@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/agents/success-criteria.d.ts

@@ -0,0 +1,60 @@
+import type Database from "better-sqlite3";
+import type { SuccessCriterion } from "@aitne/shared";
+/**
+ * Success-criteria evaluator (AGENT_DEFINITIONS_DESIGN.md §8.3).
+ *
+ * A **pure** post-execution check over an Agent's `success_criteria` array. It
+ * takes the already-resolved `contextDir` (rather than resolving it from daemon
+ * config) so the module is unit-testable against a temp vault and has no config
+ * coupling — the same shape `evening-review-verify.ts` uses.
+ *
+ * Best-effort semantics: every criterion is evaluated inside its own try/catch,
+ * so a filesystem error or DB hiccup on one criterion records `false` + a
+ * structured warning and the *others* still evaluate. A throw never flips the
+ * execution's `result` field (that reflects the LLM-level outcome; criteria are
+ * the orthogonal semantic layer the dashboard multiplies in). Warnings are
+ * returned rather than logged in-module so the evaluator stays logger-free and
+ * pure; the dispatcher-result-processor (Phase 7) logs them with execution
+ * context.
+ *
+ * Timestamp domains (§5.1 note): `agent_executions.started_at` is epoch-ms while
+ * `notification_log.created_at` / `agent_actions.started_at` are SQLite
+ * `CURRENT_TIMESTAMP` UTC strings. The two DB-backed criteria bind the epoch-ms
+ * anchor through `datetime(?/1000.0, 'unixepoch')` so the comparison is
+ * string-vs-string in the same `YYYY-MM-DD HH:MM:SS` UTC format.
+ *
+ * Delivery semantics: the `notification_log` criterion counts only rows whose
+ * `status` reflects the owner actually receiving the notification — see
+ * `NOTIFICATION_DELIVERED_STATUSES` below.
+ */
+/** Everything a criterion needs, resolved once per execution by the recorder. */
+export interface CriteriaEvalContext {
+    db: Database.Database;
+    /** Resolved context-vault root (`getContextDir`). */
+    contextDir: string;
+    /** `agents.id` (slug) — scopes the `agent_action_count` criterion. */
+    agentId: string;
+    /** Epoch-ms execution start — anchors both time-window criteria. */
+    startedAt: number;
+    /** Agent-day `YYYY-MM-DD` label, substituted into every `{date}` placeholder. */
+    dateStr: string;
+}
+/** Structured per-criterion warning the caller logs (best-effort failures). */
+export interface CriterionWarning {
+    id: string;
+    kind: SuccessCriterion["kind"];
+    message: string;
+}
+export interface SuccessCriteriaResult {
+    /** `criterion.id → met?`; written verbatim to `success_criteria_json`. */
+    hits: Record<string, boolean>;
+    /** Non-fatal evaluation problems (unresolvable path, DB error, …). */
+    warnings: CriterionWarning[];
+}
+/**
+ * Evaluate every criterion best-effort and return the `{ hits, warnings }`
+ * rollup. `hits` is written verbatim to `agent_executions.success_criteria_json`
+ * (keyed by `criterion.id` — the shared schema enforces id uniqueness, so no
+ * sibling can be silently overwritten).
+ */
+export declare function evaluateSuccessCriteria(criteria: readonly SuccessCriterion[], ctx: CriteriaEvalContext): SuccessCriteriaResult;

package/dist/core/agents/success-criteria.js

@@ -0,0 +1,139 @@
+import { existsSync, readFileSync } from "node:fs";
+import { safePath } from "../../api/routes/context/path-resolve.js";
+/** Replace every `{date}` occurrence in a target path with the agent-day label. */
+function substituteDate(target, dateStr) {
+    return target.split("{date}").join(dateStr);
+}
+/**
+ * Count ATX markdown headings whose hash-run length is *exactly* `level` — a
+ * `###` does NOT count toward a `##`/level-2 floor. Lines inside fenced code
+ * blocks (``` ``` ``` or `~~~`, up to 3 leading spaces) are skipped so a `## x`
+ * in an example block never inflates the count. A heading allows 0–3 leading
+ * spaces (4+ is an indented code block in CommonMark) and is terminated by a
+ * space, a tab, or end-of-line (an empty `##` heading still counts).
+ */
+function countHeadings(markdown, level) {
+    const lines = markdown.split(/\r?\n/);
+    let inFence = false;
+    let fenceChar = "";
+    let count = 0;
+    for (const line of lines) {
+        const fence = line.match(/^ {0,3}(`{3,}|~{3,})/);
+        if (fence) {
+            const char = fence[1][0];
+            if (!inFence) {
+                inFence = true;
+                fenceChar = char;
+            }
+            else if (char === fenceChar) {
+                inFence = false;
+                fenceChar = "";
+            }
+            continue;
+        }
+        if (inFence)
+            continue;
+        const heading = line.match(/^ {0,3}(#{1,6})(?: |\t|$)/);
+        if (heading && heading[1].length === level)
+            count += 1;
+    }
+    return count;
+}
+function evalFileExists(criterion, ctx) {
+    const target = substituteDate(criterion.target, ctx.dateStr);
+    const abs = safePath(ctx.contextDir, target);
+    if (abs === null) {
+        return { hit: false, warning: `unresolvable or out-of-vault target "${target}"` };
+    }
+    return { hit: existsSync(abs) };
+}
+function evalFileSectionCount(criterion, ctx) {
+    const target = substituteDate(criterion.target, ctx.dateStr);
+    const abs = safePath(ctx.contextDir, target);
+    if (abs === null) {
+        return { hit: false, warning: `unresolvable or out-of-vault target "${target}"` };
+    }
+    // An absent file is a legitimate criterion miss (the output was not produced),
+    // not an error — return false without a warning. A present-but-unreadable file
+    // (e.g. a directory at the path → EISDIR) throws out to the loop's catch.
+    if (!existsSync(abs)) {
+        return { hit: false };
+    }
+    const body = readFileSync(abs, "utf-8");
+    return { hit: countHeadings(body, criterion.heading_level) >= criterion.min };
+}
+// A notification only counts as *delivered* (the criterion is named
+// `delivered_within_minutes`) when it actually reached the owner. The two
+// terminal statuses that mean "the owner never received it" are excluded:
+//   - 'failed'     — delivery errored (notification-manager.ts:387/551).
+//   - 'suppressed' — deliberately withheld: quiet hours, dedup, or a batch
+//     window that expired without flushing (notification-manager.ts:436+).
+// 'delivered' (sent now) and 'batched' (folded into a digest the owner does
+// receive) both count. Matching every row regardless of status — as the bare
+// §8.3 prose literal did — would let a *failed* digest satisfy a
+// `dm_digest_delivered` check, reporting success for a notification the owner
+// never saw. (The column is window-bounded on `created_at` because
+// `delivered_at` is nullable; status is the always-populated delivery verdict.)
+const NOTIFICATION_DELIVERED_STATUSES = "('delivered', 'batched')";
+function evalNotificationLog(criterion, ctx) {
+    const upperMs = ctx.startedAt + criterion.delivered_within_minutes * 60_000;
+    const row = ctx.db
+        .prepare(`SELECT 1 AS present FROM notification_log
+        WHERE notification_type = ?
+          AND status IN ${NOTIFICATION_DELIVERED_STATUSES}
+          AND created_at >= datetime(?/1000.0, 'unixepoch')
+          AND created_at <= datetime(?/1000.0, 'unixepoch')
+        LIMIT 1`)
+        .get(criterion.notification_type, ctx.startedAt, upperMs);
+    return { hit: row !== undefined };
+}
+function evalAgentActionCount(criterion, ctx) {
+    const row = ctx.db
+        .prepare(`SELECT COUNT(*) AS n FROM agent_actions
+        WHERE agent_id = ?
+          AND action_type = ?
+          AND started_at >= datetime(?/1000.0, 'unixepoch')`)
+        .get(ctx.agentId, criterion.action_type, ctx.startedAt);
+    // COUNT(*) always returns exactly one row, so `row` is defined.
+    return { hit: row.n >= criterion.min };
+}
+function evaluateOne(criterion, ctx) {
+    switch (criterion.kind) {
+        case "file_exists":
+            return evalFileExists(criterion, ctx);
+        case "file_section_count":
+            return evalFileSectionCount(criterion, ctx);
+        case "notification_log":
+            return evalNotificationLog(criterion, ctx);
+        case "agent_action_count":
+            return evalAgentActionCount(criterion, ctx);
+    }
+}
+/**
+ * Evaluate every criterion best-effort and return the `{ hits, warnings }`
+ * rollup. `hits` is written verbatim to `agent_executions.success_criteria_json`
+ * (keyed by `criterion.id` — the shared schema enforces id uniqueness, so no
+ * sibling can be silently overwritten).
+ */
+export function evaluateSuccessCriteria(criteria, ctx) {
+    const hits = {};
+    const warnings = [];
+    for (const criterion of criteria) {
+        try {
+            const outcome = evaluateOne(criterion, ctx);
+            hits[criterion.id] = outcome.hit;
+            if (outcome.warning !== undefined) {
+                warnings.push({ id: criterion.id, kind: criterion.kind, message: outcome.warning });
+            }
+        }
+        catch (err) {
+            hits[criterion.id] = false;
+            warnings.push({
+                id: criterion.id,
+                kind: criterion.kind,
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return { hits, warnings };
+}

package/dist/core/agents/validate-agent-md.d.ts

@@ -0,0 +1,17 @@
+/** True for the canonical user agent-definition path this module validates. */
+export declare function isAgentDefinitionPath(relativePath: string): boolean;
+/**
+ * Validate an `agent.md` payload at the context-vault write boundary, mirroring
+ * the `POST /api/agents` (`planCreate`) shape check: parse the YAML frontmatter
+ * with `parseAgentFrontmatter`, then `agentDefinitionSchema.safeParse`. Returns
+ * a single human-readable message on failure (the route maps it to HTTP 400) or
+ * `null` when the payload is well-formed.
+ *
+ * Deeper semantic cross-checks (`process_key` ∈ live `PROCESS_KEYS`, skill /
+ * tool-pattern / absolute-block checks, slug-vs-builtin collision) stay the
+ * loader's job — they need `db` + the live skill list and run on the watcher
+ * reload, exactly as they do for the `POST /api/agents` path. The `slug`-vs-path
+ * cross-check IS done here because it is cheap, path-local, and a common
+ * copy-paste mistake the loader would otherwise only surface asynchronously.
+ */
+export declare function validateAgentDefinitionMarkdown(relativePath: string, content: string): string | null;

package/dist/core/agents/validate-agent-md.js

@@ -0,0 +1,64 @@
+import { agentDefinitionSchema } from "@aitne/shared";
+import { AgentFrontmatterError, parseAgentFrontmatter } from "./agent-frontmatter.js";
+/**
+ * User Agent definitions written through the context-vault chokepoint live at
+ * `policies/agents/<slug>/agent.md` (AGENT_DEFINITIONS_DESIGN.md §3.3 / §9.5).
+ *
+ * They carry the deeply-nested `agentDefinitionSchema` frontmatter
+ * (`slug`/`name`/`kind`/`schedule`/`backend`/…) — NOT the flat
+ * `type`/`owner`/`updated` context-vault rule frontmatter — so the generic
+ * `validateContextFileFrontmatter` validator must skip them (see
+ * `shouldValidateContextFileFrontmatter`), and this module owns their
+ * write-boundary shape check instead.
+ */
+const AGENT_DEFINITION_PATH_RE = /^policies\/agents\/([^/]+)\/agent\.md$/;
+/** True for the canonical user agent-definition path this module validates. */
+export function isAgentDefinitionPath(relativePath) {
+    return AGENT_DEFINITION_PATH_RE.test(relativePath);
+}
+/**
+ * Validate an `agent.md` payload at the context-vault write boundary, mirroring
+ * the `POST /api/agents` (`planCreate`) shape check: parse the YAML frontmatter
+ * with `parseAgentFrontmatter`, then `agentDefinitionSchema.safeParse`. Returns
+ * a single human-readable message on failure (the route maps it to HTTP 400) or
+ * `null` when the payload is well-formed.
+ *
+ * Deeper semantic cross-checks (`process_key` ∈ live `PROCESS_KEYS`, skill /
+ * tool-pattern / absolute-block checks, slug-vs-builtin collision) stay the
+ * loader's job — they need `db` + the live skill list and run on the watcher
+ * reload, exactly as they do for the `POST /api/agents` path. The `slug`-vs-path
+ * cross-check IS done here because it is cheap, path-local, and a common
+ * copy-paste mistake the loader would otherwise only surface asynchronously.
+ */
+export function validateAgentDefinitionMarkdown(relativePath, content) {
+    const match = AGENT_DEFINITION_PATH_RE.exec(relativePath);
+    /* c8 ignore next — callers gate on isAgentDefinitionPath; defensive guard. */
+    if (!match)
+        return null;
+    const pathSlug = match[1];
+    let frontmatter;
+    try {
+        ({ frontmatter } = parseAgentFrontmatter(content));
+    }
+    catch (err) {
+        // parseAgentFrontmatter only ever throws AgentFrontmatterError.
+        /* c8 ignore next */
+        if (!(err instanceof AgentFrontmatterError))
+            throw err;
+        return err.message;
+    }
+    const parsed = agentDefinitionSchema.safeParse(frontmatter);
+    if (!parsed.success) {
+        // Mirror `planCreate`'s issue rendering: every agentDefinitionSchema issue
+        // carries a non-empty path (field name or superRefine path), which the
+        // caller surfaces verbatim.
+        const issues = parsed.error.issues
+            .map((i) => `${i.path.join(".")}: ${i.message}`)
+            .join("; ");
+        return `agent definition invalid: ${issues}`;
+    }
+    if (parsed.data.slug !== pathSlug) {
+        return `agent definition slug "${parsed.data.slug}" must match the directory name "${pathSlug}".`;
+    }
+    return null;
+}

package/dist/core/alerts.d.ts

@@ -83,4 +83,3 @@ export interface AlertInputs {
     delegationUpgradeAvailable: boolean;
 }
 export declare function aggregateAlerts(inputs: AlertInputs): Alert[];
-//# sourceMappingURL=alerts.d.ts.map

package/dist/core/alerts.js

@@ -301,4 +301,3 @@ export function aggregateAlerts(inputs) {
         return b.detectedAt.localeCompare(a.detectedAt);
     });
 }
-//# sourceMappingURL=alerts.js.map

package/dist/core/atomic-write.d.ts

@@ -48,4 +48,3 @@
  * - Any underlying I/O failure from `open` / `write` / `rename`.
  */
 export declare function writeFileAtomically(fullPath: string, content: string): void;
-//# sourceMappingURL=atomic-write.d.ts.map

package/dist/core/atomic-write.js

@@ -66,12 +66,19 @@ export function writeFileAtomically(fullPath, content) {
     // Refuse to overwrite a symlink at the final path. lstat is racy on its
     // own — the actual TOCTOU defense is the rename below — but surfacing
     // the symlink early gives a clearer error than letting rename quietly
-    // replace an attacker's link.
+    // replace an attacker's link. Also reuse the lstat result to preserve
+    // the existing file's permission bits — a fresh `openSync(..., 0o644)`
+    // would silently widen a 0o600 file (e.g. sensitive dossier / policy)
+    // on every write.
+    let createMode = 0o600;
     try {
         const targetStat = lstatSync(fullPath);
         if (targetStat.isSymbolicLink()) {
             throw Object.assign(new Error(`atomic-write: refusing to overwrite symlink: ${fullPath}`), { code: "EATOMIC_TARGET_SYMLINK" });
         }
+        if (targetStat.isFile()) {
+            createMode = targetStat.mode & 0o777;
+        }
     }
     catch (err) {
         const code = err.code;
@@ -82,17 +89,24 @@ export function writeFileAtomically(fullPath, content) {
         if (code !== "ENOENT")
             throw err;
         /* c8 ignore stop */
-        // ENOENT is expected when the file does not exist yet.
+        // ENOENT is expected when the file does not exist yet — `createMode`
+        // stays at the conservative 0o600 default. Context MD files contain
+        // operator PII / plans; defaulting to owner-only is safer than the
+        // historical 0o644.
     }
     // Random suffix prevents an attacker from pre-placing a symlink at our
     // temp path even if they can guess the pid. 16 hex chars = 64 bits of
     // entropy, more than enough for collision avoidance.
     const tempPath = `${fullPath}.tmp.${process.pid}.${randomBytes(8).toString("hex")}`;
+    // O_NOFOLLOW is undefined on Windows (Node defines it only on POSIX). This is
+    // already cross-platform-safe: a bitwise OR coerces `undefined` to 0
+    // (ToInt32(undefined) === 0), so on Windows it contributes nothing while
+    // macOS/Linux keep the real symlink-refusal semantics.
     const flags = fsConstants.O_WRONLY |
         fsConstants.O_CREAT |
         fsConstants.O_EXCL |
         fsConstants.O_NOFOLLOW;
-    const fd = openSync(tempPath, flags, 0o644);
+    const fd = openSync(tempPath, flags, createMode);
     try {
         const buf = Buffer.from(content, "utf-8");
         let offset = 0;
@@ -132,4 +146,3 @@ export function writeFileAtomically(fullPath, content) {
         throw err;
     }
 }
-//# sourceMappingURL=atomic-write.js.map

package/dist/core/backends/api-key-probe.d.ts

@@ -37,4 +37,3 @@ export type ApiKeyProvider = "anthropic" | "openai" | "google";
  * cache to `expired`.
  */
 export declare function probeApiKeyServerSide(provider: ApiKeyProvider, apiKey: string): Promise<ApiKeyProbeResult>;
-//# sourceMappingURL=api-key-probe.d.ts.map

package/dist/core/backends/api-key-probe.js

@@ -113,4 +113,3 @@ export async function probeApiKeyServerSide(provider, apiKey) {
     // any non-definitive failure should leave the DB cache untouched.
     throw new Error(`${config.label} probe returned unexpected HTTP ${response.status}`);
 }
-//# sourceMappingURL=api-key-probe.js.map

package/dist/core/backends/auth-health-monitor.d.ts

@@ -370,4 +370,3 @@ export declare class AuthHealthMonitor {
      */
     runKeepaliveSweep(): Promise<BackendId[]>;
 }
-//# sourceMappingURL=auth-health-monitor.d.ts.map

package/dist/core/backends/auth-health-monitor.js

@@ -536,6 +536,11 @@ export class AuthHealthMonitor {
                 continue;
             }
             const core = this.cores[backendId];
+            // Defensive: the snapshot loop above already filtered backends
+            // without a registered core, so this branch is unreachable in
+            // steady state. Kept as a load-bearing guard if the cores map
+            // ever mutates mid-tick.
+            /* c8 ignore next */
             if (!core)
                 continue;
             let result;
@@ -680,6 +685,9 @@ export class AuthHealthMonitor {
      * it AND incorrectly advances our escalation bookkeeping.
      */
     shouldNotify(current, prev, quietHours) {
+        // Defensive: caller (runCheckAll) filters ok before invoking. Kept
+        // so a future caller that skips the filter still gets a safe answer.
+        /* c8 ignore next */
         if (current.status === "ok")
             return false;
         // First observation in this failure session — wait for next tick so
@@ -688,6 +696,11 @@ export class AuthHealthMonitor {
         if (!prev || prev.status === "ok" || prev.status === "unknown") {
             return false;
         }
+        // Defensive: persistCheckResult stamps firstExpiredAt on every
+        // ok→non-ok transition, so any row whose status is non-ok past the
+        // guard above also has firstExpiredAt set. Kept so a hand-edited
+        // row still produces a safe answer rather than NaN math downstream.
+        /* c8 ignore next */
         if (!prev.firstExpiredAt)
             return false;
         const nowMs = this.now().getTime();
@@ -703,6 +716,10 @@ export class AuthHealthMonitor {
         return this.hasEscalationElapsed(prev, nowMs);
     }
     hasEscalationElapsed(prev, nowMs) {
+        // Defensive: only caller `shouldNotify` invokes this AFTER its own
+        // `!prev.notifiedAt` early return, so notifiedAt is always set when
+        // we get here. Kept as a typesafe assertion.
+        /* c8 ignore next */
         if (!prev.notifiedAt)
             return false;
         const minutesSince = (nowMs - prev.notifiedAt.getTime()) / 60_000;
@@ -729,6 +746,9 @@ export class AuthHealthMonitor {
         const nowMs = this.now().getTime();
         const sharpTone = items.some((item) => {
             const first = item.prev?.firstExpiredAt;
+            // Defensive: shouldNotify upstream guarantees every item in
+            // `toNotify` has prev.firstExpiredAt set.
+            /* c8 ignore next */
             if (!first)
                 return false;
             return (nowMs - first.getTime()) / 86_400_000 >= URGENT_TONE_DAYS;
@@ -739,6 +759,9 @@ export class AuthHealthMonitor {
         const lines = [header, ""];
         for (const { backendId, result, prev } of items) {
             const detail = result.detail ?? result.status;
+            // Defensive: see sharpTone block above; shouldNotify guarantees
+            // firstExpiredAt is set on every item that reaches this loop.
+            /* c8 ignore next 3 */
             const since = prev?.firstExpiredAt
                 ? ` (${formatElapsed(nowMs - prev.firstExpiredAt.getTime())} elapsed)`
                 : "";
@@ -858,11 +881,16 @@ export class AuthHealthMonitor {
                     .run(now.toISOString(), now.toISOString(), backendId);
                 this.telemetry.recordKeepaliveReminder(backendId);
                 reminded.push(backendId);
+                // DB stamp failure after successful notify; SQLite virtually
+                // never throws after a write completes, but we leave the catch
+                // in place so a hard disk error or schema-locked race surfaces
+                // a warning instead of bubbling up to the caller.
+                /* c8 ignore start */
             }
             catch (err) {
-                /* v8 ignore next 4 — DB stamp failure after successful notify; SQLite rarely throws after write */
                 logger.warn({ err, backendId }, "runKeepaliveSweep: DB stamp failed after notify (may re-send next sweep)");
             }
+            /* c8 ignore stop */
         }
         return reminded;
     }
@@ -942,9 +970,7 @@ function defaultRecoveryCommand(backendId) {
             return "codex login";
         case "gemini":
             return "gemini";
-        /* v8 ignore next 2 — unreachable: BackendId is a closed union of the three cases above */
-        default:
-            return `${backendId} auth`;
+        case "opencode":
+            return "opencode auth login";
     }
 }
-//# sourceMappingURL=auth-health-monitor.js.map

package/dist/core/backends/auth-recovery.d.ts

@@ -260,4 +260,3 @@ export declare class AuthRecovery {
      */
     private incrementRecovery;
 }
-//# sourceMappingURL=auth-recovery.d.ts.map

package/dist/core/backends/auth-recovery.js

@@ -252,10 +252,19 @@ export class AuthRecovery {
         if (this.shuttingDown) {
             throw new Error("Daemon is shutting down, cannot start recovery.");
         }
+        // Windows npm installs resolve `codex`/`claude` to a .cmd/.bat shim that
+        // spawn() cannot exec without a shell (ENOENT). POSIX resolves to
+        // extensionless binaries, so the regex is false there and shell stays
+        // false. When the shell IS used, Node hands the command line to cmd.exe
+        // verbatim without auto-quoting, so a cliPath containing spaces
+        // (`C:\Program Files\…`) must be double-quoted; the static args are safe
+        // literals needing no quoting.
+        const useShell = process.platform === "win32" && /\.(cmd|bat)$/i.test(cliPath);
         // Spawn `codex login --device-auth`
-        const child = spawn(cliPath, ["login", "--device-auth"], {
+        const child = spawn(useShell ? `"${cliPath}"` : cliPath, ["login", "--device-auth"], {
             stdio: ["pipe", "pipe", "pipe"],
             env: { ...process.env, TERM: "dumb", NO_COLOR: "1" },
+            shell: useShell,
         });
         // Parse device code from stdout (collected until first \n\n after code)
         const deviceInfo = await this.waitForDeviceCode(child);
@@ -336,10 +345,15 @@ export class AuthRecovery {
         if (this.shuttingDown) {
             throw new Error("Daemon is shutting down, cannot start recovery.");
         }
+        // See the device-auth spawn above: win32 .cmd/.bat shims need a shell;
+        // when the shell is used the cliPath must be double-quoted for paths with
+        // spaces, and POSIX stays shell:false on extensionless binaries.
+        const useShell = process.platform === "win32" && /\.(cmd|bat)$/i.test(cliPath);
         // Spawn with BROWSER=echo to suppress daemon-initiated browser launch
-        const child = spawn(cliPath, ["auth", "login", "--claudeai"], {
+        const child = spawn(useShell ? `"${cliPath}"` : cliPath, ["auth", "login", "--claudeai"], {
             stdio: ["pipe", "pipe", "pipe"],
             env: { ...process.env, TERM: "dumb", NO_COLOR: "1", BROWSER: "echo" },
+            shell: useShell,
         });
         // Parse OAuth URL from stdout
         const authUrl = await this.waitForClaudeAuthUrl(child);
@@ -901,7 +915,7 @@ export class AuthRecovery {
             }
             else {
                 // Write `expired` back — the recovering subprocess no longer
-                // owns the row. Uses FIRST_EXPIRED_CASE_SQL (M4 fix) so that
+                // owns the row. Uses FIRST_EXPIRED_CASE_SQL so that
                 // `auth_first_expired_at` is preserved from the pre-recovery
                 // state (the ELSE/COALESCE branch handles `recovering` →
                 // `expired`). The `WHERE auth_status = 'recovering'` guard
@@ -1083,4 +1097,3 @@ function removeGeminiOAuthCredsBackup() {
         // Best-effort
     }
 }
-//# sourceMappingURL=auth-recovery.js.map

package/dist/core/backends/auth-telemetry.d.ts

@@ -78,4 +78,3 @@ export declare class AuthTelemetry {
     /** Delete telemetry rows older than `days` days (retention GC). */
     pruneOlderThan(days: number): number;
 }
-//# sourceMappingURL=auth-telemetry.d.ts.map

package/dist/core/backends/auth-telemetry.js

@@ -105,4 +105,3 @@ export class AuthTelemetry {
         return Number(info.changes);
     }
 }
-//# sourceMappingURL=auth-telemetry.js.map

package/dist/core/backends/backend-router.d.ts

@@ -44,7 +44,7 @@ export interface RouterExecuteParams {
      * tier does NOT match, `resolveBinding` will swap in a canonical model for
      * the requested tier on the same backend (e.g. Pro preset pins
      * `routine.hourly_check` to Sonnet; `requestedTier: "heavy"` swaps to
-     * `claude-opus-4-7`). This is the ONLY path through which the three
+     * `claude-opus-4-8`). This is the ONLY path through which the three
      * explicit-Opus escape hatches (dashboard chat picker, agent_schedule.model,
      * `/api/agent/run-now {requestedModel}`) can reach Opus on Pro plan.
      *
@@ -107,6 +107,12 @@ export interface RouterExecuteParams {
      *  Forwarded verbatim on both main and fallback execute paths so the
      *  URL-fetch widening survives a Claude → Codex fallback. */
     wikiUrlFetchEnabled?: boolean;
+    /** AGENT_DEFINITIONS_DESIGN.md §4.2 — see `AgentExecuteParams.extraSkills`.
+     *  Forwarded verbatim on both main and fallback execute paths so the
+     *  firing Agent's added skills survive a Claude → Codex fallback. */
+    extraSkills?: readonly string[];
+    /** AGENT_DEFINITIONS_DESIGN.md §4.2 — see `AgentExecuteParams.skillsReplace`. */
+    skillsReplace?: boolean;
 }
 export interface RouterResumeParams {
     backendId: BackendId;
@@ -144,8 +150,18 @@ export interface IAgentRouter {
  * the session dir was materialized for Claude (`CLAUDE.md` + `.claude/skills/`)
  * and lacks `AGENTS.md`. Without this hook, the fallback core runs in a dir
  * missing its instruction file.
+ *
+ * `messageText` is the inbound DM text (for `MessageEvent` only) that
+ * feeds the `gmailLifestyleActiveForDm` / `managedTasksActiveForDm`
+ * predicates. Threading it on the fallback path keeps the fallback's
+ * `<skill-index>` block and `.codex/skills/` (or `.gemini/skills/`)
+ * directory in sync with the main backend's manifest decision — without
+ * it, a Claude→Codex DM fallback would re-materialize with the
+ * conservative-include defaults (both conditional skills always loaded)
+ * even when the main side correctly dropped them, leaking asymmetric
+ * skill sets across the two backends mid-turn.
  */
-export type PrepareSessionDirFn = (sessionDir: string, backendId: BackendId, eventType: string, processKey?: ProcessKey, wikiWorkspaceName?: string) => void;
+export type PrepareSessionDirFn = (sessionDir: string, backendId: BackendId, eventType: string, processKey?: ProcessKey, wikiWorkspaceName?: string, messageText?: string | null) => void;
 export declare class BackendRouter implements IAgentRouter {
     private readonly db;
     private readonly config;
@@ -281,6 +297,32 @@ export declare class BackendRouter implements IAgentRouter {
     private loadGlobalDefaults;
     private isWebSearchEnabled;
     private hasTable;
+    /**
+     * BROWSER_HISTORY_INTEGRATION_PLAN §10.3 — backend safety floor check.
+     * Returns null when the resolved binding satisfies the floor (or no
+     * floor applies to the process key); returns a violation otherwise.
+     *
+     * The floor is consulted via `getBrowserHistorySafetyFloor`, a
+     * static map keyed by process key. When a new high-sensitivity
+     * integration ships, it registers its own floor map and routes
+     * through a similar lookup; this helper is the single chokepoint.
+     *
+     * Validates BOTH `binding.main` and `binding.fallback`. The earlier
+     * implementation only checked main, which left a security gap: for
+     * `routine.research_dispatch` (Claude-only — non-negotiable per the
+     * design), a main=Claude / fallback=Codex configuration would pass
+     * the gate, but a decisive failure on Claude would then run the
+     * routine on Codex through `executeFallbackCore`, violating the
+     * floor silently. §10.3 is explicit: "There is no fallback to
+     * 'best effort with prose deny' — the design's threat model assumes
+     * the enforcement surface holds; running without it is not a
+     * graceful degradation, it is a security regression."
+     */
+    private checkSafetyFloor;
+    private evaluateSafetyFloorForBackend;
+    private executionModeFor;
+    private logSafetyFloorRefusal;
+    private dmSafetyFloorOnce;
     private handleNoFallbackFailure;
     private handleFallbackFailure;
     private notifyFallbackSuccess;
@@ -296,4 +338,3 @@ export declare class BackendRouter implements IAgentRouter {
     private isMaxBudgetFailure;
 }
 export {};
-//# sourceMappingURL=backend-router.d.ts.map