@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/backend-router.js

@@ -1,4 +1,4 @@
-import { backendHasIntegrationConnector, delegatedIntegrationsForProcessKey, getDefaultTierForProcessKey, isCustomRoutineKey, isProcessKey, nativeIntegrationsForProcessKey, resolveProcessKey, TIER_LOCKED_PROCESS_KEYS, } from "@aitne/shared";
+import { backendHasIntegrationConnector, delegatedIntegrationsForProcessKey, getBrowserHistorySafetyFloor, getDefaultTierForProcessKey, isCustomRoutineKey, isMessageEvent, isProcessKey, nativeIntegrationsForProcessKey, resolveProcessKey, TIER_LOCKED_PROCESS_KEYS, } from "@aitne/shared";
 import { readIntegrations } from "../../db/integrations-store.js";
 import { createLogger } from "../../logging.js";
 import { BackendDecisiveFailure, BackendQuotaError, } from "../agent-core.js";
@@ -15,6 +15,13 @@ const PROCESS_MAX_TURNS = {
     "routine.hourly_check": 30, // P90=25, pad for complex observation sets
     "routine.roadmap_refresh": 25, // single observed run was 13 turns
     "message.dm": 35, // most <15, allow long conversations
+    // Setup is high-tier (Opus / gpt-5.4 / Pro — Codex collapses high to
+    // gpt-5.4 via SEED_HIGH_TIER_OVERRIDE) because the rules document
+    // feeds every downstream routine. The high-tier fall-through default is
+    // 300 turns which is way past the structural shape — a setup
+    // conversation is at most ~6 turns (Q&A + 1–2 revision rounds + the
+    // final emit). Cap at 50 so a runaway loop terminates fast.
+    "setup": 50,
 };
 const NOTIFICATION_DEDUPE_WINDOW_MS = 2 * 60 * 60 * 1000;
 /**
@@ -74,6 +81,21 @@ export class BackendRouter {
             ...(params.requestedBackendId ? { requestedBackendId: params.requestedBackendId } : {}),
             ...(params.requestedModelId ? { requestedModelId: params.requestedModelId } : {}),
         });
+        // BROWSER_HISTORY_INTEGRATION_PLAN §10.3 — backend safety floor.
+        // High-sensitivity integrations declare a per-process-key allowlist
+        // of eligible backends + a forbidden-modes list. When the resolved
+        // binding violates the floor, the router refuses to execute, logs
+        // an `agent_actions(action_type='backend_floor_refused')` row, and
+        // surfaces a one-time owner DM directing the operator at
+        // /settings/models. No graceful degradation — the threat model
+        // assumes the enforcement surface holds.
+        const floorViolation = this.checkSafetyFloor(binding);
+        if (floorViolation) {
+            this.logSafetyFloorRefusal(binding, floorViolation);
+            await this.dmSafetyFloorOnce(binding, floorViolation, params.event);
+            const failure = new BackendDecisiveFailure(binding.main.backendId, "policy_denied", floorViolation.reason);
+            throw new BackendRouterHandledError(`Backend safety floor refused: ${floorViolation.reason}`, failure, failure);
+        }
         // Phase 3.3 — pre-flight auth cache check. When the main backend's
         // cached auth status is recently confirmed bad, skip straight to the
         // fallback to avoid a doomed subprocess. Only applies when a fallback
@@ -118,6 +140,10 @@ export class BackendRouter {
                 ...(params.wikiUrlFetchEnabled
                     ? { wikiUrlFetchEnabled: true }
                     : {}),
+                ...(params.extraSkills && params.extraSkills.length > 0
+                    ? { extraSkills: params.extraSkills }
+                    : {}),
+                ...(params.skillsReplace ? { skillsReplace: true } : {}),
             }, streamCallbacks);
             // Reactive self-heal: a successful execute is authoritative proof the
             // CLI held valid credentials. Bump auth_last_success_at (so the 60-day
@@ -244,7 +270,14 @@ export class BackendRouter {
                 const fallbackWikiWorkspace = typeof params.event.data?.workspace === "string"
                     ? params.event.data.workspace
                     : undefined;
-                this.prepareSessionDir(params.sessionDir, fallback.backendId, params.workdirEventType ?? params.event.type, params.workdirProcessKey ?? binding.processKey, fallbackWikiWorkspace);
+                // Phase 4 — forward the inbound DM text so the fallback
+                // re-materialise sees the same `*ForDm` trigger surface the main
+                // path saw. Non-message events get `undefined` and the predicates
+                // fall back to the base (DB-only) branch.
+                const fallbackMessageText = isMessageEvent(params.event)
+                    ? params.event.content
+                    : undefined;
+                this.prepareSessionDir(params.sessionDir, fallback.backendId, params.workdirEventType ?? params.event.type, params.workdirProcessKey ?? binding.processKey, fallbackWikiWorkspace, fallbackMessageText);
             }
             catch (err) {
                 if (opts?.isPreflight) {
@@ -293,6 +326,10 @@ export class BackendRouter {
                 ...(params.wikiUrlFetchEnabled
                     ? { wikiUrlFetchEnabled: true }
                     : {}),
+                ...(params.extraSkills && params.extraSkills.length > 0
+                    ? { extraSkills: params.extraSkills }
+                    : {}),
+                ...(params.skillsReplace ? { skillsReplace: true } : {}),
             }, streamCallbacks);
             recordReactiveAuthSuccess(this.db, fallback.backendId, this.authTelemetry);
             await this.notifyFallbackSuccess(params.event, binding.processKey, binding.main, mainFailure, fallback);
@@ -360,6 +397,80 @@ export class BackendRouter {
                 fallback: null,
             };
         }
+        // Backend-only override. Used by the routine pre-pass fan-out
+        // (`RoutineFetchWindowRunner`) so a `native` integration bound to a
+        // backend other than the configured `routine.fetch_window` backend
+        // can still spawn its sub-session on the integration's actual
+        // backend (e.g. gmail-native-codex while fetch_window default is
+        // claude).
+        //
+        // Model resolution mirrors the no-override branch's pin semantics so
+        // operator customisation is preserved when the override does not
+        // actually change the backend:
+        //   1. If `requestedBackendId === processConfig.main_backend`, reuse
+        //      `processConfig.main_model` (operator's pin). Only swap to a
+        //      canonical (backend, tier) model when an explicit
+        //      `requestedTier` mismatches the pinned model's registry tier —
+        //      this mirrors `maybeApplyTierOverride` below. Without this
+        //      branch, a Pro-preset operator who pinned `routine.fetch_window`
+        //      to Sonnet would silently get Haiku on every direct-mode
+        //      integration sub-session (the canonical lite model), because
+        //      the runner ALWAYS passes `requestedBackendId` — even for
+        //      sub-plans whose required backend equals the default.
+        //   2. Otherwise (cross-backend), the pinned model is for a
+        //      different backend and unusable. Look up the canonical model
+        //      for (requestedBackendId, resolved tier) via
+        //      `resolveDefaultModelId` (same helper the no-override branch
+        //      uses for the no-processConfig fallback path).
+        //
+        // `maxTurns`/`maxBudgetUsd` inherit from `processConfig` regardless
+        // — envelopes are per-process, not per-backend.
+        //
+        // Fallback is dropped — caller specified a backend by name, silently
+        // rerouting to a different backend would defeat the purpose of the
+        // per-integration routing (matches the dropped-fallback rule of the
+        // combined backend+model override above).
+        if (requestedBackendId) {
+            const overrideTier = this.resolveTier(processKey, requestedTier);
+            let modelId;
+            if (processConfig
+                && processConfig.main_backend === requestedBackendId) {
+                const pinnedTier = this.tierFromModelId(requestedBackendId, processConfig.main_model);
+                // Swap to canonical only when the caller passed an explicit
+                // `requestedTier` AND the pin's registry tier disagrees. An
+                // unknown `pinnedTier` (custom model) is preserved verbatim —
+                // operator chose it on purpose, same trust contract as
+                // `maybeApplyTierOverride`.
+                const shouldSwap = requestedTier !== undefined
+                    && pinnedTier !== null
+                    && pinnedTier !== overrideTier;
+                if (shouldSwap) {
+                    const defaults = this.loadGlobalDefaults();
+                    modelId = this.resolveDefaultModelId(requestedBackendId, overrideTier, defaults);
+                }
+                else {
+                    modelId = processConfig.main_model;
+                }
+            }
+            else {
+                const defaults = this.loadGlobalDefaults();
+                modelId = this.resolveDefaultModelId(requestedBackendId, overrideTier, defaults);
+            }
+            return {
+                processKey,
+                resolvedTier: overrideTier,
+                main: {
+                    backendId: requestedBackendId,
+                    modelId,
+                    maxTurns: processConfig?.max_turns ??
+                        PROCESS_MAX_TURNS[processKey] ??
+                        (overrideTier === "high" ? 300 : overrideTier === "medium" ? 50 : 20),
+                    maxBudgetUsd: processConfig?.max_budget_usd ??
+                        (overrideTier === "high" ? 5.0 : overrideTier === "medium" ? 1.0 : 0.2),
+                },
+                fallback: null,
+            };
+        }
         const resolvedTier = this.resolveTier(processKey, requestedTier);
         if (processConfig) {
             const main = this.resolveConfiguredBinding(processConfig.main_backend, processConfig.main_model, processConfig.max_turns, processConfig.max_budget_usd);
@@ -711,6 +822,116 @@ export class BackendRouter {
             .get(name);
         return !!row;
     }
+    /**
+     * BROWSER_HISTORY_INTEGRATION_PLAN §10.3 — backend safety floor check.
+     * Returns null when the resolved binding satisfies the floor (or no
+     * floor applies to the process key); returns a violation otherwise.
+     *
+     * The floor is consulted via `getBrowserHistorySafetyFloor`, a
+     * static map keyed by process key. When a new high-sensitivity
+     * integration ships, it registers its own floor map and routes
+     * through a similar lookup; this helper is the single chokepoint.
+     *
+     * Validates BOTH `binding.main` and `binding.fallback`. The earlier
+     * implementation only checked main, which left a security gap: for
+     * `routine.research_dispatch` (Claude-only — non-negotiable per the
+     * design), a main=Claude / fallback=Codex configuration would pass
+     * the gate, but a decisive failure on Claude would then run the
+     * routine on Codex through `executeFallbackCore`, violating the
+     * floor silently. §10.3 is explicit: "There is no fallback to
+     * 'best effort with prose deny' — the design's threat model assumes
+     * the enforcement surface holds; running without it is not a
+     * graceful degradation, it is a security regression."
+     */
+    checkSafetyFloor(binding) {
+        const floor = getBrowserHistorySafetyFloor(binding.processKey);
+        if (!floor)
+            return null;
+        const mainViolation = this.evaluateSafetyFloorForBackend(binding.processKey, binding.main.backendId, floor, "main");
+        if (mainViolation)
+            return mainViolation;
+        if (binding.fallback) {
+            const fallbackViolation = this.evaluateSafetyFloorForBackend(binding.processKey, binding.fallback.backendId, floor, "fallback");
+            if (fallbackViolation)
+                return fallbackViolation;
+        }
+        return null;
+    }
+    evaluateSafetyFloorForBackend(processKey, backendId, floor, side) {
+        if (!floor.eligible.includes(backendId)) {
+            return {
+                reason: `Process ${processKey} requires one of [${floor.eligible.join(", ")}] but the ${side} binding is ${backendId}. ${floor.rationale}`,
+                backendId,
+                side,
+            };
+        }
+        if (floor.forbiddenModes) {
+            const mode = this.executionModeFor(backendId);
+            const forbidden = floor.forbiddenModes.find((entry) => entry.backend === backendId && entry.mode === mode);
+            if (forbidden) {
+                return {
+                    reason: `Process ${processKey} cannot run on ${backendId} in ${mode} mode (${side} binding). ${floor.rationale}`,
+                    backendId,
+                    side,
+                };
+            }
+        }
+        return null;
+    }
+    executionModeFor(backendId) {
+        switch (backendId) {
+            case "claude":
+                return this.config.claudeExecutionPermissionMode;
+            case "codex":
+                return this.config.codexExecutionPermissionMode;
+            case "gemini":
+                return this.config.geminiExecutionPermissionMode;
+            case "opencode":
+                return this.config.opencodeExecutionPermissionMode;
+        }
+    }
+    logSafetyFloorRefusal(binding, violation) {
+        try {
+            this.db
+                .prepare(`INSERT INTO agent_actions
+             (action_type, result, error, detail)
+           VALUES (?, ?, ?, ?)`)
+                .run("backend_floor_refused", "failed", violation.reason, JSON.stringify({
+                processKey: binding.processKey,
+                backendId: violation.backendId,
+                side: violation.side,
+                executionMode: this.executionModeFor(violation.backendId),
+                reason: violation.reason,
+            }));
+        }
+        catch (err) {
+            // Defensive: an unexpected schema mismatch (e.g. agent_actions
+            // missing columns in a stale test fixture) must not block the
+            // refusal itself. The throw above still surfaces the policy.
+            logger.warn({ err, processKey: binding.processKey }, "Failed to persist backend_floor_refused audit row");
+        }
+    }
+    // BROWSER_HISTORY_INTEGRATION_PLAN §10.3 mandates a one-time DM on
+    // floor refusal so the operator notices the binding is misconfigured.
+    // Without the DM the routine silently stops running and the
+    // `agent_actions` row is only visible through the dashboard activity
+    // panel — easy to miss for a routine that runs nightly. We thread
+    // the originating event through so notifier.send can route the
+    // message on the configured owner channel.
+    async dmSafetyFloorOnce(binding, violation, event) {
+        if (!this.notifier)
+            return;
+        const dedupeKey = `backend-floor:${binding.processKey}:${violation.side}:${violation.backendId}`;
+        const message = `Browser-history routine \`${binding.processKey}\` is paused: `
+            + `your configured ${violation.side} backend (${violation.backendId}) is not in the safety floor. `
+            + `Adjust the binding in /settings/models and re-run.`;
+        logger.warn({
+            processKey: binding.processKey,
+            backendId: violation.backendId,
+            reason: violation.reason,
+        }, message);
+        await this.notifyConfiguredChannel(message, event, dedupeKey, "high");
+    }
     async handleNoFallbackFailure(event, processKey, main, failure) {
         await this.maybeSendUserFacingFailure(event, processKey, failure);
         await this.notifyConfiguredChannel(this.buildNoFallbackMessage(processKey, main, failure), event, `no-fallback:${processKey}:${main.backendId}:${this.describeFailureKind(failure)}`, "normal");
@@ -801,6 +1022,13 @@ export class BackendRouter {
                 return "The backend timed out. Please try again later.";
             case "model_unavailable":
                 return "The configured model is currently unavailable. Please select a different model in settings.";
+            case "policy_denied":
+                // maybeSendUserFacingFailure surfaces only this kind-mapped string
+                // (the raw cause never reaches the user), so keep the message
+                // self-contained and agnostic to which specific TOML rule fired —
+                // it could be curl chaining, a non-localhost host, --force on git,
+                // or any future workspace policy.
+                return "The agent tried a command that is blocked by the workspace policy. Try rephrasing your request and I'll attempt it again.";
             default:
                 return "An error occurred during backend execution. Please try again.";
         }
@@ -810,4 +1038,3 @@ export class BackendRouter {
             && failure.originalCode === "max_budget_usd";
     }
 }
-//# sourceMappingURL=backend-router.js.map

package/dist/core/backends/claude-auth.d.ts

@@ -67,4 +67,3 @@ export declare function checkAuth(deps: ClaudeAuthDeps): Promise<{
  *    refresh would race and corrupt state).
  */
 export declare function checkAuthDetailed(deps: ClaudeAuthDeps): Promise<AuthCheckResult>;
-//# sourceMappingURL=claude-auth.d.ts.map

package/dist/core/backends/claude-auth.js

@@ -195,4 +195,3 @@ export async function checkAuthDetailed(deps) {
     }
     return { ok: true, status: "ok", method: "oauth" };
 }
-//# sourceMappingURL=claude-auth.js.map

package/dist/core/backends/claude-code-core.d.ts

@@ -3,10 +3,22 @@ import type { AgentConfig } from "../../config.js";
 import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, ReadSensitiveTokenManager, StreamCallbacks } from "../agent-core.js";
 import { BackendQuotaError, BackendDecisiveFailure } from "../agent-core.js";
 import type { AgentWriteTracker } from "../../safety/agent-write-tracker.js";
+import { loadFetchWindowSystemPrompt, resetFetchWindowSystemPromptForTest } from "../fetch-window-prompt-loader.js";
 import { CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools } from "./claude-probe.js";
 import { AgentTimeoutError, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError } from "./claude-errors.js";
 import { checkAuth as checkAuthFn } from "./claude-auth.js";
 export { AgentTimeoutError, CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError, };
+/**
+ * Test-only surface: lets `claude-code-core.test.ts` exercise the
+ * fetch_window prompt loader without reaching into module internals via
+ * `as any` casts. Re-exports the shared loader (now hoisted to
+ * `core/fetch-window-prompt-loader.ts`) so the existing test import path
+ * keeps working after Phase 1.5's hoist.
+ */
+export declare const _testInternals: {
+    loadFetchWindowSystemPrompt: typeof loadFetchWindowSystemPrompt;
+    resetFetchWindowSystemPromptForTest: typeof resetFetchWindowSystemPromptForTest;
+};
 /**
  * ClaudeCodeCore intentionally does NOT run a pre-flight `checkAuth()`
  * gate inside `execute()` / `runTurn()`. Codex and Gemini each call
@@ -41,6 +53,7 @@ export declare class ClaudeCodeCore implements IAgentCore {
     readonly backendId: "claude";
     private static readonly RETRY_DELAY_MS;
     private static readonly MAX_RETRIES;
+    private static readonly NETWORK_ERROR_MESSAGE_PATTERN;
     private readonly cliPathCache;
     /** Legacy shared read token injected into the Claude subprocess env. */
     private readToken;
@@ -48,6 +61,16 @@ export declare class ClaudeCodeCore implements IAgentCore {
     private readTokenManager;
     /** B-003 Phase 3 — DB + blob store for per-session MCP materialization. */
     private mcpContext;
+    /**
+     * Lazily-constructed in-process MCP server exposing
+     * `mcp__aitne-observations__submit_observations`. Replaces the curl-to-
+     * `/api/observations/batch` path for pre-pass sessions so Unicode-
+     * whitespace-bearing mail bodies don't trip the SDK's bash preflight.
+     * Built once per ClaudeCodeCore instance (the SDK accepts the same
+     * `McpSdkServerConfigWithInstance` across multiple `query()` calls);
+     * exposure is still gated per-session by `allowedTools`.
+     */
+    private observationsMcpServer;
     /** Transparent getter — all existing `this.cliPath` references keep working. */
     private get cliPath();
     constructor(config: AgentConfig, 
@@ -63,6 +86,35 @@ export declare class ClaudeCodeCore implements IAgentCore {
     setReadToken(token: string): void;
     setReadTokenManager(manager: ReadSensitiveTokenManager): void;
     setMcpContext(context: McpSessionContext): void;
+    /**
+     * Lazily build the in-process observations MCP server. Returns null
+     * when `mcpContext` isn't wired (tests, very early startup) so the
+     * caller's merge skips the server entry rather than wiring a broken
+     * one.
+     *
+     * The server is constructed once and reused — the SDK accepts the same
+     * `McpSdkServerConfigWithInstance` across multiple `query()` calls and
+     * the underlying handler captures the (long-lived) `db` handle.
+     * Per-session exposure is gated by `allowedTools`:
+     * `composePrePassAllowedTools` adds the tool name for pre-pass
+     * sessions; other sessions cannot invoke it under
+     * `permissionMode: "dontAsk"`.
+     */
+    private getObservationsMcpServer;
+    /**
+     * Compose the final `mcpServers` map handed to the SDK. Merges the
+     * external (OAuth-backed) servers from {@link materializeMcpForSession}
+     * with the in-process observations server. External servers win on key
+     * collision (defensive against a future external server happening to
+     * share the `aitne-observations` name — we'd want the explicit
+     * external configuration to take effect rather than silently shadowing
+     * it).
+     *
+     * Returns null when neither side contributes anything so the caller's
+     * conditional spread keeps `mcpServers` out of the SDK options
+     * entirely (passing an empty object is harmless but noisier in logs).
+     */
+    private composeMcpServers;
     /**
      * Load the per-session MCP materialization. When the core hasn't been
      * wired with a context (tests, startup ordering) we return an empty
@@ -170,7 +222,7 @@ export declare class ClaudeCodeCore implements IAgentCore {
      * `delegatedTools` is UNION'd onto the returned list — even when
      * `allowedToolsOverride` is set. This is a deliberate deviation from the
      * override's otherwise-absolute "replace everything" contract (see
-     * `CRITICAL_OVERRIDE_TOOLS` at line 293, which warns but does not union).
+     * `CRITICAL_OVERRIDE_TOOLS`, which warns but does not union).
      * Rationale: delegated mode is a runtime-configurable axis orthogonal to
      * the dashboard's tool-customization override. If a user set the override
      * before flipping an integration to delegated, silently dropping the
@@ -224,4 +276,3 @@ export declare class ClaudeCodeCore implements IAgentCore {
      */
     runDelegatedTask(params: DelegatedTaskInvokeParams): Promise<DelegatedTaskResultRaw>;
 }
-//# sourceMappingURL=claude-code-core.d.ts.map