@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/dispatcher-message-handler.d.ts

@@ -43,8 +43,9 @@
  */
 import type Database from "better-sqlite3";
 import type { MessageEvent } from "@aitne/shared";
-import type { AgentConfig } from "../config.js";
+import { type AgentConfig } from "../config.js";
 import type { IAgentRouter } from "./backends/backend-router.js";
+import { AgentWriteTracker } from "../safety/agent-write-tracker.js";
 import { type UserBangCommand } from "./bang-commands/user-commands.js";
 import type { DocsCitationLookup } from "./docs/citation-validator.js";
 import { EventBus } from "./event-bus.js";
@@ -68,6 +69,14 @@ export interface MessageHandlerDeps {
     prompt: PromptAssembler;
     errorRouter: DispatcherErrorRouter;
     resultProcessor: ResultProcessor;
+    /**
+     * Optional commit-attribution tracker (C1). Production always supplies
+     * one via `Dispatcher`; tests may omit it. When omitted, the
+     * bang-command path uses a fresh per-call tracker so the contract on
+     * `BangCommandContext.writeTracker` (mandatory) stays satisfied
+     * without forcing every existing test fixture to construct one.
+     */
+    writeTracker?: AgentWriteTracker;
     /** Lazily-injected SignalDetector accessor (null in tests + when unwired). */
     getSignalDetector: () => SignalDetector | null;
     /** Lazily-injected dashboard stream accessor (null until index.ts wires it). */
@@ -82,6 +91,25 @@ export interface MessageHandlerDeps {
     getAuthHealthMonitor: () => import("./backends/auth-health-monitor.js").AuthHealthMonitor | null;
     /** Lazily-injected bang-command registry accessor. */
     getBangCommandRegistry: () => import("./bang-commands/registry.js").BangCommandRegistry | null;
+    /** Lazily-injected B-4 purchase-handler accessor. Null in tests and
+     *  before B-4 is wired at startup. Used by the inbound classifier at
+     *  the top of `handle()` to short-circuit `!~xxxxxxxx`,
+     *  `!verify <tail>`, and `!cancel-purchase` inputs BEFORE the LLM
+     *  (or the bang-command registry) sees them — see
+     *  MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.4 / §17.7. */
+    getPurchaseHandler?: () => import("../services/browser-history/automation/purchase-handler.js").PurchaseHandler | null;
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 (Q#6 MVP blocker) — lazily-
+     * injected lite-final-confirm handler accessor. Null in tests and
+     * before the browser-task surface is wired at startup. Used by the
+     * inbound `!~xxxxxxxx` classifier alongside `getPurchaseHandler`: the
+     * adapter routes a reply by querying BOTH stores via `lookupByRaw`
+     * and dispatching to whichever returned a row. The strict-cancel-on-
+     * non-token-reply contract is replicated symmetrically across both
+     * surfaces so a single non-token reply cancels pending tokens of
+     * either kind on the affected channel.
+     */
+    getFinalConfirmHandler?: () => import("../services/browser-history/automation/final-confirm-handler.js").FinalConfirmHandler | null;
     /** Live getter for the dispatcher's `currentSetupMode` flag. */
     getCurrentSetupMode: () => SetupMode | null;
     /** Forward into the dispatcher's `beginSetupMode` so persistence stays
@@ -109,6 +137,7 @@ export declare class MessageHandler {
     private readonly prompt;
     private readonly errorRouter;
     private readonly resultProcessor;
+    private readonly writeTracker;
     private readonly getSignalDetector;
     private readonly getDashboardStream;
     private readonly getAttachmentStore;
@@ -116,6 +145,8 @@ export declare class MessageHandler {
     private readonly getAuthRecovery;
     private readonly getAuthHealthMonitor;
     private readonly getBangCommandRegistry;
+    private readonly getPurchaseHandler;
+    private readonly getFinalConfirmHandler;
     private readonly getCurrentSetupMode;
     private readonly beginSetupMode;
     private readonly lookupCustomBangCommandForEvent;
@@ -167,4 +198,3 @@ export declare class MessageHandler {
         triggerMatched: boolean;
     };
 }
-//# sourceMappingURL=dispatcher-message-handler.d.ts.map

package/dist/core/dispatcher-message-handler.js

@@ -44,9 +44,12 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { formatSqliteDatetime, isDocsQAMessage, isMessageEvent, parseSqliteUtcMs, resolveProcessKey, } from "@aitne/shared";
+import { getContextDir } from "../config.js";
+import { resolveUserSkillsRoot } from "./user-skills-root.js";
 import { getModelLabel } from "./backends/model-registry.js";
 import { parseGeminiAuthCode } from "./backends/auth-recovery.js";
 import { tryHandle as tryHandleBangCommand } from "./bang-commands/registry.js";
+import { AgentWriteTracker } from "../safety/agent-write-tracker.js";
 import { CUSTOM_BANG_COMMAND_SOURCE, createUserBangCommandEvent, resolveCommandSkillSlugs, } from "./bang-commands/user-commands.js";
 import { logInvalidCitations, validateAndRewrite, } from "./docs/citation-validator.js";
 import { countContextWritesInWindow, didRefetchTodayDuringTurn, matchesRecentActivityTrigger, } from "./dm-freshness-metrics.js";
@@ -68,6 +71,7 @@ export class MessageHandler {
     prompt;
     errorRouter;
     resultProcessor;
+    writeTracker;
     getSignalDetector;
     getDashboardStream;
     getAttachmentStore;
@@ -75,6 +79,8 @@ export class MessageHandler {
     getAuthRecovery;
     getAuthHealthMonitor;
     getBangCommandRegistry;
+    getPurchaseHandler;
+    getFinalConfirmHandler;
     getCurrentSetupMode;
     beginSetupMode;
     lookupCustomBangCommandForEvent;
@@ -94,6 +100,12 @@ export class MessageHandler {
         this.prompt = deps.prompt;
         this.errorRouter = deps.errorRouter;
         this.resultProcessor = deps.resultProcessor;
+        // Tests can omit `writeTracker`; production always supplies one via
+        // Dispatcher. The fallback ensures `BangCommandContext.writeTracker`
+        // (mandatory) is always populated when bang commands run. A
+        // per-handler tracker is fine — `markAgentCommit` only matters when
+        // the dispatcher path forwards it on to `runGitPreCompile`.
+        this.writeTracker = deps.writeTracker ?? new AgentWriteTracker();
         this.getSignalDetector = deps.getSignalDetector;
         this.getDashboardStream = deps.getDashboardStream;
         this.getAttachmentStore = deps.getAttachmentStore;
@@ -101,6 +113,9 @@ export class MessageHandler {
         this.getAuthRecovery = deps.getAuthRecovery;
         this.getAuthHealthMonitor = deps.getAuthHealthMonitor;
         this.getBangCommandRegistry = deps.getBangCommandRegistry;
+        this.getPurchaseHandler = deps.getPurchaseHandler ?? (() => null);
+        this.getFinalConfirmHandler =
+            deps.getFinalConfirmHandler ?? (() => null);
         this.getCurrentSetupMode = deps.getCurrentSetupMode;
         this.beginSetupMode = deps.beginSetupMode;
         this.lookupCustomBangCommandForEvent = deps.lookupCustomBangCommandForEvent;
@@ -203,6 +218,13 @@ export class MessageHandler {
                         const recovery = await authRecovery.initiateGeminiAuth();
                         results.push(`✅ gemini — Recovery started. Open the following URL in your browser and authenticate, then send the code here:\n${recovery.authUrl}\n(expires in ${recovery.expiresMinutes} min)`);
                     }
+                    else if (bid === "opencode") {
+                        // OpenCode auth is per-provider via the `opencode auth login`
+                        // CLI and cannot be driven headlessly by the daemon. Surface
+                        // the manual command so the operator can copy-paste it; the
+                        // health monitor will pick the success up on its next probe.
+                        results.push(`⚠️ opencode — Manual recovery required. Run \`opencode auth login\` in a terminal to refresh provider credentials, then run \`/auth status\` to re-check.`);
+                    }
                     else {
                         results.push(`⚠️ ${bid} — No automated recovery available for this backend.`);
                     }
@@ -240,15 +262,29 @@ export class MessageHandler {
             }
             return true;
         }
+        // `/auth fix opencode` — surface manual recovery instructions.
+        // OpenCode authenticates per-provider via `opencode auth login` and the
+        // daemon can't drive that headlessly (it's interactive + non-OAuth),
+        // so we return the canonical CLI command instead of pretending to
+        // start a session. The health monitor will pick up the new state on
+        // its next probe; the operator can re-run `/auth status` to confirm.
+        if (text === "/auth fix opencode") {
+            await this.notificationMgr.send(`OpenCode recovery is manual.\n` +
+                `Run \`opencode auth login\` in a terminal to refresh provider credentials, ` +
+                `then send \`/auth status\` here to re-check.`, event);
+            return true;
+        }
         // `/auth cancel` — cancel active recovery
         if (text === "/auth cancel" || text.startsWith("/auth cancel ")) {
             if (!authRecovery)
                 return false;
             const parts = text.split(/\s+/);
             const backendHint = parts[2];
-            // Cancel all active recoveries, or a specific one
+            // Cancel all active recoveries, or a specific one. OpenCode is
+            // included for symmetry even though it has no daemon-driven session
+            // to cancel — `cancelRecovery` returns false there, which is fine.
             let cancelled = false;
-            for (const bid of ["codex", "gemini", "claude"]) {
+            for (const bid of ["codex", "gemini", "claude", "opencode"]) {
                 if (backendHint && bid !== backendHint)
                     continue;
                 if (authRecovery.cancelRecovery(bid))
@@ -271,10 +307,141 @@ export class MessageHandler {
      * access test casts continue to work.
      */
     async handle(event) {
+        // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.4 / §17.7 — Phase B-4
+        // structural-anti-spoofing inbound classifier. Runs BEFORE the
+        // bang-command interceptor (and BEFORE any inbound recording on
+        // `conversation_sessions.messages`) so a `!~xxxxxxxx` token reply,
+        // `!verify <tail>` slash, or `!cancel-purchase` slash NEVER reaches
+        // the LLM's conversation log. The plan §17.7 invariant — "the agent
+        // must not see used tokens in its conversation log" — is enforced
+        // structurally here: matched inbounds short-circuit `handle()`
+        // entirely after the purchase-handler records the audit row on
+        // `_replies` and emits the consume / verify / cancel follow-up DM.
+        //
+        // Pre-conditions:
+        //   - event.isDm — non-DM channels never carry tokens (§17.3 / §17.4)
+        //   - getPurchaseHandler() is non-null (false in tests; B-4 wired
+        //     at startup binds it)
+        //
+        // The classifier is pure (`classifyAdapterInbound`); the handler
+        // dispatch is async I/O (DB + outbound DM follow-up). On any
+        // exception the classifier falls through to normal processing —
+        // failing closed on the B-4 path could deadlock a legitimate user
+        // who happens to type a `!~`-shaped message that fails some
+        // downstream DB check, so we log + skip on error.
+        if (event.isDm) {
+            const purchaseHandler = this.getPurchaseHandler();
+            const finalConfirmHandler = this.getFinalConfirmHandler();
+            // BROWSER_TASK_REDESIGN_PLAN.md §14.11 Q#6 — jti-prefix dispatch.
+            // The `!~xxxxxxxx` envelope is shared between B-4 purchase tokens
+            // and lite-final-confirm tokens. A pending token of EITHER kind
+            // must consume the reply (and a non-token reply must strict-
+            // cancel pending tokens of EITHER kind on the channel). The
+            // route in code:
+            //
+            //   1. classifyAdapterInbound is purchase-specific by name but
+            //      the `kind === "token_reply"` case carries only the parsed
+            //      `!~xxxxxxxx` string — that envelope is identical across
+            //      both surfaces (see `lite-final-confirm-tokens.parseLite…`).
+            //      Reusing the classifier keeps the shape-validation logic
+            //      in one place.
+            //   2. For `verify` / `cancel_purchase` — purchase-only slashes,
+            //      no lite equivalent — route to the purchase handler when
+            //      wired.
+            //   3. For `token_reply` — query BOTH stores via `lookupByRaw`.
+            //      Both jtis are uuid v4 so a colliding match is bounded by
+            //      uuid uniqueness. If both stores miraculously return a row,
+            //      we route to whichever was issued first (oldest issuedAt
+            //      wins) so the older surface deterministically resolves.
+            //      Whichever store consumed the row writes the audit + DM
+            //      via its own handler.
+            //   4. For `passthrough` — fan strict-cancel-on-non-token-reply
+            //      to BOTH handlers when wired. Each only cancels pending
+            //      rows it knows about on that channel; together they
+            //      preserve the rev3 strict-cancel contract symmetrically.
+            if (purchaseHandler || finalConfirmHandler) {
+                try {
+                    const { classifyAdapterInbound } = await import("../services/browser-history/automation/purchase-tokens.js");
+                    const decision = classifyAdapterInbound(event.content);
+                    const channelRef = `${event.platform}:${event.channel}`;
+                    if (decision.kind === "token_reply") {
+                        const purchaseRow = purchaseHandler?.lookupByRaw(decision.token)
+                            ?? null;
+                        const liteRow = finalConfirmHandler?.lookupByRaw(decision.token)
+                            ?? null;
+                        const { decideTokenReplyRoute } = await import("./dm-token-router.js");
+                        const route = decideTokenReplyRoute({ purchaseRow, liteRow });
+                        if (route.kind === "purchase" && purchaseHandler) {
+                            await purchaseHandler.handleTokenReply({
+                                body: event.content,
+                                channelRef,
+                            });
+                            return;
+                        }
+                        if (route.kind === "lite_final_confirm" && finalConfirmHandler) {
+                            await finalConfirmHandler.handleTokenReply({
+                                body: event.content,
+                                channelRef,
+                            });
+                            return;
+                        }
+                        // route.kind === "none" — neither store recognised the
+                        // token. Fall through to the strict-cancel block below so
+                        // the user's reply still reaches the LLM and any pending
+                        // tokens on the channel get cancelled.
+                    }
+                    else if (decision.kind === "verify") {
+                        if (purchaseHandler) {
+                            await purchaseHandler.handleVerifySlash({
+                                tail: decision.tail,
+                                channelRef,
+                            });
+                        }
+                        // Purchase-only slash: short-circuit even when purchaseHandler
+                        // is unwired so it never enters the lite strict-cancel fan-out
+                        // below (verify/cancel have no lite equivalent — §12 Q#6).
+                        return;
+                    }
+                    else if (decision.kind === "cancel_purchase") {
+                        if (purchaseHandler) {
+                            await purchaseHandler.handleCancelPurchaseSlash({ channelRef });
+                        }
+                        // Purchase-only slash: short-circuit even when purchaseHandler
+                        // is unwired so it never enters the lite strict-cancel fan-out
+                        // below (verify/cancel have no lite equivalent — §12 Q#6).
+                        return;
+                    }
+                    // decision.kind === "passthrough" (or token_reply with no
+                    // match): apply strict-cancel-on-non-token-reply to BOTH
+                    // handlers when wired. Each handler only cancels pending
+                    // rows on the channel it knows about, so a single non-token
+                    // reply cancels tokens of either kind without the two paths
+                    // double-counting. The agent never sees the token surfaces
+                    // by design (§17.7).
+                    if (purchaseHandler) {
+                        await purchaseHandler
+                            .cancelPendingOnNonTokenReply({ channelRef })
+                            .catch((err) => {
+                            logger.warn({ err, channelRef }, "B-4 strict-cancel on non-token reply raised (continuing)");
+                        });
+                    }
+                    if (finalConfirmHandler) {
+                        await finalConfirmHandler
+                            .cancelPendingOnNonTokenReply({ channelRef })
+                            .catch((err) => {
+                            logger.warn({ err, channelRef }, "lite-final-confirm strict-cancel on non-token reply raised (continuing)");
+                        });
+                    }
+                }
+                catch (err) {
+                    logger.warn({ err, correlationId: event.correlationId, platform: event.platform }, "DM-token inbound classifier raised — falling through to normal dispatch");
+                }
+            }
+        }
         // Bang-command interceptor — runs first so `!stop` / `!cost` / `!report`
         // succeed even mid-setup, mid-auth-recovery, etc., and so non-bang DMs
         // received while the agent is paused short-circuit before reaching the
-        // backend (I-3). See docs/design/backlog/messaging-bang-commands.md §6.2.
+        // backend. See docs/design/backlog/messaging-bang-commands.md §6.2.
         const bangCommandRegistry = this.getBangCommandRegistry();
         if (bangCommandRegistry) {
             const handled = await tryHandleBangCommand(bangCommandRegistry, {
@@ -282,13 +449,49 @@ export class MessageHandler {
                 db: this.db,
                 config: this.config,
                 audit: this.audit,
+                writeTracker: this.writeTracker,
                 rawSend: (text) => this.notificationMgr.send(text, event),
+                // Wired callback used by `!close`. Kept here (rather than handing
+                // sessionMgr/messageRecorder into BangCommandContext) so the
+                // bang-command surface stays narrow: handlers only see the
+                // collaborators they actually need, and unit tests can inject a
+                // single-line stub.
+                closeActiveDmSession: async () => {
+                    const existing = await this.sessionMgr.findActive({
+                        platform: event.platform,
+                        channel: event.channel,
+                        threadId: event.threadId,
+                        isDm: event.isDm,
+                        intent: event.intent,
+                    });
+                    if (!existing)
+                        return { closedId: null };
+                    // recordMessage persists the row and touches
+                    // last_message_at/message_count in a single transaction, so
+                    // retention + dashboard sidebar stay consistent with the
+                    // actual `messages` row count. closeSession then flips status.
+                    // Mirrors the verbatim sequence the pre-bang close-keyword
+                    // gate used (extracted, not changed, so the close audit trail
+                    // looks identical in `agent_actions`).
+                    this.messageRecorder.recordMessage({
+                        sessionId: existing.id,
+                        role: "user",
+                        content: event.content,
+                        platform: event.platform,
+                        senderId: event.sender,
+                    });
+                    this.sessionMgr.closeSession(existing.id);
+                    return { closedId: existing.id };
+                },
                 enqueueUserBangCommand: async (command, sourceEvent) => {
                     await this.eventBus.put(createUserBangCommandEvent(sourceEvent, command));
                 },
                 enqueueWikiEvent: async (wikiEvent) => {
                     await this.eventBus.put(wikiEvent);
                 },
+                enqueueBrowserResearchEvent: async (researchEvent) => {
+                    await this.eventBus.put(researchEvent);
+                },
                 enqueueWikiApproval: async (approvalInput) => {
                     // WIKI_BUILDER_DESIGN.md §5.5 / §P2.E — escalate to Approve tier
                     // via the existing agent_schedule approval queue. The dashboard
@@ -358,33 +561,13 @@ export class MessageHandler {
             if (authResult)
                 return;
         }
-        // Check for explicit close command before processing.
-        // Use findActive (not getOrCreate) to avoid creating an orphan session.
-        if (this.sessionMgr.isCloseCommand(event.content)) {
-            const existing = await this.sessionMgr.findActive({
-                platform: event.platform,
-                channel: event.channel,
-                threadId: event.threadId,
-                isDm: event.isDm,
-                intent: event.intent,
-            });
-            if (existing) {
-                // recordMessage persists the row and touches
-                // last_message_at/message_count in a single transaction, so
-                // retention + dashboard sidebar stay consistent with the actual
-                // `messages` row count. closeSession then flips status.
-                this.messageRecorder.recordMessage({
-                    sessionId: existing.id,
-                    role: "user",
-                    content: event.content,
-                    platform: event.platform,
-                    senderId: event.sender,
-                });
-                this.sessionMgr.closeSession(existing.id);
-            }
-            await this.notificationMgr.send("Session closed.", event);
-            return;
-        }
+        // Session close is now an explicit bang command (`!close`) handled
+        // by the registry interceptor above. The legacy bare-word matcher
+        // (`end` / `close` / `done`) was removed in M1 because natural
+        // English completion signals — most notably the lone word "done"
+        // — were silently terminating active conversations with no
+        // confirmation. The new surface keeps the same close semantics but
+        // forces an explicit intent.
         const replyActivity = await this.notificationMgr.beginReplyActivity(event);
         let turnToken = null;
         // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — capture the turn-start reference
@@ -633,25 +816,18 @@ export class MessageHandler {
             let resumeSnapshotAgeMinutes = 0;
             if (canResume) {
                 // ── Resume existing SDK session ──
-                const proactiveForwardContext = forwardContextAvailable
-                    ? await this.contextBuilder.build(event)
-                    : null;
-                const userMsgRecorded = this.messageRecorder.recordMessage({
-                    sessionId: session.id,
-                    role: "user",
-                    content: event.content,
-                    platform: event.platform,
-                    senderId: event.sender,
-                });
-                if (userMsgRecorded) {
-                    userMessageId = this.readLastInsertedMessageId(session.id);
-                }
                 // Compute the freshness anchors for this resumed turn. `started_at`
                 // is the moment `<today>` was captured (the fresh-execute branch
                 // builds the system prompt then). Reading from the session row
                 // (rather than the in-memory `session` value) keeps this side-
                 // effect-free: the row was just fetched by `getOrCreate` and is
                 // authoritative.
+                //
+                // Hoisted above the proactive-forward catchup builder so the
+                // builder can use `sessionStartedAtMs` as its lower-bound anchor
+                // (DM-HISTORY-CONTINUITY-FIX H-2). `started_at` is fixed at session
+                // start and does not race with concurrent inserts; `last_message_at`
+                // would.
                 const turnNow = new Date();
                 const sessionTimingRow = this.db
                     .prepare(`SELECT started_at FROM conversation_sessions WHERE id = ?`)
@@ -664,6 +840,29 @@ export class MessageHandler {
                 resumeTurnContext =
                     `<turn_context current_time="${turnNow.toISOString()}" `
                         + `snapshot_age_minutes="${resumeSnapshotAgeMinutes}" />`;
+                // DM-HISTORY-CONTINUITY-FIX H-2 — emit ONLY the catchup block,
+                // not the full context. The SDK session already holds the cached
+                // system prompt with `<conversation_history>`, `<today>`,
+                // `<management_rules>` etc.; calling `contextBuilder.build(event)`
+                // here would re-encode that entire ~10K-token payload against the
+                // user-turn cost AND duplicate the in-session history under a
+                // second tag. The narrow catchup builder returns only proactive
+                // forwards that landed in this scope (or the other DM surface)
+                // *after* the session started — which is exactly the information
+                // the SDK does not already have.
+                const proactiveForwardContext = forwardContextAvailable
+                    ? await this.contextBuilder.buildResumeCatchupContext(event, sessionStartedAtMs)
+                    : null;
+                const userMsgRecorded = this.messageRecorder.recordMessage({
+                    sessionId: session.id,
+                    role: "user",
+                    content: event.content,
+                    platform: event.platform,
+                    senderId: event.sender,
+                });
+                if (userMsgRecorded) {
+                    userMessageId = this.readLastInsertedMessageId(session.id);
+                }
                 // §4.5 connector-health DM is dispatched AFTER recordMessage so the
                 // warning's messages-table row carries a strictly-later timestamp
                 // than the user message. See `consultDelegatedConnectorWarnings`.
@@ -675,12 +874,22 @@ export class MessageHandler {
                     mailAccounts: this.getActiveMailAccounts(),
                     integrations: readIntegrations(this.db),
                     character: this.config.character,
+                    // docs/design/appendices/skills-unification.md Phase 4 — runtime context fed to
+                    // `resolveSkillManifest` so the conditional `gmail-lifestyle`
+                    // and `managed-tasks` skills drop when the DB has no signal
+                    // AND the inbound message text carries no trigger phrase. The
+                    // resume path mirrors the fresh-execute branch (~110 lines
+                    // below) — without it, drift detection on the second turn
+                    // would re-render with the conservative-include defaults.
+                    db: this.db,
+                    contextDir: getContextDir(this.config),
+                    ...(isMessageEvent(event) ? { messageText: event.content } : {}),
                     ...(workdirOverride ? { override: workdirOverride } : {}),
                 });
                 // Sync user-authored skills into the workdir before resuming, so any
                 // skill added/edited/deleted via /api/skills since the last turn is
                 // visible to the SDK's `.claude/skills/` discovery. Cheap and idempotent.
-                syncAllUserSkills(sessionDir, join(this.config.dataDir, "skills"));
+                syncAllUserSkills(sessionDir, resolveUserSkillsRoot(this.config));
                 // Phase 1 — stage inbound attachments + bind rows + append
                 // bracketed prompt block. For resume we can't prepend to the
                 // task-flow template (there isn't one on this path), so the
@@ -698,8 +907,14 @@ export class MessageHandler {
                     });
                 }
                 const resumeTranscripts = await this.prompt.transcribeAttachments(resumeStaged);
-                const resumeMessage = resumeStaged.length > 0
-                    ? `${event.content}\n${this.prompt.buildAttachmentPromptBlock(resumeStaged, resumeTranscripts)}`
+                // Surface adapter-reported missing attachments (e.g. expired
+                // Discord CDN URLs) so the agent sees a stub describing the file
+                // even when the bytes were unreachable.
+                const resumeMissing = isMessageEvent(event)
+                    ? (event.attachments ?? []).filter((a) => a.missing)
+                    : [];
+                const resumeMessage = resumeStaged.length > 0 || resumeMissing.length > 0
+                    ? `${event.content}\n${this.prompt.buildAttachmentPromptBlock(resumeStaged, resumeTranscripts, resumeMissing)}`
                     : event.content;
                 const resumeMessageWithForwardContext = proactiveForwardContext
                     ? `${resumeTurnContext}\n\n${proactiveForwardContext}\n\n<current_user_message>\n${resumeMessage}\n</current_user_message>`
@@ -709,7 +924,7 @@ export class MessageHandler {
                         id: row.id,
                         safeFilename: row.safeFilename,
                         mimeType: row.mimeType,
-                        absolutePath: `${sessionDir}/_attachments/${row.safeFilename}`,
+                        absolutePath: join(sessionDir, "_attachments", row.safeFilename),
                         relativePath: `_attachments/${row.safeFilename}`,
                     }))
                     : [];
@@ -748,7 +963,36 @@ export class MessageHandler {
                                 : event.isDm
                                     ? "message.received.dm"
                                     : event.type;
-                const context = await this.contextBuilder.build(event);
+                // DM-HISTORY-CONTINUITY-FIX H-1/H-3 follow-up — refresh
+                // `started_at` to NOW so it tracks the build time of THIS
+                // turn's system prompt. The H-2 catchup builder uses
+                // `started_at` as its lower-bound anchor; without this
+                // refresh, two paths leave it lagging the actual SDK-session-
+                // bind time:
+                //   1. handleDirectDm INSERTed the row at scheduler dispatch
+                //      time, possibly hours before this fresh-execute (H-1).
+                //   2. Dashboard reset-in-place keeps the row + NULLs
+                //      backend_session_id, but does not refresh started_at
+                //      (H-3 / pre-existing path).
+                // In both cases a subsequent resume turn would over-include
+                // forwards that the SDK session actually saw at fresh-execute
+                // time, duplicating them in the catchup block.
+                this.sessionMgr.markFreshExecuteStart(session.id);
+                // DM-HISTORY-CONTINUITY-FIX H-3 — suppress the active-session
+                // <conversation_history> block when the cross-session bridge
+                // below is about to emit "## Previous conversation in this
+                // thread" for the same rows. The dashboard reset-in-place
+                // path leaves the session row active (so the active block
+                // would fire) while also setting requiresHistoryInjection=true
+                // (so the cross-session block fires too) — without this gate
+                // the two blocks render the same messages under two different
+                // XML tags. The two blocks are mutually exclusive after this.
+                // Docs-QA is exempt because it skips the cross-session bridge
+                // entirely (see DOCS_QA_B7_DESIGN.md §11.6).
+                const context = await this.contextBuilder.build(event, {
+                    skipActiveHistoryBlock: session.requiresHistoryInjection === true
+                        && !isDocsQAMessage(event),
+                });
                 // Setup flows route through processKey="setup" for backend binding,
                 // but the workdir must materialize with the mode-specific processKey
                 // so `setup.update` doesn't inherit `setup.initial`'s skill set via
@@ -770,6 +1014,17 @@ export class MessageHandler {
                         mailAccounts: this.getActiveMailAccounts(),
                         integrations: readIntegrations(this.db),
                         character: this.config.character,
+                        // docs/design/appendices/skills-unification.md Phase 4 — runtime context for
+                        // the conditional manifest predicates. `db` feeds
+                        // `gmailLifestyleActive` / `managedTasksActive`;
+                        // `messageText` (DM only) feeds the *ForDm trigger-phrase
+                        // fallback; `contextDir` feeds `eveningRulebookIsActive`
+                        // (no-op here — DMs never hit the evening_review branch,
+                        // but the field is cheap to thread for symmetry with the
+                        // resume callsite above and any future predicate).
+                        db: this.db,
+                        contextDir: getContextDir(this.config),
+                        ...(isMessageEvent(event) ? { messageText: event.content } : {}),
                         ...(workdirOverride ? { override: workdirOverride } : {}),
                     })
                     : undefined;
@@ -780,7 +1035,7 @@ export class MessageHandler {
                 // wouldn't discover it. The sync is a cheap diff operation backed by
                 // a manifest file inside the workdir.
                 if (sessionDir) {
-                    syncAllUserSkills(sessionDir, join(this.config.dataDir, "skills"));
+                    syncAllUserSkills(sessionDir, resolveUserSkillsRoot(this.config));
                 }
                 // Docs-QA sessions are stateless lookups (DOCS_QA_B7_DESIGN.md
                 // §11.6 — "QA panel state lives in React state, not the DB").
@@ -823,8 +1078,11 @@ export class MessageHandler {
                     });
                 }
                 const freshTranscripts = await this.prompt.transcribeAttachments(freshStaged);
-                const executePrompt = freshStaged.length > 0
-                    ? `${prompt}\n${this.prompt.buildAttachmentPromptBlock(freshStaged, freshTranscripts)}`
+                const freshMissing = isMessageEvent(event)
+                    ? (event.attachments ?? []).filter((a) => a.missing)
+                    : [];
+                const executePrompt = freshStaged.length > 0 || freshMissing.length > 0
+                    ? `${prompt}\n${this.prompt.buildAttachmentPromptBlock(freshStaged, freshTranscripts, freshMissing)}`
                     : prompt;
                 // DMs should always persist backend sessions so same-session resume and
                 // dashboard history continue do not fall back to history reinjection.
@@ -834,7 +1092,7 @@ export class MessageHandler {
                         id: row.id,
                         safeFilename: row.safeFilename,
                         mimeType: row.mimeType,
-                        absolutePath: `${sessionDir}/_attachments/${row.safeFilename}`,
+                        absolutePath: join(sessionDir, "_attachments", row.safeFilename),
                         relativePath: `_attachments/${row.safeFilename}`,
                     }))
                     : [];
@@ -1061,4 +1319,3 @@ export class MessageHandler {
         };
     }
 }
-//# sourceMappingURL=dispatcher-message-handler.js.map