@aitne/daemon 0.1.7 → 0.1.9

package/dist/api/routes/dashboard/snapshots.js

@@ -0,0 +1,32 @@
+export function registerSnapshotsRoutes(app, deps) {
+    const { db } = deps;
+    // ── Snapshots API ──
+    /** GET /snapshots/content/:id — single snapshot content */
+    app.get("/snapshots/content/:id", (c) => {
+        const id = Number(c.req.param("id"));
+        if (!Number.isSafeInteger(id) || id <= 0) {
+            return c.json({ error: "invalid id" }, 400);
+        }
+        const row = db
+            .prepare("SELECT id, file_path, content, trigger, created_at FROM md_file_snapshots WHERE id = ?")
+            .get(id);
+        if (!row)
+            return c.json({ error: "not_found" }, 404);
+        return c.json(row);
+    });
+    /** GET /snapshots/* — snapshot history for a context file */
+    app.get("/snapshots/*", (c) => {
+        const filePath = c.req.path.replace("/api/snapshots/", "");
+        // Validate: reject path traversal and unsafe characters
+        if (!filePath || /\.\./.test(filePath) || !/^[\w./-]+$/.test(filePath)) {
+            return c.json({ error: "invalid file path" }, 400);
+        }
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        const rows = db
+            .prepare(`SELECT id, file_path, trigger, session_id, created_at
+         FROM md_file_snapshots WHERE file_path = ?
+         ORDER BY created_at DESC LIMIT ?`)
+            .all(filePath, limit);
+        return c.json({ snapshots: rows });
+    });
+}

package/dist/api/routes/delegated-sync.d.ts

@@ -1,4 +1,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createDelegatedSyncRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=delegated-sync.d.ts.map

package/dist/api/routes/delegated-sync.js

@@ -189,4 +189,3 @@ export function createDelegatedSyncRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=delegated-sync.js.map

package/dist/api/routes/delegated.d.ts

@@ -25,10 +25,11 @@ import type { ApiDependencies } from "../server.js";
  *
  * Risk tier: **Approve** (Bearer required) per §4.2 "wider blast radius
  * than /exec, so the dashboard / setup flow gates it." This deliberately
- * differs from `/api/integrations/:key/invoke` and `/api/integrations/:key/exec`
- * (Autonomous), where `state.deniedTools` is the chokepoint — `/run` has
- * no integration to apply a deny list against, so the trust trigger moves
- * up to Bearer-gated invocation.
+ * differs from `/api/integrations/:key/exec` (Autonomous), where
+ * `state.deniedTools` is the chokepoint — `/run` has no integration to
+ * apply a deny list against, so the trust trigger moves up to Bearer-
+ * gated invocation. (The retired `/api/integrations/:key/invoke` RPC
+ * route was likewise Autonomous before its 2026-05-01 retirement.)
  *
  * Note on §13 acceptance ("invoked from a Claude DM session"): DM agents do
  * not carry the dashboard's Bearer token, so the literal acceptance flow is
@@ -39,4 +40,3 @@ import type { ApiDependencies } from "../server.js";
  * registry — both are deferrable.
  */
 export declare function createDelegatedRunRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=delegated.d.ts.map

package/dist/api/routes/delegated.js

@@ -29,10 +29,11 @@ const logger = createLogger("delegated-run-api");
  *
  * Risk tier: **Approve** (Bearer required) per §4.2 "wider blast radius
  * than /exec, so the dashboard / setup flow gates it." This deliberately
- * differs from `/api/integrations/:key/invoke` and `/api/integrations/:key/exec`
- * (Autonomous), where `state.deniedTools` is the chokepoint — `/run` has
- * no integration to apply a deny list against, so the trust trigger moves
- * up to Bearer-gated invocation.
+ * differs from `/api/integrations/:key/exec` (Autonomous), where
+ * `state.deniedTools` is the chokepoint — `/run` has no integration to
+ * apply a deny list against, so the trust trigger moves up to Bearer-
+ * gated invocation. (The retired `/api/integrations/:key/invoke` RPC
+ * route was likewise Autonomous before its 2026-05-01 retirement.)
  *
  * Note on §13 acceptance ("invoked from a Claude DM session"): DM agents do
  * not carry the dashboard's Bearer token, so the literal acceptance flow is
@@ -233,7 +234,7 @@ function mapTaskErrorClassToHttpStatus(errorClass) {
 /**
  * Clamp a numeric request-body field to [min, max], applying `defaultValue`
  * when omitted. Returns null on invalid input. Mirrors the helper in
- * `routes/integrations.ts:clampNumber` — same shape kept local to avoid
+ * `routes/integrations/exec.ts:clampNumber` — same shape kept local to avoid
  * cross-route imports of trivial utilities.
  */
 function clampNumber(raw, defaultValue, min, max, allowFloat = false) {
@@ -247,4 +248,3 @@ function clampNumber(raw, defaultValue, min, max, allowFloat = false) {
         return null;
     return raw;
 }
-//# sourceMappingURL=delegated.js.map

package/dist/api/routes/docs.d.ts

@@ -31,4 +31,3 @@ export declare function createDocsRoutesFromDeps(deps: Pick<ApiDependencies, "db
     indexer?: DocsIndexerHandle;
     docsQAAdapter?: DocsQAAdapter;
 }): Hono;
-//# sourceMappingURL=docs.d.ts.map

package/dist/api/routes/docs.js

@@ -2,8 +2,28 @@ import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { z } from "zod";
 import { createLogger } from "../../logging.js";
+import { composeIssue, respondWithAgentError } from "../helpers/agent-errors.js";
 import { buildMatchExpression, isAsciiOnlyQuery } from "../../services/fts5.js";
-import { DEFAULT_CLAUDE_MEDIUM_MODEL, findRegisteredModel, getModelLabel, getModelsForBackend, latestMediumFor, } from "../../core/backends/model-registry.js";
+import { DEFAULT_CLAUDE_MEDIUM_MODEL, DEFAULT_CODEX_MEDIUM_MODEL, DEFAULT_GEMINI_MEDIUM_MODEL, DEFAULT_OPENCODE_MEDIUM_MODEL, findRegisteredModel, getModelLabel, getModelsForBackend, latestMediumFor, } from "../../core/backends/model-registry.js";
+/**
+ * Per-backend medium-tier default used by the docs-QA picker when the
+ * registry has no live medium model for the backend (registry pruned,
+ * everything marked deprecated, etc.). Keeps the fallback symmetric across
+ * backends rather than handing claude a real model and leaving opencode/
+ * codex/gemini with an empty string when the row also has no `main_model`.
+ */
+function defaultMediumModelFor(backendId) {
+    switch (backendId) {
+        case "claude":
+            return DEFAULT_CLAUDE_MEDIUM_MODEL;
+        case "codex":
+            return DEFAULT_CODEX_MEDIUM_MODEL;
+        case "gemini":
+            return DEFAULT_GEMINI_MEDIUM_MODEL;
+        case "opencode":
+            return DEFAULT_OPENCODE_MEDIUM_MODEL;
+    }
+}
 import { DOCS_QA_SCOPE, DOCS_QA_SCOPE_KEY, } from "../../messaging/constants.js";
 const logger = createLogger("docs-api");
 const SEARCH_LIMIT_DEFAULT = 5;
@@ -19,6 +39,7 @@ const BACKEND_DISPLAY_LABELS = {
     claude: "Claude Code",
     codex: "OpenAI Codex",
     gemini: "Gemini CLI",
+    opencode: "OpenCode",
 };
 const searchQuerySchema = z.object({
     q: z.string().min(1).max(500),
@@ -127,7 +148,12 @@ export function createDocsRoutes(deps) {
            FROM fts_docs WHERE slug = ?`)
             .get(slug);
         if (!row) {
-            return c.json({ error: "doc_not_found", slug }, 404);
+            return respondWithAgentError(c, 404, [
+                composeIssue("docs.doc_not_found", {
+                    field: "slug",
+                    received: slug,
+                }),
+            ], { legacyFields: { slug } });
         }
         return c.json({
             slug: row.slug,
@@ -374,8 +400,14 @@ export function createDocsRoutes(deps) {
         // returns the first registered+available medium model; the Claude
         // fallback covers the edge case where no medium model is registered
         // yet.
+        // Medium-tier fallback ladder. Behaviour preserved per-backend, with
+        // the trailing `""` for non-claude replaced by the canonical
+        // per-backend default so opencode/codex/gemini land on a real model
+        // when the registry has no live medium model AND the row is empty.
         const mediumModel = latestMediumFor(backend) ??
-            (backend === "claude" ? DEFAULT_CLAUDE_MEDIUM_MODEL : row?.main_model ?? "");
+            (backend === "claude"
+                ? DEFAULT_CLAUDE_MEDIUM_MODEL
+                : row?.main_model ?? defaultMediumModelFor(backend));
         // Medium-tier models the picker offers for this backend. High-tier
         // (Opus etc.) are filtered out so the picker cannot bypass
         // `dashboard.docs_qa`'s TIER_LOCK by routing through `requestedModelId`
@@ -407,16 +439,31 @@ export function createDocsRoutes(deps) {
     // caller).
     app.post("/docs/qa/messages", async (c) => {
         if (!docsQAAdapter) {
-            return c.json({ error: "qa_adapter_unavailable" }, 503);
+            return respondWithAgentError(c, 503, [
+                composeIssue("docs.qa_adapter_unavailable", {
+                    field: "<server>",
+                    received: "<not_wired>",
+                }),
+            ]);
         }
         const body = await c.req.json().catch(() => null);
         const parsed = qaMessageSchema.safeParse(body);
         if (!parsed.success) {
-            return c.json({ error: "validation_error", details: parsed.error.flatten() }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("docs.validation_error", {
+                    field: "body",
+                    received: body,
+                }),
+            ], { legacyFields: { details: parsed.error.flatten() } });
         }
         if (!docsQAAdapter.isConnected(parsed.data.channelId)) {
             logger.warn({ channelId: parsed.data.channelId }, "Docs QA POST rejected — channel not connected");
-            return c.json({ error: "channel_not_connected" }, 404);
+            return respondWithAgentError(c, 404, [
+                composeIssue("docs.channel_not_connected", {
+                    field: "channelId",
+                    received: parsed.data.channelId,
+                }),
+            ]);
         }
         // Validate any picker-supplied modelId against the resolved backend.
         // The dispatcher's (requestedBackendId, requestedModelId) hard override
@@ -429,10 +476,21 @@ export function createDocsRoutes(deps) {
             const backend = resolveDocsQABackend(db, readDocsQABackendRow(db));
             const registered = findRegisteredModel(backend, parsed.data.modelId);
             if (!registered || !registered.available) {
-                return c.json({ error: "model_not_registered", modelId: parsed.data.modelId }, 400);
+                return respondWithAgentError(c, 400, [
+                    composeIssue("docs.model_not_registered", {
+                        field: "modelId",
+                        received: parsed.data.modelId,
+                    }),
+                ], { legacyFields: { modelId: parsed.data.modelId } });
             }
             if (registered.tier !== "medium") {
-                return c.json({ error: "model_tier_locked", modelId: parsed.data.modelId }, 400);
+                return respondWithAgentError(c, 400, [
+                    composeIssue("docs.model_tier_locked", {
+                        field: "modelId",
+                        received: parsed.data.modelId,
+                        expected: "medium-tier model",
+                    }),
+                ], { legacyFields: { modelId: parsed.data.modelId } });
             }
             modelOverride = { backendId: backend, modelId: registered.modelId };
         }
@@ -450,7 +508,12 @@ export function createDocsRoutes(deps) {
     // ── GET /api/docs/qa/stream — SSE outbound channel ──
     app.get("/docs/qa/stream", (c) => {
         if (!docsQAAdapter) {
-            return c.json({ error: "qa_adapter_unavailable" }, 503);
+            return respondWithAgentError(c, 503, [
+                composeIssue("docs.qa_adapter_unavailable", {
+                    field: "<server>",
+                    received: "<not_wired>",
+                }),
+            ]);
         }
         const adapter = docsQAAdapter;
         return streamSSE(c, async (stream) => {
@@ -577,4 +640,3 @@ function rebindDocsQASessionChannel(db, newChannelId) {
 export function createDocsRoutesFromDeps(deps, extra = {}) {
     return createDocsRoutes({ db: deps.db, ...extra });
 }
-//# sourceMappingURL=docs.js.map

package/dist/api/routes/entities.d.ts

@@ -6,4 +6,3 @@ export interface EntitiesRoutesDeps {
 }
 export declare function createEntitiesRoutes(deps: EntitiesRoutesDeps): Hono;
 export declare function buildEntitiesRoutesDepsFromApi(deps: ApiDependencies): EntitiesRoutesDeps;
-//# sourceMappingURL=entities.d.ts.map

package/dist/api/routes/entities.js

@@ -1,6 +1,7 @@
 import { Hono } from "hono";
 import { isDomain, isEntityType } from "@aitne/shared";
 import { findEntitiesByDomainTypeDate, findEntitiesBySource, findEntitiesBySourceKey, getEntityByPath, } from "../../db/entities-store.js";
+import { composeIssue, respondWithAgentError } from "../helpers/agent-errors.js";
 /**
  * Entity-mirror lookup contract (docs/design/21-management-registry-and-
  * entities.md §7.6).
@@ -9,7 +10,7 @@ import { findEntitiesByDomainTypeDate, findEntitiesBySource, findEntitiesBySourc
  *   query params (mutually exclusive shapes):
  *     • source=<app>&external_id=<eid>      → tier-1 exact match
  *     • source=<app>[&limit=N]              → list-by-source bias
- *                                            (management-task-register §10.1
+ *                                            (managed-tasks skill `## Register`
  *                                            Step 4a — pick the (domain,
  *                                            type) already dominant for app)
  *     • domain=<d>&type=<t>&date=<YYYY-MM-DD>[&q=<title>]
@@ -57,16 +58,28 @@ export function createEntitiesRoutes(deps) {
         const hasTier2 = domain !== undefined || type !== undefined ||
             date !== undefined;
         if (hasTier1 && hasTier2) {
-            return c.json({
-                error: "ambiguous_query",
-                message: "use either (source, external_id) or (domain, type, date) — not both",
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.ambiguous_query", {
+                    field: "query",
+                    received: { source, externalId, domain, type, date },
+                }),
+            ], {
+                legacyFields: {
+                    message: "use either (source, external_id) or (domain, type, date) — not both",
+                },
+            });
         }
         if (!hasTier1 && !hasTier2) {
-            return c.json({
-                error: "missing_query",
-                message: "provide (source, external_id) or (domain, type, date) query parameters",
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.missing_query", {
+                    field: "query",
+                    received: "<empty>",
+                }),
+            ], {
+                legacyFields: {
+                    message: "provide (source, external_id) or (domain, type, date) query parameters",
+                },
+            });
         }
         if (hasTier1) {
             // `source` alone is the bias query (Step 4a of §10.1) — list all
@@ -78,10 +91,15 @@ export function createEntitiesRoutes(deps) {
                 if (limitRaw !== undefined) {
                     const n = Number.parseInt(limitRaw, 10);
                     if (!Number.isFinite(n) || n < 1) {
-                        return c.json({
-                            error: "validation_error",
-                            message: "`limit` must be a positive integer",
-                        }, 400);
+                        return respondWithAgentError(c, 400, [
+                            composeIssue("entities.validation_error", {
+                                field: "limit",
+                                received: limitRaw,
+                                expected: "positive integer",
+                            }),
+                        ], {
+                            legacyFields: { message: "`limit` must be a positive integer" },
+                        });
                     }
                     limit = n;
                 }
@@ -93,10 +111,22 @@ export function createEntitiesRoutes(deps) {
                 });
             }
             if (!source || !externalId) {
-                return c.json({
-                    error: "validation_error",
-                    message: "`external_id` requires `source`; provide `source=<app>&external_id=<eid>` for tier-1 exact match, or `source=<app>` alone for the bias query",
-                }, 400);
+                return respondWithAgentError(c, 400, [
+                    composeIssue("entities.validation_error", {
+                        // The `source && !externalId` branch above already returns,
+                        // so by the time we reach here `source` is necessarily falsy
+                        // (only `external_id` alone could land us in this if).
+                        // Keep the ternary as a defensive label and ignore the dead arm.
+                        /* c8 ignore next */
+                        field: source ? "external_id" : "source",
+                        received: { source, externalId },
+                        expected: "(source, external_id) pair for tier-1 exact match",
+                    }),
+                ], {
+                    legacyFields: {
+                        message: "`external_id` requires `source`; provide `source=<app>&external_id=<eid>` for tier-1 exact match, or `source=<app>` alone for the bias query",
+                    },
+                });
             }
             const items = findEntitiesBySource(db, source, externalId);
             return c.json({
@@ -105,39 +135,66 @@ export function createEntitiesRoutes(deps) {
                 items: items.map(toResponse),
             });
         }
-        // tier-2
+        // Tier-2 fallback — domain/type/date triple is required for the
+        // structured lookup below.
         if (!domain || !type || !date) {
-            return c.json({
-                error: "validation_error",
-                message: "tier-2 lookup requires `domain`, `type`, and `date` (ISO YYYY-MM-DD)",
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.validation_error", {
+                    field: !domain ? "domain" : !type ? "type" : "date",
+                    received: { domain, type, date },
+                    expected: "tier-2 triple (domain, type, date)",
+                }),
+            ], {
+                legacyFields: {
+                    message: "tier-2 lookup requires `domain`, `type`, and `date` (ISO YYYY-MM-DD)",
+                },
+            });
         }
         if (!isDomain(domain)) {
-            return c.json({
-                error: "validation_error",
-                message: `unknown domain "${domain}"`,
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.validation_error", {
+                    field: "domain",
+                    received: domain,
+                    expected: "registered domain enum (see Domain in @aitne/shared)",
+                }),
+            ], { legacyFields: { message: `unknown domain "${domain}"` } });
         }
         if (!isEntityType(type)) {
-            return c.json({
-                error: "validation_error",
-                message: `unknown type "${type}" (singular form expected, e.g. "meeting")`,
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.validation_error", {
+                    field: "type",
+                    received: type,
+                    expected: "singular entity type (e.g. 'meeting', not 'meetings')",
+                }),
+            ], {
+                legacyFields: {
+                    message: `unknown type "${type}" (singular form expected, e.g. "meeting")`,
+                },
+            });
         }
         if (!ISO_DATE_RE.test(date)) {
-            return c.json({
-                error: "validation_error",
-                message: "`date` must be ISO YYYY-MM-DD",
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.validation_error", {
+                    field: "date",
+                    received: date,
+                    expected: "ISO YYYY-MM-DD",
+                    constraint: { type: "string", pattern: "^\\d{4}-\\d{2}-\\d{2}$" },
+                }),
+            ], { legacyFields: { message: "`date` must be ISO YYYY-MM-DD" } });
         }
         let limit;
         if (limitRaw !== undefined) {
             const n = Number.parseInt(limitRaw, 10);
             if (!Number.isFinite(n) || n < 1) {
-                return c.json({
-                    error: "validation_error",
-                    message: "`limit` must be a positive integer",
-                }, 400);
+                return respondWithAgentError(c, 400, [
+                    composeIssue("entities.validation_error", {
+                        field: "limit",
+                        received: limitRaw,
+                        expected: "positive integer",
+                    }),
+                ], {
+                    legacyFields: { message: "`limit` must be a positive integer" },
+                });
             }
             limit = n;
         }
@@ -158,14 +215,27 @@ export function createEntitiesRoutes(deps) {
     app.get("/entities/by-path", (c) => {
         const path = c.req.query("path");
         if (!path) {
-            return c.json({
-                error: "missing_query",
-                message: "provide `path` query parameter (e.g. work/meetings/foo.md)",
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("entities.missing_query", {
+                    field: "path",
+                    received: "<missing>",
+                    expected: "vault-relative entity path",
+                }),
+            ], {
+                legacyFields: {
+                    message: "provide `path` query parameter (e.g. knowledge/entities/work/meetings/foo.md)",
+                },
+            });
         }
         const item = getEntityByPath(db, path);
-        if (!item)
-            return c.json({ error: "not_found" }, 404);
+        if (!item) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("entities.not_found", {
+                    field: "path",
+                    received: path,
+                }),
+            ]);
+        }
         return c.json({ item: toResponse(item) });
     });
     return app;
@@ -173,4 +243,3 @@ export function createEntitiesRoutes(deps) {
 export function buildEntitiesRoutesDepsFromApi(deps) {
     return { db: deps.db };
 }
-//# sourceMappingURL=entities.js.map

package/dist/api/routes/fs.d.ts

@@ -20,4 +20,3 @@ import type { ApiDependencies } from "../server.js";
  * filesystem call is made.
  */
 export declare function createFsRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=fs.d.ts.map

package/dist/api/routes/fs.js

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { normalizeRequestedPath } from "./fs.logic.js";
 import { validateWikiRootPath } from "../../core/wiki/workspaces.js";
 import { probeExistingWikiVault } from "../../core/wiki/import-probe.js";
+import { composeIssue, respondWithAgentError } from "../helpers/agent-errors.js";
 /**
  * Wiki vault probe route — supports the dashboard's external-mode
  * picker (WIKI_BUILDER_DESIGN.md §6.1 "External vault path").
@@ -28,21 +29,35 @@ export function createFsRoutes(deps) {
     app.get("/fs/probe", (c) => {
         const rawPath = c.req.query("path");
         if (rawPath === undefined) {
-            return c.json({ error: "missing_path", message: "Query param `path` is required." }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("fs.missing_path", {
+                    field: "path",
+                    received: "<missing>",
+                }),
+            ], { legacyFields: { message: "Query param `path` is required." } });
         }
         const norm = normalizeRequestedPath(rawPath);
         if (!norm.ok) {
-            return c.json({
-                ok: false,
-                error: norm.error,
-                message: norm.message,
-                exists: false,
-                isDir: false,
-                writable: false,
-                collision: null,
-                hasObsidianStructure: false,
-                existingWiki: null,
-            }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("fs.invalid_path", {
+                    field: "path",
+                    received: rawPath,
+                    /* c8 ignore next — normalizeRequestedPath always sets `message` on failure; the fallback is defensive in case a future error path forgets to. */
+                    expected: norm.message ?? "absolute path outside the system blocklist",
+                }),
+            ], {
+                legacyErrorCode: norm.error,
+                legacyFields: {
+                    ok: false,
+                    message: norm.message,
+                    exists: false,
+                    isDir: false,
+                    writable: false,
+                    collision: null,
+                    hasObsidianStructure: false,
+                    existingWiki: null,
+                },
+            });
         }
         const absPath = norm.path;
         const exists = existsSync(absPath);
@@ -153,4 +168,3 @@ function mapValidationError(error) {
         /* c8 ignore stop */
     }
 }
-//# sourceMappingURL=fs.js.map

package/dist/api/routes/fs.logic.d.ts

@@ -59,4 +59,3 @@ export type NormalizeResult = {
     message: string;
 };
 export type NormalizeError = "invalid_path" | "relative_path" | "forbidden_prefix" | "secret_path";
-//# sourceMappingURL=fs.logic.d.ts.map

package/dist/api/routes/fs.logic.js

@@ -77,7 +77,12 @@ export const SECRET_ABS_PATTERNS = [
     /(^|\/)id_ed25519(\..*)?$/,
 ];
 export function isSecretPath(absPath) {
-    return SECRET_ABS_PATTERNS.some((re) => re.test(absPath));
+    // SECRET_ABS_PATTERNS are POSIX-slash anchored, so a backslash-delimited
+    // Windows path (e.g. `C:\Users\me\.ssh\id_rsa`) would slip past them.
+    // Normalising separators is inert on macOS/Linux (legitimate secret-dir
+    // paths there contain no backslashes) and closes the Windows gap.
+    const p = absPath.replace(/\\/g, "/");
+    return SECRET_ABS_PATTERNS.some((re) => re.test(p));
 }
 export function isUnderForbidden(absPath) {
     // Exemptions take precedence — a path under `/var/folders/...`
@@ -134,4 +139,3 @@ export function normalizeRequestedPath(raw) {
     }
     return { ok: true, path: absPath };
 }
-//# sourceMappingURL=fs.logic.js.map

package/dist/api/routes/git-accounts.d.ts

@@ -20,4 +20,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createGitAccountsRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=git-accounts.d.ts.map

package/dist/api/routes/git-accounts.js

@@ -224,4 +224,3 @@ function wireRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=git-accounts.js.map

package/dist/api/routes/git-templates.d.ts

@@ -47,4 +47,3 @@ export interface GitTemplatesRouteDependencies {
     getContextDir: () => string;
 }
 export declare function createGitTemplatesRoutes(deps: GitTemplatesRouteDependencies): Hono;
-//# sourceMappingURL=git-templates.d.ts.map