@aitne/daemon 0.1.7 → 0.1.9

package/dist/bootstrap/event-pipeline.d.ts

@@ -0,0 +1,329 @@
+/**
+ * Event-processing pipeline bootstrap — §10 of the legacy `startup()` IIFE.
+ *
+ * Extracted from `index.ts` per
+ * `docs/design/appendices/index-bootstrap-stage-split.md` Phase B-4.
+ * Companion to `bootstrap/db.ts`, `bootstrap/adapters.ts`,
+ * `bootstrap/services.ts`, `bootstrap/observers.ts`, and `bootstrap/api.ts`;
+ * same Pattern-C shape (file-split-plan.md §10).
+ *
+ * Responsibilities (in run order — preserves the §10 ordering invariants
+ * captured by the design doc's §11):
+ *  1. Construct the four agent backends (Claude / Codex / Gemini / Opencode)
+ *     and wire the per-session MCP context onto each.
+ *  2. Run the boot janitors that close orphaned proxy / pool / delegated-task
+ *     tempdirs and rows so the dispatcher starts from a clean state.
+ *  3. Construct `DelegatedBackendInvoker`, `NotificationManager`, and
+ *     `AuthTelemetry`. The shared `makeAuthNotifier` factory binds the
+ *     monitor + recovery surfaces to the same notification pipeline.
+ *  4. Build the `BackendRouter` with its `prepareSessionDir` fallback
+ *     re-materialization callback (CLAUDE.md invariant: a Claude→Codex
+ *     fallback would otherwise leave the dir with only CLAUDE.md and no
+ *     AGENTS.md). Validates the built-in skill source tree + delegated
+ *     mode startup contracts before any execute.
+ *  5. Construct `ContextBuilder`, `SessionManager`, `MessageRecorder`,
+ *     `EventBroadcaster`, `AuditLogger`. Build `rematerializeActiveDmWorkdirs`
+ *     and install it as the real `onMailScopeChanged` handler via the
+ *     `setMailScopeChangedHandler` dep (forward-reference resolved).
+ *  6. Construct `MigrationLock`, `ContextWriteGate`, `SignalDetector`,
+ *     `ScopedReadSensitiveTokenManager`, then the `EventDispatcher`. Apply
+ *     every dispatcher setter (signal detector, docs citation lookup,
+ *     dashboard stream fan-out, attachment store, event broadcaster, voice
+ *     transcriber, auth recovery/monitor, delegated-sync refresh, bang
+ *     command registry, skill curation hooks).
+ *  7. Construct `AuthHealthMonitor` + `AuthRecovery` (after dispatcher so
+ *     the `isMorningRoutineActive` closure resolves immediately). Reconcile
+ *     in-flight recoveries, fire the initial keepalive sweep, and arm the
+ *     daily sweep timer.
+ *  8. Wire the roadmap-refresh trampoline through `setRoadmapRefreshSink`
+ *     so the observer pollers built in B-2 can emit refresh signals now
+ *     that the dispatcher exists.
+ *  9. Build the on-demand `buildDelegatedSyncWorker` + register it when at
+ *     least one integration is in `delegated` mode. Register the
+ *     `DelegatedProbeObserver` so the §4.5 connector-health cache stays
+ *     fresh.
+ *  10. Return the cross-stage closures (`handleSecretChange`,
+ *      `handleGoogleServicesReady`, `handlePromptContextChanged`,
+ *      `rematerializeActiveDmWorkdirs`) the B-3 API factory and the
+ *      `index.ts` post-startup-complete flush consume.
+ *
+ * Ordering invariants this module preserves (design §11):
+ *  - Wiki token resolver (B-1) and `mergeRuntimeSettingsFromDb` (B-1) run
+ *    before this factory is invoked. The dispatcher reads the merged
+ *    config directly.
+ *  - Orphan dashboard_chat session close (B-1) runs before SessionManager
+ *    is constructed here.
+ *  - Fallback re-materialization is wired into BackendRouter before any
+ *    backend fallback can occur — the closure lives inside this factory,
+ *    same lexical proximity as the pre-extraction code.
+ *  - The roadmap-refresh sink (`setRoadmapRefreshSink` dep) is installed
+ *    immediately after the dispatcher is constructed but BEFORE
+ *    `observerManager.startAll()` runs (which happens later in `index.ts`).
+ *  - `handleSecretChange` and `handleGoogleServicesReady` are returned
+ *    rather than registered here — the B-3 api factory wires the former
+ *    into `ApiDependencies.onSecretChanged` and `index.ts` composes the
+ *    latter with the `startupComplete`/`pendingGoogleServicesReady`
+ *    deferral wrapper before threading the wrapper into B-3 via
+ *    `onGoogleServicesReady`.
+ *
+ * Test surface (per design doc §10):
+ *  - `createSecretChangeHandler` — exported for the scope-routing matrix
+ *    test (slack, telegram, discord, notion, github, google, apple_calendar,
+ *    apiToken, unknown). The Notion hot-register branch's three gates
+ *    (services.notion, observerManager.has, notionDatabaseIds.length,
+ *    shouldStartObserversFor) are pinned here. The GitHub webhook-mode
+ *    upgrade branch's two gates (getGitWatcher non-null, secretState.
+ *    githubWebhookConfigured) are pinned here.
+ *  - `createGoogleServicesReadyHandler` — exported for the calendar
+ *    hot-register / morning-routine gate / roadmap-refresh test matrix.
+ */
+import type Database from "better-sqlite3";
+import type { AgentConfig } from "../config.js";
+import type { EventBus } from "../core/event-bus.js";
+import { EventDispatcher } from "../core/dispatcher.js";
+import { SignalDetector } from "../core/signal-detector.js";
+import { SessionManager } from "../core/session-manager.js";
+import { MessageRecorder } from "../core/message-recorder.js";
+import { ScopedReadSensitiveTokenManager } from "../core/read-sensitive-token-manager.js";
+import { ContextWriteGate, MigrationLock, type TodayWriteLockManager } from "../core/today-write-lock.js";
+import type { RoadmapWriteLockManager } from "../core/roadmap-write-lock.js";
+import { type PromptContextChangedCallback } from "../core/context-staleness.js";
+import { type OpencodeServerManager } from "../core/backends/opencode-server-manager.js";
+import { AuthTelemetry } from "../core/backends/auth-telemetry.js";
+import { AuthHealthMonitor } from "../core/backends/auth-health-monitor.js";
+import { AuthRecovery } from "../core/backends/auth-recovery.js";
+import type { IAgentCore } from "../core/agent-core.js";
+import { type RefreshDmSessionWorkdirsResult } from "../core/workdir.js";
+import { AuditLogger } from "../safety/audit.js";
+import type { AgentWriteTracker } from "../safety/agent-write-tracker.js";
+import { NotificationManager } from "../adapters/notification-manager.js";
+import type { MessageHub } from "../adapters/message-hub.js";
+import type { DashboardAdapter } from "../adapters/dashboard-adapter.js";
+import { DocsQAAdapter } from "../adapters/docs-qa-adapter.js";
+import { EventBroadcaster } from "../api/routes/sse.js";
+import type { ServiceRegistry } from "../services/service-registry.js";
+import type { EncryptedBlobStore } from "../secrets/encrypted-blob-store.js";
+import type { SecretBroker } from "../secrets/secret-broker.js";
+import type { AttachmentStore } from "../services/attachments/store.js";
+import { DelegatedBackendInvoker } from "../services/delegated-backend-invoker.js";
+import { DelegatedSyncWorker } from "../observers/delegated-sync-worker.js";
+import type { ObserverManager } from "../observers/manager.js";
+import type { GitWatcher } from "../observers/git-watcher.js";
+import type { CalendarPoller } from "../observers/calendar-poller.js";
+import type { NotionPoller } from "../observers/notion-poller.js";
+import type { AgentScheduler } from "../core/scheduler.js";
+import type { BootstrapSecretState } from "./services.js";
+/**
+ * Result returned by {@link rematerializeActiveDmWorkdirs} — null when
+ * there are no active DM sessions to refresh.
+ */
+export interface DmWorkdirRefreshResult {
+    readonly summary: RefreshDmSessionWorkdirsResult;
+    readonly mailAccounts: ReadonlyArray<unknown>;
+}
+export interface BootstrapEventPipelineDeps {
+    readonly db: Database.Database;
+    readonly config: AgentConfig;
+    readonly eventBus: EventBus;
+    readonly secretBroker: SecretBroker;
+    readonly blobStore: EncryptedBlobStore;
+    readonly writeTracker: AgentWriteTracker;
+    readonly services: ServiceRegistry;
+    readonly messageHub: MessageHub;
+    readonly dashboardAdapter: DashboardAdapter;
+    readonly attachmentStore: AttachmentStore;
+    readonly morningRoutineLock: TodayWriteLockManager;
+    readonly roadmapWriteLock: RoadmapWriteLockManager;
+    readonly secretState: BootstrapSecretState;
+    readonly observerManager: ObserverManager;
+    readonly buildCalendarPoller: () => CalendarPoller | null;
+    readonly buildNotionPoller: () => NotionPoller | null;
+    readonly getGitWatcher: () => GitWatcher | null;
+    readonly reloadDiscordAdapter: (force: boolean) => Promise<void>;
+    readonly reloadSlackAdapter: (force: boolean) => Promise<void>;
+    readonly reloadTelegramAdapter: (force: boolean) => Promise<void>;
+    readonly reloadGoogleServices: () => Promise<void>;
+    readonly reloadAppleCalendarService: () => Promise<void>;
+    readonly reloadNotionService: () => Promise<void>;
+    readonly reloadGitHubService: () => Promise<void>;
+    readonly scheduler: AgentScheduler;
+    /**
+     * Reads index.ts's `startupComplete` latch. Threaded through to the
+     * `handleSecretChange("notion")` hot-register branch so it can avoid
+     * double-starting the poller during the bootstrap window — see
+     * `SecretChangeHandlerDeps.isStartupComplete` for the full rationale.
+     */
+    readonly isStartupComplete: () => boolean;
+    /**
+     * `MailAccountRegistry` was built in `index.ts` §6 with a placeholder
+     * `onScopeChanged`. This setter installs the real handler once
+     * `rematerializeActiveDmWorkdirs` + `eventBroadcaster` exist (mid-§10
+     * in the pre-extraction code).
+     */
+    readonly setMailScopeChangedHandler: (cb: (reason: string) => void) => void;
+    /**
+     * Observer pollers (built in B-2 before the dispatcher exists) call a
+     * `triggerRoadmapRefresh` trampoline that forwards to a `let` slot in
+     * `index.ts`. This setter fills the slot with
+     * `dispatcher.emitRoadmapRefresh` immediately after dispatcher
+     * construction — observers don't fire the trampoline until
+     * `observerManager.startAll()` runs further down in `index.ts`, by
+     * which time the sink is installed.
+     */
+    readonly setRoadmapRefreshSink: (sink: (source: string) => void) => void;
+    /**
+     * Test-only override for the opencode server manager. Production passes
+     * the real `createOpencodeServerManager()` factory implicitly; peer
+     * tests of higher-level wiring inject a no-op stub.
+     */
+    readonly opencodeServerManager?: OpencodeServerManager;
+}
+export interface BootstrapEventPipelineResult {
+    readonly dispatcher: EventDispatcher;
+    readonly sessionManager: SessionManager;
+    readonly messageRecorder: MessageRecorder;
+    readonly notificationManager: NotificationManager;
+    readonly signalDetector: SignalDetector;
+    readonly eventBroadcaster: EventBroadcaster;
+    readonly auditLogger: AuditLogger;
+    readonly docsQAAdapter: DocsQAAdapter;
+    readonly agentBackends: IAgentCore[];
+    readonly opencodeServerManager: OpencodeServerManager;
+    readonly delegatedBackendInvoker: DelegatedBackendInvoker;
+    readonly authHealthMonitor: AuthHealthMonitor;
+    readonly authRecovery: AuthRecovery;
+    readonly authTelemetry: AuthTelemetry;
+    readonly readTokenManager: ScopedReadSensitiveTokenManager;
+    readonly migrationLock: MigrationLock;
+    readonly contextWriteGate: ContextWriteGate;
+    readonly buildDelegatedSyncWorker: () => DelegatedSyncWorker;
+    readonly getDelegatedSyncWorker: () => DelegatedSyncWorker | null;
+    readonly rematerializeActiveDmWorkdirs: (reason: string) => DmWorkdirRefreshResult | null;
+    readonly handleSecretChange: (scope: string) => Promise<void>;
+    readonly handleGoogleServicesReady: () => void;
+    readonly handlePromptContextChanged: PromptContextChangedCallback;
+    /** Daily auth-health keepalive sweep timer; cleared during graceful shutdown. */
+    readonly keepaliveTimer: NodeJS.Timeout;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 ask_user + §5.1 pending-queue
+     * timeout. 30 s tick that sweeps overdue clarifications + queue
+     * timeouts. Cleared during graceful shutdown alongside the keepalive
+     * timer so the daemon process can exit cleanly.
+     */
+    readonly browserTaskDeadlineTimer: NodeJS.Timeout;
+    /**
+     * Shared in-memory slot state for the browser-task surface. The
+     * runner and the API route layer hold THIS instance (not a copy)
+     * so a cancel-while-pending and a runner-side promote race on the
+     * same value.
+     */
+    readonly browserTaskSlotStateRef: import("../services/browser-task/browser-task-runner.js").SlotStateRef;
+    /**
+     * Per-install browser-task runner. Phase 1 ships without
+     * `driver` wired so the runner returns `failed (not_implemented)`
+     * after acquiring + releasing the slot (state-machine round-trip
+     * still exercised). Phase 2 plumbs the Playwright + Claude SDK
+     * driver into the same factory call.
+     */
+    readonly browserTaskRunner: import("../services/browser-task/browser-task-runner.js").BrowserTaskRunner;
+}
+/**
+ * Construct the event-processing pipeline (§10). See the file-level
+ * docstring for the run order and the ordering invariants this factory
+ * preserves.
+ */
+export declare function createEventPipeline(deps: BootstrapEventPipelineDeps): Promise<BootstrapEventPipelineResult>;
+export interface SecretChangeHandlerDeps {
+    readonly db: Database.Database;
+    readonly config: AgentConfig;
+    readonly services: ServiceRegistry;
+    readonly observerManager: ObserverManager;
+    readonly secretState: BootstrapSecretState;
+    readonly buildNotionPoller: () => NotionPoller | null;
+    readonly getGitWatcher: () => GitWatcher | null;
+    /**
+     * Reads index.ts's `startupComplete` latch. Used by the notion hot-
+     * register branch to decide whether to call `poller.start()`
+     * explicitly: pre-startup the pending `observerManager.startAll()`
+     * will start it; post-startup the call site owns starting it since
+     * `startAll()` has already finished. Without this gate the poller's
+     * `setInterval` slot leaks (the start methods overwrite `this.timer`
+     * unconditionally — see `notion-poller.ts:91` and `calendar-poller.ts:63`).
+     * Mirrors the `pendingGoogleServicesReady` deferral pattern in index.ts.
+     */
+    readonly isStartupComplete: () => boolean;
+    readonly reloadSlackAdapter: (force: boolean) => Promise<void>;
+    readonly reloadTelegramAdapter: (force: boolean) => Promise<void>;
+    readonly reloadDiscordAdapter: (force: boolean) => Promise<void>;
+    readonly reloadNotionService: () => Promise<void>;
+    readonly reloadGitHubService: () => Promise<void>;
+    readonly reloadGoogleServices: () => Promise<void>;
+    readonly reloadAppleCalendarService: () => Promise<void>;
+}
+/**
+ * Build the `handleSecretChange(scope)` closure consumed by the API
+ * surface's `onSecretChanged` hook. Exported so the peer test can pin
+ * the scope-routing matrix without booting a real dispatcher.
+ *
+ * The matrix MUST stay in sync with `docs/design/appendices/
+ * index-bootstrap-stage-split.md` §10 (test bullet 1):
+ *
+ *   scope            → reload + hot-register branches
+ *   "slack"          → reloadSlackAdapter(force=true)
+ *   "telegram"       → reloadTelegramAdapter(force=true)
+ *   "discord"        → reloadDiscordAdapter(force=true)
+ *   "notion"         → reloadNotionService; then if services.notion
+ *                      && !observerManager.has("notion-poller")
+ *                      && notionDatabaseIds.length > 0
+ *                      && shouldStartObserversFor(db, "notion")
+ *                      → register + start a freshly-built poller
+ *   "github"         → reloadGitHubService; then if getGitWatcher()
+ *                      && secretState.githubWebhookConfigured
+ *                      → enableWebhookMode on the existing watcher
+ *   "google"         → reloadGoogleServices
+ *   "apple_calendar" → reloadAppleCalendarService
+ *   "apiToken"       → no-op (a token rotation only affects future
+ *                      request authentication; nothing here is keyed on it)
+ *   default          → no-op (unknown scope is silently ignored to keep
+ *                      forward-compat with new secret kinds)
+ */
+export declare function createSecretChangeHandler(deps: SecretChangeHandlerDeps): (scope: string) => Promise<void>;
+export interface GoogleServicesReadyHandlerDeps {
+    readonly db: Database.Database;
+    readonly config: AgentConfig;
+    readonly services: ServiceRegistry;
+    readonly observerManager: ObserverManager;
+    readonly buildCalendarPoller: () => CalendarPoller | null;
+    readonly scheduler: Pick<AgentScheduler, "queueMorningRoutineWake">;
+    readonly dispatcher: Pick<EventDispatcher, "emitRoadmapRefresh">;
+}
+/**
+ * Build the `handleGoogleServicesReady` closure consumed when an OAuth
+ * round-trip leaves a fresh Google credential in the keychain mid-runtime.
+ * Exported so the peer test can pin the morning-routine / roadmap-refresh
+ * matrix without booting a real dispatcher.
+ *
+ * Branches (per design doc §10 test bullets 2 + 3):
+ *   - services.calendar set AND google_calendar in `direct` AND no
+ *     calendar observer registered yet → build + start a poller.
+ *   - today.md stale → `scheduler.queueMorningRoutineWake("google_auth_ready")`
+ *     and SKIP the standalone roadmap refresh (the morning routine's
+ *     post-completion hook handles roadmap).
+ *   - today.md fresh AND roadmap stale → `dispatcher.emitRoadmapRefresh
+ *     ("google_auth_ready")`.
+ */
+export declare function createGoogleServicesReadyHandler(deps: GoogleServicesReadyHandlerDeps): () => void;
+export interface PromptContextChangedHandlerDeps {
+    readonly config: AgentConfig;
+    readonly db: Database.Database;
+    readonly dispatcher: Pick<EventDispatcher, "getCurrentSetupMode">;
+    readonly sessionManager: Pick<SessionManager, "markActiveDmSessionsStale">;
+}
+/**
+ * Build the `handlePromptContextChanged` callback consumed by the
+ * context-index reconciler and by the API surface's
+ * `onPromptContextChanged` hook. Exported for symmetry with the other
+ * cross-stage closures; the staleness decision logic itself lives in
+ * `core/context-staleness.ts` (and is unit-tested there).
+ */
+export declare function createPromptContextChangedHandler(deps: PromptContextChangedHandlerDeps): PromptContextChangedCallback;