@aitne/daemon 0.1.8 → 0.1.10

package/dist/api/routes/context.js

@@ -1,1645 +0,0 @@
-import { Hono } from "hono";
-import { readFileSync, existsSync, statSync, readdirSync, unlinkSync, realpathSync, lstatSync, readlinkSync, } from "node:fs";
-import { basename, join, dirname, resolve, relative, isAbsolute } from "node:path";
-import { writeFileAtomically } from "../../core/atomic-write.js";
-import { contextPutSchema, contextPatchSchema, getAgentDayDateStr, localDateStr, } from "@aitne/shared";
-import { getContextDir } from "../../config.js";
-import { getDegradedMode } from "../../db/runtime-state.js";
-import { InMemoryTodayWriteLockManager, getTodayWriteLockTimeoutMs, } from "../../core/today-write-lock.js";
-import { InMemoryRoadmapWriteLockManager, getRoadmapWriteLockTimeoutMs, } from "../../core/roadmap-write-lock.js";
-import { CONTEXT_BASE_FILE_STEMS, CONTEXT_FILE_EXTENSIONS, } from "../../core/context-paths.js";
-import { REPAIRABLE_STUB_TARGETS, buildContextHealthReport, normalizeRepairStubPath, } from "../../core/context-health.js";
-import { validateDailySkeletonFrontmatter } from "../../core/context-frontmatter.js";
-import { classifyContextWriteStaleness } from "../../core/context-staleness.js";
-import { resolveTemplatesRoot } from "../../core/skeleton.js";
-import { isValidYmd, } from "../../core/roadmap-horizon.js";
-import { extractRoadmapIds, generateRoadmapId, RoadmapIdGenerationError, } from "../../core/roadmap-ids.js";
-import { buildTodayAgentPlanMetadata, extractTodayAgentPlanRows, extractTodayDate, readTodayAgentPlanMetadata, } from "../../core/today-agent-plan.js";
-import { SNAPSHOT_DEBOUNCE_MS, clearEntriesBefore, findSection, getAvailableSections, isLegacyTodayContent, prepareContextContentForWrite, toTodayScheduleCandidate, trimBulletEntries, validateContextContent, validateTodayContent, } from "../../core/context-validation/index.js";
-import { createLogger } from "../../logging.js";
-import { readJsonBody } from "../json-body.js";
-import { composeIssue, respondWithAgentError, } from "../helpers/agent-errors.js";
-const logger = createLogger("context-api");
-const CONTEXT_BASE_FILE_STEM_SET = new Set(CONTEXT_BASE_FILE_STEMS);
-function resolveContextTarget(userPath) {
-    for (const ext of CONTEXT_FILE_EXTENSIONS) {
-        if (userPath.endsWith(ext)) {
-            return { base: userPath.slice(0, -ext.length), ext };
-        }
-    }
-    if (CONTEXT_BASE_FILE_STEM_SET.has(userPath)) {
-        return { base: userPath, ext: ".base" };
-    }
-    return { base: userPath, ext: ".md" };
-}
-function normalizeContextPath(userPath) {
-    return resolveContextTarget(userPath).base;
-}
-/**
- * Subpath prefixes inside contextDir that the API never exposes.
- * Relative paths from `path.relative` never contain a trailing slash for
- * the leaf element, so we match on "<name>" exactly OR "<name>/" prefix.
- *
- *  - `.git` — local repo artifacts the daemon must not touch
- *  - `.DS_Store` — macOS filesystem cruft
- *  - `.obsidian` — Obsidian's own state directory
- *
- * `.obsidian` stays denied in every mode. `vaultMode="obsidian"` means the
- * directory may exist on disk and should be preserved by the daemon, not that
- * the agent may read or edit Obsidian's workspace state through this API.
- */
-const DENIED_SUBPATH_ROOTS = [".git", ".DS_Store", ".obsidian"];
-function isDeniedPath(relativePath) {
-    for (const root of DENIED_SUBPATH_ROOTS) {
-        if (relativePath === root || relativePath.startsWith(`${root}/`)) {
-            return true;
-        }
-    }
-    return false;
-}
-function escapesBase(base, candidate) {
-    const rel = relative(base, candidate);
-    return rel.startsWith("..") || isAbsolute(rel);
-}
-function resolveRealPathBestEffort(path, seen = new Set()) {
-    const abs = resolve(path);
-    try {
-        const stat = lstatSync(abs);
-        if (stat.isSymbolicLink()) {
-            if (seen.has(abs))
-                return null;
-            seen.add(abs);
-            const target = readlinkSync(abs);
-            return resolveRealPathBestEffort(isAbsolute(target) ? target : resolve(dirname(abs), target), seen);
-        }
-        return realpathSync(abs);
-    }
-    catch {
-        const parent = dirname(abs);
-        if (parent === abs)
-            return abs;
-        const parentReal = resolveRealPathBestEffort(parent, seen);
-        return parentReal ? resolve(parentReal, basename(abs)) : null;
-    }
-}
-/**
- * Resolve a user-supplied path safely within contextDir.
- * Accepts paths with or without the trailing `.md` / `.base` extension.
- * Returns null if the resolved path escapes contextDir (path traversal),
- * targets a reserved `.base` stem with the wrong extension, or is on the
- * deny list.
- */
-function safePath(contextDir, userPath) {
-    const { base, ext } = resolveContextTarget(userPath);
-    if (base === "projects/_active" && ext !== ".base") {
-        logger.warn({ userPath, base, ext }, "Base file requested with wrong extension");
-        return null;
-    }
-    const resolved = resolve(contextDir, `${base}${ext}`);
-    const rel = relative(contextDir, resolved);
-    // Reject if path escapes contextDir (starts with .. or is absolute)
-    if (escapesBase(contextDir, resolved)) {
-        logger.warn({ userPath, resolved }, "Path traversal rejected");
-        return null;
-    }
-    if (isDeniedPath(rel)) {
-        logger.warn({ userPath, resolved }, "Denied subpath rejected");
-        return null;
-    }
-    const contextReal = resolveRealPathBestEffort(contextDir);
-    const resolvedReal = resolveRealPathBestEffort(resolved);
-    if (!contextReal || !resolvedReal) {
-        logger.warn({ userPath, resolved }, "Realpath resolution rejected");
-        return null;
-    }
-    if (escapesBase(contextReal, resolvedReal)) {
-        logger.warn({ userPath, resolved, resolvedReal }, "Symlink traversal rejected");
-        return null;
-    }
-    const realRel = relative(contextReal, resolvedReal);
-    if (isDeniedPath(realRel)) {
-        logger.warn({ userPath, resolved, resolvedReal }, "Denied realpath rejected");
-        return null;
-    }
-    return resolved;
-}
-// B-007 §5.1 — write-permission whitelist for the new layout.
-const CONTEXT_WRITE_PERMISSIONS = {
-    // Top-level survivors.
-    today: ["PUT", "PATCH"],
-    yesterday: ["PUT", "PATCH"],
-    roadmap: ["PUT", "PATCH"],
-    _index: ["PUT", "PATCH"],
-    "context-index": ["PUT", "PATCH"],
-    // user/* covers fixed area files AND the §5.5 growth pattern
-    // (e.g. `user/health/sleep-log.md` after an area promotion).
-    "user/*": ["PUT", "PATCH"],
-    // Natural-language rulebooks — §5.8.
-    "rules/_index": ["PUT", "PATCH"],
-    // DELETE intentionally omitted. Policy files under `rules/policies/`
-    // use `status: removed` in lieu of physical deletion so the captured
-    // history (origin DM, why, linked routine) survives. See
-    // MANAGEMENT-POLICY-CAPTURE-PLAN.md §4.6 / §5.1.
-    "rules/*": ["PUT", "PATCH"],
-    "routines/_index": ["PUT", "PATCH"],
-    "routines/*": ["PUT", "PATCH"],
-    // B-007 §5.8 Q3 — custom routines support DELETE so the agent can
-    // retire a routine when the user asks via DM. The scheduler re-reads
-    // the directory via `onCustomRoutinesChanged` and unregisters the
-    // cron job on the next reload pass.
-    "routines/custom/*": ["PUT", "PATCH", "DELETE"],
-    // Projects (`.base` permitted via CONTEXT_FILE_EXTENSIONS).
-    "projects/_index": ["PUT", "PATCH"],
-    "projects/_active": ["PUT"],
-    "projects/*": ["PUT", "PATCH"],
-    // Lightweight registry for watched git repos that are not promoted to a
-    // full project page.
-    // @deprecated Pre-cutover layout (see docs/design/appendices/unified-repositories.md);
-    // retained for transitional reads of legacy files. New writes route to
-    // `git/<slug>/{overview,journal/<YYYY-MM-DD>}`.
-    "git-repos/*": ["PUT", "PATCH"],
-    // Unified repositories — per-repo project overview + per-day journal.
-    // The two specific patterns below carry write permission; arbitrary
-    // paths under `git/` are NOT writable to keep the layout disciplined.
-    // See docs/design/appendices/unified-repositories.md §4.5.
-    "git/{slug}/overview": ["PUT", "PATCH"],
-    "git/{slug}/journal/{date}": ["PUT", "PATCH"],
-    // Journal & reviews.
-    "daily/*": ["PUT", "PATCH"],
-    "weekly/*": ["PUT", "PATCH"],
-    "monthly/*": ["PUT", "PATCH"],
-    // Dossiers + inbox + agent self-areas.
-    "dossiers/_index": ["PUT", "PATCH"],
-    "dossiers/*": ["PUT", "PATCH"],
-    // B-007 §5.9 Step 4 / §5.3 — morning routine triages each inbox file and
-    // moves the original to `agent/scratch/inbox-YYYY-MM-DD-*.md`. Both sides
-    // of the move need DELETE: inbox for the post-triage cleanup, scratch for
-    // the eventual 48h TTL retention sweep (§6.5).
-    "inbox/*": ["PUT", "PATCH", "DELETE"],
-    "agent/journal": ["PUT", "PATCH"],
-    "agent/scratch/*": ["PUT", "PATCH", "DELETE"],
-};
-/**
- * Paths where PUT is only allowed when the file does not yet exist.
- * Subsequent writes must go through PATCH (append). This enforces the
- * append-only contract at the API level rather than relying on prompt
- * compliance alone.
- */
-const CREATE_ONLY_PUT = new Set(["agent/journal"]);
-/**
- * Slug regex shared by `{slug}` and `{date}` placeholders. Matches the
- * sanitized output of `deriveSlug` (a-z, 0-9, dot, underscore, dash) and
- * `YYYY-MM-DD` date strings without further validation — the route
- * handler does the canonical date validation when it parses the URL.
- */
-const PLACEHOLDER_SEGMENT_RE = /^[a-z0-9._-]+$/;
-function patternToRegex(pattern) {
-    // Escape regex metachars except the placeholder syntax we control.
-    const escaped = pattern.replace(/[.+^$()|\\]/g, "\\$&");
-    // `{name}` → one allowed segment.
-    const withSegments = escaped.replace(/\\?\{[^}]+\\?\}/g, "[a-z0-9._-]+");
-    // `/*` at end → exactly one trailing segment.
-    const withTail = withSegments.replace(/\/\*$/, "/[^/]+");
-    return new RegExp("^" + withTail + "$");
-}
-function isWriteAllowed(path, method) {
-    // Check exact match first
-    if (CONTEXT_WRITE_PERMISSIONS[path]?.includes(method))
-        return true;
-    // Check wildcard patterns
-    for (const [pattern, methods] of Object.entries(CONTEXT_WRITE_PERMISSIONS)) {
-        if (!methods.includes(method))
-            continue;
-        if (pattern.endsWith("/*")) {
-            const prefix = pattern.slice(0, -2);
-            if (path.startsWith(prefix + "/")) {
-                return true;
-            }
-        }
-        if (pattern.includes("{")) {
-            if (patternToRegex(pattern).test(path)) {
-                // Defense-in-depth: each replaced placeholder must match the
-                // sanitized form. The regex already enforces that, but we
-                // double-check the character set explicitly so a future
-                // pattern with `{slug}` mid-string can't drift.
-                const segments = path.split("/");
-                const patternSegments = pattern.split("/");
-                /* c8 ignore next 2 — segment-length mismatch after a regex match is
-                 * unreachable: patternToRegex already validates the full path structure. */
-                if (segments.length !== patternSegments.length)
-                    continue;
-                let allValid = true;
-                for (let i = 0; i < segments.length; i++) {
-                    const lit = patternSegments[i];
-                    if (lit.startsWith("{") && lit.endsWith("}")) {
-                        if (!PLACEHOLDER_SEGMENT_RE.test(segments[i])) {
-                            allValid = false;
-                            break;
-                        }
-                    }
-                    else /* c8 ignore next 2 — literal mismatch after a full-pattern regex match
-                            * is unreachable: the regex enforces exact literal equality. */ if (lit !== segments[i]) {
-                        allValid = false;
-                        break;
-                    }
-                }
-                if (allValid)
-                    return true;
-            }
-        }
-    }
-    return false;
-}
-/**
- * Determine if a context file change should trigger a prompt context
- * refresh consideration. The staleness classifier decides whether the
- * matching write is loud enough to invalidate active DM sessions.
- *
- * B-007 §5.1 — user/profile.md is refreshed on PUT only (setup writes
- * the full file) but NOT on PATCH (SignalDetector appends to Raw Signals
- * frequently — refreshing on every append would thrash the owner session).
- *
- * The setup.initial PUT fires this, but it does NOT destroy the in-flight
- * setup conversation — the `onPromptContextChanged` handler in index.ts
- * skips `markActiveDmSessionsStale` while `currentSetupMode` is active.
- */
-function shouldRefreshPromptContext(path, method) {
-    if (path === "today" ||
-        path === "roadmap" ||
-        path === "context-index") {
-        return true;
-    }
-    // B-007 — any rules/*.md file feeds the policy-files injection hub, so
-    // edits to any of them should invalidate the owner-session prompt cache.
-    // Routine rulebooks (`routines/*.md`) similarly drive task-flow prompts.
-    if (path.startsWith("rules/") || path.startsWith("routines/")) {
-        return true;
-    }
-    if (path.startsWith("dossiers/")) {
-        return true;
-    }
-    if (path === "user/profile" && method === "PUT") {
-        return true;
-    }
-    return false;
-}
-function notifyPromptContextChanged(deps, path, reason, input) {
-    const classification = classifyContextWriteStaleness(input);
-    deps.onPromptContextChanged?.(path, reason, classification.tier, {
-        tierReason: classification.tierReason,
-    });
-    // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — record the staleness tier in
-    // `agent_actions` so the dashboard's `dm_freshness_metrics` view can
-    // count loud vs. quiet writes that landed within a DM session's
-    // lifetime. Best-effort: a failure here must not break the write.
-    try {
-        deps.db
-            .prepare(`INSERT INTO agent_actions (action_type, trigger, result, detail, started_at, completed_at)
-         VALUES ('context_write', 'reactive', 'success', json(?), datetime('now'), datetime('now'))`)
-            .run(JSON.stringify({
-            path,
-            method: input.method,
-            tier: classification.tier,
-            tierReason: classification.tierReason,
-            reason,
-        }));
-    }
-    catch (err) {
-        /* c8 ignore next 5 — DB INSERT failure inside a best-effort audit path;
-         * triggering requires closing the DB mid-request, which destroys the
-         * test harness. */
-        logger.warn({ err, path, method: input.method }, "Failed to record context_write agent_actions row (Stage C metrics)");
-    }
-}
-/**
- * Cap on the JSON body accepted by the Context PUT/PATCH endpoints.
- *
- * Real context files are well under this — `today.md` is typically
- * ~10 KB at the busiest point of the day, `roadmap.md` runs ~50 KB,
- * project pages ~50 KB, and `agent/journal.md` is bounded by the
- * retention rollup. 1 MB leaves >10x headroom for legitimate writes
- * while preventing a runaway-payload denial-of-service:
- *
- *   - The agent could otherwise be tricked (prompt injection from a
- *     poisoned email or Obsidian note) into PATCHing a multi-megabyte
- *     payload, and each PATCH writes a snapshot row in
- *     `md_file_snapshots`. Snapshots are pruned at 30 days, so a
- *     burst of large writes can balloon the DB before retention
- *     catches up.
- *
- *   - 1 MB is an order of magnitude smaller than the attachment route's
- *     25 MB cap; context files have no legitimate need to be that big.
- *
- * Only PUT/PATCH against the wildcard route apply this cap. Smaller
- * structured endpoints (lock, archive-today, repair/stub) use
- * `readOptionalJsonBody` whose payloads are tiny by construction.
- */
-const CONTEXT_BODY_MAX_BYTES = 1024 * 1024;
-export function createContextRoutes(deps) {
-    const app = new Hono();
-    const { db, config, writeTracker } = deps;
-    // Resolve the context directory at request time rather than closing over
-    // the startup value. `/api/setup/migrate-context` mutates `config` in
-    // memory after a successful move, and the Context API must immediately
-    // follow the new primary-vault path without requiring a daemon restart.
-    //
-    // Intentionally omit `db` here: degraded mode is handled by the 503
-    // middleware below, so once a request reaches a handler we want the
-    // actual current target path, never the legacy fallback.
-    const getCurrentContextDir = () => getContextDir(config);
-    /**
-     * Management Mode degraded-mode gate (plan §5.4).
-     * When the primary vault is unreachable, refuse BOTH reads and writes
-     * with 503 so the agent does not read or write a stale fallback
-     * location. Checked per-request so lifting degraded mode in the health
-     * probe takes effect without restart. The lock endpoints under
-     * `/context/lock/*` also participate: acquiring a lock during degraded
-     * mode would leave the lock held with no way to write, so we gate them
-     * too.
-     */
-    app.use("/context/*", async (c, next) => {
-        const state = getDegradedMode(db);
-        if (state) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("context.vault_unreachable", {
-                    field: "primaryVault",
-                    received: { reason: state.reason, path: state.path, since: state.since },
-                }),
-            ], {
-                legacyFields: {
-                    reason: state.reason,
-                    path: state.path,
-                    since: state.since,
-                },
-            });
-        }
-        // Phase 2 — global context-write gate engaged during a
-        // /api/setup/migrate-context run. Refuses WRITES (not reads)
-        // because reads against the still-intact source are safe; the
-        // migration endpoint blocks writes so no handler races the move.
-        const writeMethods = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-        if (deps.contextWriteGate?.isEngaged() && writeMethods.has(c.req.method)) {
-            const gateState = deps.contextWriteGate.getState();
-            return respondWithAgentError(c, 503, [
-                composeIssue("context.migration_in_progress", {
-                    field: "method",
-                    received: { method: c.req.method, reason: gateState.reason, since: gateState.since },
-                }),
-            ], {
-                legacyFields: {
-                    reason: gateState.reason,
-                    since: gateState.since,
-                },
-            });
-        }
-        await next();
-    });
-    const morningRoutineLock = deps.morningRoutineLock ??
-        new InMemoryTodayWriteLockManager(getTodayWriteLockTimeoutMs(config.executeTimeoutMinutes));
-    const roadmapWriteLock = deps.roadmapWriteLock ??
-        new InMemoryRoadmapWriteLockManager(getRoadmapWriteLockTimeoutMs(config.executeTimeoutMinutes));
-    // Per-instance state (not shared across tests)
-    const lastSnapshotTimes = new Map();
-    // Mutex for serialized writes
-    let writeLock = Promise.resolve();
-    function withWriteLock(fn) {
-        const prev = writeLock;
-        let resolve;
-        writeLock = new Promise((r) => {
-            resolve = r;
-        });
-        return prev.then(() => {
-            try {
-                return fn();
-            }
-            finally {
-                resolve();
-            }
-        });
-    }
-    function saveSnapshot(filePath, content, trigger, force = false, sessionId) {
-        const now = Date.now();
-        const lastTime = lastSnapshotTimes.get(filePath) ?? 0;
-        if (!force && now - lastTime < SNAPSHOT_DEBOUNCE_MS) {
-            return null;
-        }
-        const result = db
-            .prepare("INSERT INTO md_file_snapshots (file_path, content, trigger, session_id) VALUES (?, ?, ?, ?)")
-            .run(filePath, content, trigger, sessionId ?? null);
-        lastSnapshotTimes.set(filePath, now);
-        return Number(result.lastInsertRowid);
-    }
-    function isRoadmapValidationDisabled(path, headerValue) {
-        return path === "roadmap" && headerValue?.toLowerCase() === "off";
-    }
-    function logRoadmapValidationBypass(c, method, path) {
-        logger.warn({
-            path,
-            method,
-            sessionId: c.req.header("X-Session-Id") ?? null,
-            caller: c.req.header("X-Caller") ??
-                c.req.header("X-Agent-Caller") ??
-                c.req.header("User-Agent") ??
-                null,
-            route: c.req.path,
-        }, "Roadmap validation bypassed by X-Roadmap-Validation: off");
-    }
-    function roadmapDefaultLongTermPlanSource(c) {
-        const caller = (c.req.header("X-Caller") ??
-            c.req.header("X-Agent-Caller") ??
-            "").toLowerCase();
-        return caller.includes("dashboard") ? "dashboard" : "manual";
-    }
-    async function readOptionalJsonBody(c) {
-        const raw = await c.req.text();
-        if (raw.trim() === "")
-            return { ok: true, body: {} };
-        try {
-            const parsed = JSON.parse(raw);
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                return {
-                    ok: false,
-                    response: respondWithAgentError(c, 400, [
-                        composeIssue("context.body_not_object", {
-                            field: "body",
-                            received: parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed,
-                        }),
-                    ]),
-                };
-            }
-            return { ok: true, body: parsed };
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            logger.warn({ path: c.req.path, method: c.req.method, detail }, "Request rejected — body is not valid JSON");
-            return {
-                ok: false,
-                response: respondWithAgentError(c, 400, [
-                    composeIssue("context.invalid_json_body", {
-                        field: "body",
-                        received: detail,
-                    }),
-                ]),
-            };
-        }
-    }
-    // === Routes registered BEFORE wildcards (Hono matches in registration order) ===
-    // POST /context/lock/morning-routine — Acquire exclusive lock
-    app.post("/context/lock/morning-routine", (c) => {
-        const result = morningRoutineLock.acquire();
-        if (!result.ok) {
-            return respondWithAgentError(c, 409, [
-                composeIssue("context.lock_held", {
-                    field: "morningRoutineLock",
-                    received: { holder: result.holder },
-                }),
-            ]);
-        }
-        return c.json({ status: "acquired", lockId: result.lockId });
-    });
-    // DELETE /context/lock/morning-routine — Release exclusive lock
-    app.delete("/context/lock/morning-routine", async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        const lockId = body.lockId;
-        if (lockId && morningRoutineLock.release(lockId)) {
-            return c.json({ status: "released" });
-        }
-        return respondWithAgentError(c, 400, [
-            composeIssue("context.lock_not_held", {
-                field: "lockId",
-                received: lockId ?? "<missing>",
-            }),
-        ]);
-    });
-    // POST /context/lock/roadmap — Acquire exclusive roadmap write lock
-    // Dispatcher auto-acquires this for `routine.roadmap_refresh`; other
-    // flows (DM handler via the roadmap skill, evening sweeper) may
-    // acquire it manually. See ROADMAP-REDESIGN.md §3.6.
-    app.post("/context/lock/roadmap", (c) => {
-        const result = roadmapWriteLock.acquire();
-        if (!result.ok) {
-            return respondWithAgentError(c, 409, [
-                composeIssue("context.roadmap_write_lock_held", {
-                    field: "roadmapWriteLock",
-                    received: { holder: result.holder },
-                }),
-            ]);
-        }
-        return c.json({ status: "acquired", lockId: result.lockId });
-    });
-    // DELETE /context/lock/roadmap — Release the roadmap write lock
-    app.delete("/context/lock/roadmap", async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        const lockId = body.lockId;
-        if (lockId && roadmapWriteLock.release(lockId)) {
-            return c.json({ status: "released" });
-        }
-        return respondWithAgentError(c, 400, [
-            composeIssue("context.lock_not_held", {
-                field: "lockId",
-                received: lockId ?? "<missing>",
-            }),
-        ]);
-    });
-    // POST /context/roadmap/id — Mint a stable daemon-owned roadmap entry id.
-    app.post("/context/roadmap/id", async (c) => {
-        if (roadmapWriteLock.getHolder()) {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!roadmapWriteLock.isHeldBy(lockId)) {
-                logger.info({ path: "roadmap" }, "Roadmap id mint rejected — roadmap write lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.roadmap_write_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        const parsedBody = await readOptionalJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const requestedDate = parsedBody.body.creationDate ?? parsedBody.body.sourceDate;
-        const creationDate = typeof requestedDate === "string"
-            ? requestedDate
-            : localDateStr(new Date(), config.timezone || undefined);
-        if (!isValidYmd(creationDate)) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.creation_date_invalid", {
-                    field: "creationDate",
-                    received: creationDate,
-                }),
-            ]);
-        }
-        return withWriteLock(() => {
-            const contextDir = getCurrentContextDir();
-            const fullPath = safePath(contextDir, "roadmap");
-            if (!fullPath) {
-                return respondWithAgentError(c, 400, [
-                    composeIssue("context.path_invalid", {
-                        field: "path",
-                        received: "roadmap",
-                    }),
-                ]);
-            }
-            const content = existsSync(fullPath)
-                ? readFileSync(fullPath, "utf-8")
-                : "";
-            const existingIds = extractRoadmapIds(content).map((ref) => ref.id);
-            try {
-                return c.json({
-                    id: generateRoadmapId({
-                        creationDate,
-                        existingIds,
-                        randomBytes: deps.roadmapIdRandomBytes,
-                    }),
-                });
-            }
-            catch (err) {
-                if (err instanceof RoadmapIdGenerationError) {
-                    return respondWithAgentError(c, 503, [
-                        composeIssue("context.roadmap_id_generation_failed", {
-                            field: "id",
-                            received: { existingIdCount: existingIds.length, creationDate },
-                        }),
-                    ]);
-                }
-                throw err;
-            }
-        });
-    });
-    // POST /context/archive-today — B-007 §5.9 day rotation.
-    // Before Phase 1 this copied today.md to `schedule/YYYY-MM-DD.md`; that
-    // mechanical archive has been retired (the synthesized `daily/YYYY-MM-DD.md`
-    // is now written by the morning routine). The endpoint is kept as the
-    // agent-triggered rotation that renames `today.md → yesterday.md` and
-    // returns the previous date so the agent can write the new `today.md`
-    // in the same flow.
-    app.post("/context/archive-today", (c) => {
-        return withWriteLock(() => {
-            const contextDir = getCurrentContextDir();
-            const todayPath = join(contextDir, "today.md");
-            if (!existsSync(todayPath)) {
-                return respondWithAgentError(c, 404, [
-                    composeIssue("context.path_not_found", {
-                        field: "path",
-                        received: "today",
-                    }),
-                ]);
-            }
-            const content = readFileSync(todayPath, "utf-8");
-            const dateStr = content.match(/^#.*(\d{4}-\d{2}-\d{2})/)?.[1] ??
-                localDateStr(new Date());
-            const yesterdayPath = join(contextDir, "yesterday.md");
-            // Atomic write through O_NOFOLLOW + rename so a symlink swap at
-            // `yesterday.md` between request validation and the write cannot
-            // redirect the rotation into an attacker-controlled path. The
-            // legacy `copyFileSync` would silently follow such a symlink.
-            writeFileAtomically(yesterdayPath, content);
-            saveSnapshot("today", content, "rotate-to-yesterday", true);
-            return c.json({
-                status: "archived",
-                archivePath: "yesterday.md",
-                rotatedFrom: dateStr,
-            });
-        });
-    });
-    // POST /context/restore-snapshot/:id — restore a prior md_file_snapshots
-    // row back onto disk. The current on-disk file (if any) is snapshotted
-    // first so the restore itself is reversible from the Knowledge page.
-    app.post("/context/restore-snapshot/:id", (c) => {
-        const idRaw = c.req.param("id");
-        const id = Number(idRaw);
-        if (!Number.isSafeInteger(id) || id <= 0) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.snapshot_id_invalid", {
-                    field: "id",
-                    received: idRaw,
-                }),
-            ]);
-        }
-        const row = db
-            .prepare("SELECT id, file_path, content FROM md_file_snapshots WHERE id = ?")
-            .get(id);
-        if (!row) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("context.snapshot_not_found", {
-                    field: "id",
-                    received: id,
-                }),
-            ]);
-        }
-        const target = resolveContextTarget(row.file_path);
-        const path = target.base;
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, row.file_path);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        if (!isWriteAllowed(path, "PUT") && !isWriteAllowed(path, "PATCH")) {
-            logger.warn({ path, method: "RESTORE" }, "Snapshot restore forbidden");
-            return respondWithAgentError(c, 403, [
-                composeIssue("context.write_forbidden", {
-                    field: "path",
-                    received: { path, method: "RESTORE" },
-                }),
-            ]);
-        }
-        if (morningRoutineLock.getHolder() && path === "today") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!morningRoutineLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Snapshot restore rejected — morning routine lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.morning_routine_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        if (roadmapWriteLock.getHolder() && path === "roadmap") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!roadmapWriteLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Snapshot restore rejected — roadmap write lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.roadmap_write_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        const contentError = validateContextContent(target, row.content, {
-            skipFrontmatterValidation: true,
-        });
-        if (contentError) {
-            return respondWithAgentError(c, contentError.status, [
-                composeIssue("context.content_validation_failed", {
-                    field: contentError.path ?? "content",
-                    received: contentError.message,
-                }),
-            ], {
-                legacyFields: {
-                    message: contentError.message,
-                    path: contentError.path,
-                },
-            });
-        }
-        return withWriteLock(() => {
-            let backupSnapshotId = null;
-            if (existsSync(fullPath)) {
-                const current = readFileSync(fullPath, "utf-8");
-                backupSnapshotId = saveSnapshot(path, current, "api_restore_snapshot", true);
-            }
-            // writeFileAtomically handles parent-dir creation, refuses to
-            // follow a symlink at the destination, and renames into place.
-            writeFileAtomically(fullPath, row.content);
-            writeTracker?.markWriting(fullPath, row.content);
-            if (shouldRefreshPromptContext(path, "PUT")) {
-                notifyPromptContextChanged(deps, path, `context_restore_snapshot:${path}`, { path, method: "RESTORE" });
-            }
-            if (path.startsWith("routines/custom/")) {
-                deps.onCustomRoutinesChanged?.();
-            }
-            const writtenStat = statSync(fullPath);
-            logger.info({
-                path,
-                method: "RESTORE",
-                restoredFromSnapshotId: id,
-                backupSnapshotId: backupSnapshotId ?? undefined,
-            }, "Context snapshot restored");
-            return c.json({
-                status: "restored",
-                path,
-                restoredFromSnapshotId: id,
-                backupSnapshotId,
-                lastModified: writtenStat.mtime.toISOString(),
-            });
-        });
-    });
-    // GET /context/list/:dir — List files in directory
-    app.get("/context/list/:dir", (c) => {
-        const dir = c.req.param("dir");
-        // B-007 §5.1 — canonical listable directories.
-        const allowedDirs = [
-            "projects",
-            "weekly",
-            "monthly",
-            "daily",
-            "user",
-            "rules",
-            "routines",
-            "dossiers",
-            "git",
-            "git-repos",
-            "inbox",
-        ];
-        if (!allowedDirs.includes(dir)) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.directory_invalid", {
-                    field: "dir",
-                    received: { dir, allowed: allowedDirs },
-                }),
-            ]);
-        }
-        const contextDir = getCurrentContextDir();
-        const dirPath = join(contextDir, dir);
-        if (!existsSync(dirPath)) {
-            return c.json({ files: [] });
-        }
-        const files = readdirSync(dirPath)
-            .filter((f) => CONTEXT_FILE_EXTENSIONS.some((ext) => f.endsWith(ext)))
-            .map((f) => {
-            const stat = statSync(join(dirPath, f));
-            return { name: f, lastModified: stat.mtime.toISOString() };
-        });
-        // B-007 §5.8 Q3 — surface custom routines so the dashboard routines
-        // editor sees them alongside the built-ins. `routines/custom/` is the
-        // only nested directory we need to flatten; other listable dirs are
-        // flat by design (§5.1).
-        if (dir === "routines") {
-            const customDir = join(dirPath, "custom");
-            if (existsSync(customDir)) {
-                for (const f of readdirSync(customDir)) {
-                    if (!CONTEXT_FILE_EXTENSIONS.some((ext) => f.endsWith(ext)))
-                        continue;
-                    const stat = statSync(join(customDir, f));
-                    files.push({
-                        name: `custom/${f}`,
-                        lastModified: stat.mtime.toISOString(),
-                    });
-                }
-            }
-        }
-        // Unified repositories layout (`git/<slug>/overview.md` +
-        // `git/<slug>/journal/<YYYY-MM-DD>.md`) — surface every per-repo file
-        // under the `git` listing so the Knowledge page tree shows them.
-        // Without this the listing only contains files directly under `git/`,
-        // and the per-slug subdirectories silently drop off the dashboard.
-        // Mirrors the `routines/custom/` flatten above.
-        if (dir === "git") {
-            for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
-                if (!entry.isDirectory())
-                    continue;
-                const slug = entry.name;
-                const slugDir = join(dirPath, slug);
-                for (const f of readdirSync(slugDir)) {
-                    if (!CONTEXT_FILE_EXTENSIONS.some((ext) => f.endsWith(ext)))
-                        continue;
-                    const stat = statSync(join(slugDir, f));
-                    files.push({
-                        name: `${slug}/${f}`,
-                        lastModified: stat.mtime.toISOString(),
-                    });
-                }
-                const journalDir = join(slugDir, "journal");
-                if (existsSync(journalDir)) {
-                    for (const f of readdirSync(journalDir)) {
-                        if (!CONTEXT_FILE_EXTENSIONS.some((ext) => f.endsWith(ext)))
-                            continue;
-                        const stat = statSync(join(journalDir, f));
-                        files.push({
-                            name: `${slug}/journal/${f}`,
-                            lastModified: stat.mtime.toISOString(),
-                        });
-                    }
-                }
-            }
-        }
-        // MANAGEMENT-POLICY-CAPTURE-PLAN §4.4.1 step 1 — surface policy files
-        // under `rules/policies/` flattened into the `rules` listing so the
-        // `management-policy` skill can use the directory listing as its
-        // source-of-truth (the agent-maintained `_index.md` is only the
-        // convenience snapshot). Mirrors the `routines/custom/` flatten above.
-        if (dir === "rules") {
-            const policiesDir = join(dirPath, "policies");
-            if (existsSync(policiesDir)) {
-                for (const f of readdirSync(policiesDir)) {
-                    if (!CONTEXT_FILE_EXTENSIONS.some((ext) => f.endsWith(ext)))
-                        continue;
-                    const stat = statSync(join(policiesDir, f));
-                    files.push({
-                        name: `policies/${f}`,
-                        lastModified: stat.mtime.toISOString(),
-                    });
-                }
-            }
-        }
-        return c.json({ files });
-    });
-    // GET /context/today/reconciliation — compare open Agent Plan rows with
-    // pending/running schedules for the same local day. This is intentionally
-    // diagnostic only: morning routine may write today.md and register schedules
-    // in separate API calls, so write-time hard failure would create false
-    // conflicts. The endpoint gives operators and future jobs a server-side
-    // reconciliation surface.
-    app.get("/context/today/reconciliation", (c) => {
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, "today");
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: "today",
-                }),
-            ]);
-        }
-        if (!existsSync(fullPath)) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("context.path_not_found", {
-                    field: "path",
-                    received: "today",
-                }),
-            ]);
-        }
-        const content = readFileSync(fullPath, "utf-8");
-        const validationError = validateTodayContent(content);
-        const todayDate = extractTodayDate(content) ??
-            localDateStr(new Date(), config.timezone || undefined);
-        const openRows = extractTodayAgentPlanRows(content).rows.filter((row) => !row.checked);
-        const openRowsWithMetadata = openRows.map((row) => ({
-            row,
-            agentPlan: buildTodayAgentPlanMetadata(todayDate, row),
-        }));
-        const pendingRows = db
-            .prepare(`SELECT id, scheduled_for, task_type, task_description, task_context, status
-           FROM agent_schedule
-          WHERE status IN ('pending', 'running')`)
-            .all();
-        const schedules = pendingRows
-            .map((row) => toTodayScheduleCandidate(row, config.timezone || undefined))
-            .filter((row) => row !== null)
-            .map((row) => ({
-            ...row,
-            agentPlan: readTodayAgentPlanMetadata(row.taskContext),
-        }))
-            .filter((row) => row.agentPlan !== null && row.agentPlan.date === todayDate);
-        const rowMatches = openRowsWithMetadata.map(({ row, agentPlan }) => {
-            const matches = schedules.filter((schedule) => schedule.localDate === todayDate &&
-                schedule.localTime === row.time &&
-                schedule.agentPlan.ref === agentPlan.ref &&
-                schedule.agentPlan.fingerprint === agentPlan.fingerprint &&
-                schedule.agentPlan.category === row.category &&
-                schedule.agentPlan.trigger === row.trigger);
-            return { row, agentPlan, matches };
-        });
-        const rowsWithoutSchedule = rowMatches.filter(({ matches }) => matches.length === 0);
-        const duplicateAgentPlanSchedules = rowMatches.filter(({ matches }) => matches.length > 1);
-        const matchedScheduleIds = new Set();
-        for (const { matches } of rowMatches) {
-            for (const schedule of matches)
-                matchedScheduleIds.add(schedule.id);
-        }
-        const schedulesWithoutRow = schedules.filter((row) => !matchedScheduleIds.has(row.id));
-        const mismatchCount = (rowsWithoutSchedule.length +
-            duplicateAgentPlanSchedules.length +
-            schedulesWithoutRow.length);
-        return c.json({
-            status: validationError
-                ? "invalid_today"
-                : mismatchCount > 0
-                    ? "mismatch"
-                    : "ok",
-            validationError,
-            todayDate,
-            openAgentPlanRows: openRows.length,
-            pendingSchedules: schedules.length,
-            rowsWithoutSchedule: rowsWithoutSchedule.map(({ row, agentPlan }) => ({
-                line: row.line,
-                ref: agentPlan.ref,
-                time: row.time,
-                action: row.action,
-                category: row.category,
-                trigger: row.trigger,
-            })),
-            schedulesWithoutRow: schedulesWithoutRow.map((row) => ({
-                id: row.id,
-                ref: row.agentPlan.ref,
-                localTime: row.localTime,
-                scheduledFor: row.scheduledFor,
-                taskType: row.taskType,
-                status: row.status,
-                description: row.description,
-            })),
-            duplicateAgentPlanSchedules: duplicateAgentPlanSchedules.map(({ row, agentPlan, matches }) => ({
-                line: row.line,
-                ref: agentPlan.ref,
-                time: row.time,
-                action: row.action,
-                scheduleIds: matches.map((match) => match.id),
-            })),
-        });
-    });
-    // GET /context/health — schema drift and missing-file report for the
-    // primary context vault. Registered before the wildcard read route.
-    app.get("/context/health", (c) => {
-        const contextDir = getCurrentContextDir();
-        return c.json(buildContextHealthReport(contextDir));
-    });
-    // POST /context/repair/stub — create a known missing stub from the
-    // templates tree. This is intentionally guarded to a small allow-list;
-    // it is not an arbitrary file creation endpoint.
-    app.post("/context/repair/stub", async (c) => {
-        const parsedBody = await readOptionalJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const rawPath = parsedBody.body.path;
-        if (typeof rawPath !== "string") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_required", {
-                    field: "path",
-                    received: typeof rawPath,
-                }),
-            ], {
-                // repair-stub previously returned `error: "validation_error"` for
-                // the missing-path branch (not `"path_required"`); preserve that
-                // legacy alias so dashboard / older tests don't break.
-                legacyErrorCode: "validation_error",
-            });
-        }
-        const normalizedPath = normalizeRepairStubPath(rawPath);
-        if (!normalizedPath || !REPAIRABLE_STUB_TARGETS.has(normalizedPath)) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.stub_target_unsupported", {
-                    field: "path",
-                    received: { path: rawPath, allowed: Array.from(REPAIRABLE_STUB_TARGETS) },
-                }),
-            ]);
-        }
-        const templatesRoot = resolveTemplatesRoot(config.workspaceDir);
-        /* c8 ignore next 9 — resolveTemplatesRoot always succeeds via import.meta.url
-         * fallback in tests; the 503 branch requires a broken install where the
-         * agent-assets directory is absent from every candidate path. */
-        if (!templatesRoot) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("context.template_unavailable", {
-                    field: "templatesRoot",
-                    received: "<unresolved>",
-                }),
-            ]);
-        }
-        const templatePath = join(templatesRoot, normalizedPath);
-        if (!existsSync(templatePath)) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("context.template_not_found", {
-                    field: "path",
-                    received: { path: normalizedPath, templatePath },
-                }),
-            ]);
-        }
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, normalizedPath);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: normalizedPath,
-                }),
-            ]);
-        }
-        return withWriteLock(() => {
-            if (existsSync(fullPath)) {
-                const existingStat = statSync(fullPath);
-                return c.json({
-                    status: "exists",
-                    path: normalizedPath,
-                    lastModified: existingStat.mtime.toISOString(),
-                });
-            }
-            // Read the template once and write atomically; replaces the
-            // previous copyFileSync, which would have silently followed a
-            // symlink planted at `fullPath` during the TOCTOU window between
-            // safePath validation and the write.
-            const content = readFileSync(templatePath, "utf-8");
-            writeFileAtomically(fullPath, content);
-            writeTracker?.markWriting(fullPath, content);
-            const normalizedBase = normalizeContextPath(normalizedPath);
-            if (shouldRefreshPromptContext(normalizedBase, "PUT")) {
-                notifyPromptContextChanged(deps, normalizedBase, `context_repair_stub:${normalizedBase}`, { path: normalizedBase, method: "REPAIR" });
-            }
-            deps.onIndexableContextChange?.(normalizedPath);
-            const writtenStat = statSync(fullPath);
-            logger.info({ path: normalizedPath, templatePath }, "Context stub repaired from template");
-            return c.json({
-                status: "created",
-                path: normalizedPath,
-                lastModified: writtenStat.mtime.toISOString(),
-            });
-        });
-    });
-    // === Wildcard routes ===
-    // GET /context/* — Read context file
-    app.get("/context/*", (c) => {
-        const rawPath = c.req.path.replace("/api/context/", "");
-        if (!rawPath || rawPath === "list") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_required", {
-                    field: "path",
-                    received: rawPath === "list" ? "list (route ambiguous with /list/:dir)" : "<empty>",
-                }),
-            ]);
-        }
-        const path = normalizeContextPath(rawPath);
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, rawPath);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        if (!existsSync(fullPath)) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("context.path_not_found", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        const content = readFileSync(fullPath, "utf-8");
-        const stat = statSync(fullPath);
-        // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — record reads of `today` so the
-        // dashboard refetch-hit metric can detect when the agent invokes the
-        // Task 3 directive on a resumed turn. Bounded to `today` reads only
-        // so the agent_actions volume stays small. Best-effort: any logging
-        // failure must not break the read.
-        if (path === "today") {
-            try {
-                deps.db
-                    .prepare(`INSERT INTO agent_actions (action_type, trigger, result, detail, started_at, completed_at)
-             VALUES ('context_read', 'reactive', 'success', json(?), datetime('now'), datetime('now'))`)
-                    .run(JSON.stringify({ path }));
-            }
-            catch (err) {
-                /* c8 ignore next 5 — DB INSERT failure inside a best-effort audit path;
-                 * triggering requires closing the DB mid-request which destroys
-                 * the test harness. */
-                logger.warn({ err, path }, "Failed to record context_read agent_actions row (Stage C metrics)");
-            }
-        }
-        return c.json({
-            content,
-            lastModified: stat.mtime.toISOString(),
-            editable: isWriteAllowed(path, "PUT"),
-        });
-    });
-    // PUT /context/* — Full replace
-    app.put("/context/*", async (c) => {
-        const rawPath = c.req.path.replace("/api/context/", "");
-        const target = resolveContextTarget(rawPath);
-        const path = target.base;
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, rawPath);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        if (!isWriteAllowed(path, "PUT")) {
-            logger.warn({ path, method: "PUT" }, "Context write forbidden");
-            return respondWithAgentError(c, 403, [
-                composeIssue("context.write_forbidden", {
-                    field: "path",
-                    received: { path, method: "PUT" },
-                }),
-            ]);
-        }
-        // Morning Routine lock: reject writes to today while lock is held
-        if (morningRoutineLock.getHolder() && path === "today") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!morningRoutineLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Context PUT rejected — morning routine lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.morning_routine_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        // Roadmap write lock: reject writes to roadmap while another session holds it
-        if (roadmapWriteLock.getHolder() && path === "roadmap") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!roadmapWriteLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Context PUT rejected — roadmap write lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.roadmap_write_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        const parsedBody = await readJsonBody(c, { maxBytes: CONTEXT_BODY_MAX_BYTES });
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        const parsed = contextPutSchema.safeParse(body);
-        if (!parsed.success) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.body_not_object", {
-                    field: "body",
-                    received: parsed.error.issues.map((i) => i.message).join("; "),
-                }),
-            ]);
-        }
-        const roadmapValidationOff = isRoadmapValidationDisabled(path, c.req.header("X-Roadmap-Validation"));
-        if (roadmapValidationOff) {
-            logRoadmapValidationBypass(c, "PUT", path);
-        }
-        const expectedAgentDay = path === "today"
-            ? getAgentDayDateStr(config.timezone || undefined, config.dayBoundaryHour ?? 4)
-            : undefined;
-        const preflight = prepareContextContentForWrite(target, parsed.data.content, {
-            timezone: config.timezone || undefined,
-            disableRoadmapValidation: roadmapValidationOff,
-            defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-            expectedAgentDay,
-        });
-        if (!preflight.ok) {
-            return respondWithAgentError(c, preflight.status, [
-                composeIssue("context.content_validation_failed", {
-                    field: preflight.path ?? "content",
-                    received: preflight.message,
-                }),
-            ], {
-                legacyFields: {
-                    message: preflight.message,
-                    path: preflight.path,
-                },
-            });
-        }
-        // morning-routine-optimization.md §"PUT /api/context/daily/<date>
-        // skeleton-preservation validator" — only runs once generic
-        // frontmatter validation (type/owner/updated/H1) has passed.
-        // Returns per-field structured drift errors for the five
-        // skeleton-owned frontmatter fields (date, weekday,
-        // agent_generated, calendar_events, messages_handled) so Stage B
-        // can fix every missing/malformed field in a single retry rather
-        // than discovering them one at a time. Body is NOT validated —
-        // Stage B authors body per rules/journal-format.md.
-        if (target.base.startsWith("daily/")) {
-            const dailyRelativePath = `${target.base}${target.ext}`;
-            const driftErrors = validateDailySkeletonFrontmatter(preflight.content, dailyRelativePath);
-            if (driftErrors.length > 0) {
-                return respondWithAgentError(c, 422, driftErrors.map((drift) => composeIssue("context.daily_skeleton_field_drift", {
-                    field: drift.field,
-                    received: drift.received ?? "<missing>",
-                    expected: drift.expected,
-                })));
-            }
-        }
-        const sessionId = c.req.header("X-Session-Id");
-        return withWriteLock(() => {
-            // Append-only files: PUT is only allowed for initial creation.
-            // Once the file exists, all writes must go through PATCH to preserve
-            // the append-only contract. This check MUST be inside withWriteLock
-            // to prevent TOCTOU races where two concurrent PUTs both pass an
-            // outer existsSync check and then sequentially overwrite.
-            if (CREATE_ONLY_PUT.has(path) && existsSync(fullPath)) {
-                logger.warn({ path }, "Context PUT rejected — file exists, use PATCH to append");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.append_only_violation", {
-                        field: "path",
-                        received: { path, hint: `Use PATCH to append new sections to ${path}.` },
-                    }),
-                ]);
-            }
-            // Optimistic concurrency check: if client supplied expectedMtime,
-            // compare against the current file. On mismatch, return 409 with
-            // the current state so the UI can surface a conflict dialog without
-            // a second round-trip.
-            let snapshotId = null;
-            let contentToWrite = preflight.content;
-            if (existsSync(fullPath)) {
-                const currentStat = statSync(fullPath);
-                const currentMtime = currentStat.mtime.toISOString();
-                const existing = readFileSync(fullPath, "utf-8");
-                if (parsed.data.expectedMtime !== undefined &&
-                    parsed.data.expectedMtime !== currentMtime) {
-                    logger.info({ path, expectedMtime: parsed.data.expectedMtime, currentMtime }, "Context PUT conflict");
-                    return c.json({
-                        ok: false,
-                        error: "conflict",
-                        summary: `PUT conflict on ${path}: expectedMtime ${parsed.data.expectedMtime} did not match current ${currentMtime}. GET the file, replay your change, and retry.`,
-                        errors: [
-                            composeIssue("context.write_conflict", {
-                                field: "expectedMtime",
-                                received: { expectedMtime: parsed.data.expectedMtime, currentMtime },
-                            }),
-                        ],
-                        retryable: true,
-                        currentMtime,
-                        currentContent: existing,
-                    }, 409);
-                }
-                const prepared = prepareContextContentForWrite(target, parsed.data.content, {
-                    timezone: config.timezone || undefined,
-                    disableRoadmapValidation: roadmapValidationOff,
-                    previousRoadmapContent: existing,
-                    today: localDateStr(new Date(), config.timezone || undefined),
-                    defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-                    expectedAgentDay,
-                });
-                if (!prepared.ok) {
-                    return respondWithAgentError(c, prepared.status, [
-                        composeIssue("context.content_validation_failed", {
-                            field: prepared.path ?? "content",
-                            received: prepared.message,
-                        }),
-                    ], {
-                        legacyFields: {
-                            message: prepared.message,
-                            path: prepared.path,
-                        },
-                    });
-                }
-                contentToWrite = prepared.content;
-                snapshotId = saveSnapshot(path, existing, "api_put", true, sessionId);
-            }
-            else if (parsed.data.expectedMtime !== undefined) {
-                // Client expected a specific mtime but the file is gone
-                return c.json({
-                    ok: false,
-                    error: "conflict",
-                    summary: `PUT conflict on ${path}: expectedMtime ${parsed.data.expectedMtime} but file no longer exists.`,
-                    errors: [
-                        composeIssue("context.write_conflict", {
-                            field: "expectedMtime",
-                            received: { expectedMtime: parsed.data.expectedMtime, currentMtime: "" },
-                        }),
-                    ],
-                    retryable: true,
-                    currentMtime: "",
-                    currentContent: "",
-                }, 409);
-            }
-            // Symlink-safe atomic write — protects against a TOCTOU swap of
-            // `fullPath` to a symlink between safePath validation and the write.
-            writeFileAtomically(fullPath, contentToWrite);
-            writeTracker?.markWriting(fullPath, contentToWrite);
-            if (shouldRefreshPromptContext(path, "PUT")) {
-                notifyPromptContextChanged(deps, path, `context_put:${path}`, { path, method: "PUT" });
-            }
-            if (path.startsWith("routines/custom/")) {
-                deps.onCustomRoutinesChanged?.();
-            }
-            deps.onIndexableContextChange?.(`${path}${target.ext}`);
-            const writtenStat = statSync(fullPath);
-            logger.info({ path, method: "PUT", bytesWritten: writtenStat.size, snapshotId: snapshotId ?? undefined }, "Context file updated");
-            return c.json({
-                status: "updated",
-                snapshotId: snapshotId ?? 0,
-                lastModified: writtenStat.mtime.toISOString(),
-            });
-        });
-    });
-    // PATCH /context/* — Section operation
-    app.patch("/context/*", async (c) => {
-        const rawPath = c.req.path.replace("/api/context/", "");
-        const target = resolveContextTarget(rawPath);
-        const path = target.base;
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, rawPath);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        if (!isWriteAllowed(path, "PATCH")) {
-            logger.warn({ path, method: "PATCH" }, "Context write forbidden");
-            return respondWithAgentError(c, 403, [
-                composeIssue("context.write_forbidden", {
-                    field: "path",
-                    received: { path, method: "PATCH" },
-                }),
-            ]);
-        }
-        // Morning Routine lock: reject writes to today while lock is held
-        if (morningRoutineLock.getHolder() && path === "today") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!morningRoutineLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Context PATCH rejected — morning routine lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.morning_routine_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        // Roadmap write lock: reject writes to roadmap while another session holds it
-        if (roadmapWriteLock.getHolder() && path === "roadmap") {
-            const lockId = c.req.header("X-Lock-Id");
-            if (!roadmapWriteLock.isHeldBy(lockId)) {
-                logger.info({ path }, "Context PATCH rejected — roadmap write lock held");
-                return respondWithAgentError(c, 409, [
-                    composeIssue("context.roadmap_write_lock_held", {
-                        field: "X-Lock-Id",
-                        received: lockId ?? "<missing>",
-                    }),
-                ]);
-            }
-        }
-        const parsedBody = await readJsonBody(c, { maxBytes: CONTEXT_BODY_MAX_BYTES });
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        const parsed = contextPatchSchema.safeParse(body);
-        if (!parsed.success) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.body_not_object", {
-                    field: "body",
-                    received: parsed.error.issues.map((i) => i.message).join("; "),
-                }),
-            ]);
-        }
-        if (target.ext === ".base") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.unsupported_operation", {
-                    field: "method",
-                    received: { method: "PATCH", ext: ".base", hint: "Use PUT to replace .base files." },
-                }),
-            ]);
-        }
-        const { section, mode, content: newContent, cutoff, maxEntries } = parsed.data;
-        const sessionId = c.req.header("X-Session-Id");
-        const roadmapValidationOff = isRoadmapValidationDisabled(path, c.req.header("X-Roadmap-Validation"));
-        if (roadmapValidationOff) {
-            logRoadmapValidationBypass(c, "PATCH", path);
-        }
-        const expectedAgentDay = path === "today"
-            ? getAgentDayDateStr(config.timezone || undefined, config.dayBoundaryHour ?? 4)
-            : undefined;
-        return withWriteLock(() => {
-            if (!existsSync(fullPath)) {
-                return respondWithAgentError(c, 404, [
-                    composeIssue("context.path_not_found", {
-                        field: "path",
-                        received: path,
-                    }),
-                ]);
-            }
-            const fileContent = readFileSync(fullPath, "utf-8");
-            // ── append_to_file: append content to end of file (no section lookup) ──
-            // Designed for agent/journal.md and similar append-only files where
-            // each write adds a new top-level ## section rather than modifying
-            // an existing one. Avoids the hack of targeting the last section's
-            // body and injecting H2 headers inside it.
-            if (mode === "append_to_file") {
-                const separator = fileContent.endsWith("\n") ? "" : "\n";
-                const updated = fileContent + separator + (newContent ?? "") + "\n";
-                const prepared = prepareContextContentForWrite(target, updated, {
-                    timezone: config.timezone || undefined,
-                    disableRoadmapValidation: roadmapValidationOff,
-                    previousRoadmapContent: fileContent,
-                    today: localDateStr(new Date(), config.timezone || undefined),
-                    defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-                    allowLegacyToday: path === "today" && isLegacyTodayContent(fileContent),
-                    expectedAgentDay,
-                });
-                if (!prepared.ok) {
-                    return respondWithAgentError(c, prepared.status, [
-                        composeIssue("context.content_validation_failed", {
-                            field: prepared.path ?? "content",
-                            received: prepared.message,
-                        }),
-                    ], {
-                        legacyFields: {
-                            message: prepared.message,
-                            path: prepared.path,
-                        },
-                    });
-                }
-                saveSnapshot(path, fileContent, "api_patch", false, sessionId);
-                writeFileAtomically(fullPath, prepared.content);
-                writeTracker?.markWriting(fullPath, prepared.content);
-                if (shouldRefreshPromptContext(path, "PATCH")) {
-                    notifyPromptContextChanged(deps, path, `context_patch:${path}`, {
-                        path,
-                        method: "PATCH",
-                        mode,
-                        section,
-                        content: newContent,
-                        previousContent: fileContent,
-                    });
-                }
-                if (path.startsWith("routines/custom/")) {
-                    deps.onCustomRoutinesChanged?.();
-                }
-                deps.onIndexableContextChange?.(`${path}${target.ext}`);
-                logger.info({ path, method: "PATCH", mode }, "Content appended to file");
-                return c.json({ status: "appended" });
-            }
-            // ── Section-based modes: require section lookup ──
-            const sectionBounds = findSection(fileContent, section);
-            if (!sectionBounds) {
-                const availableSections = getAvailableSections(fileContent);
-                return respondWithAgentError(c, 400, [
-                    composeIssue("context.section_not_found", {
-                        field: "section",
-                        received: { section, availableSections },
-                    }),
-                ], {
-                    legacyFields: {
-                        section,
-                        availableSections,
-                    },
-                });
-            }
-            let updated;
-            const before = fileContent.slice(0, sectionBounds.start);
-            const after = fileContent.slice(sectionBounds.end);
-            const currentBody = fileContent.slice(sectionBounds.start, sectionBounds.end);
-            let removedCount;
-            let trimmedCount;
-            switch (mode) {
-                case "append": {
-                    // Ensure a single newline separator without destroying existing content
-                    const separator = currentBody.endsWith("\n") ? "" : "\n";
-                    let appendedBody = currentBody + separator + (newContent ?? "") + "\n";
-                    // maxEntries: trim oldest bullet entries from the top
-                    if (maxEntries !== undefined) {
-                        const trimResult = trimBulletEntries(appendedBody, maxEntries);
-                        appendedBody = trimResult.body;
-                        trimmedCount = trimResult.trimmed;
-                    }
-                    updated = before + appendedBody + after;
-                    break;
-                }
-                case "replace":
-                    updated = before + (newContent ?? "") + "\n" + after;
-                    break;
-                case "clear":
-                    updated = before + "\n" + after;
-                    break;
-                case "clear_before": {
-                    // Schema refinements validate format, but defense-in-depth for
-                    // direct API callers that bypass schema validation.
-                    if (!cutoff || !/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(cutoff)) {
-                        return respondWithAgentError(c, 400, [
-                            composeIssue("context.cutoff_required", {
-                                field: "cutoff",
-                                received: cutoff ?? "<missing>",
-                                expected: "'YYYY-MM-DD HH:MM:SS' format (zero-padded)",
-                            }),
-                        ]);
-                    }
-                    const clearResult = clearEntriesBefore(currentBody, cutoff);
-                    updated = before + clearResult.remaining + after;
-                    removedCount = clearResult.removedCount;
-                    break;
-                }
-            }
-            const prepared = prepareContextContentForWrite(target, updated, {
-                timezone: config.timezone || undefined,
-                disableRoadmapValidation: roadmapValidationOff,
-                previousRoadmapContent: fileContent,
-                today: localDateStr(new Date(), config.timezone || undefined),
-                defaultLongTermPlanSource: roadmapDefaultLongTermPlanSource(c),
-                allowLegacyToday: path === "today" && isLegacyTodayContent(fileContent),
-                expectedAgentDay,
-            });
-            if (!prepared.ok) {
-                return respondWithAgentError(c, prepared.status, [
-                    composeIssue("context.content_validation_failed", {
-                        field: prepared.path ?? "content",
-                        received: prepared.message,
-                    }),
-                ], {
-                    legacyFields: {
-                        message: prepared.message,
-                        path: prepared.path,
-                    },
-                });
-            }
-            // Force snapshot on replace (bypass debounce) to ensure recovery
-            // from accidental overwrites. Other modes use normal debounce.
-            const forceSnapshot = mode === "replace" || mode === "clear" || mode === "clear_before";
-            saveSnapshot(path, fileContent, "api_patch", forceSnapshot, sessionId);
-            writeFileAtomically(fullPath, prepared.content);
-            writeTracker?.markWriting(fullPath, prepared.content);
-            if (shouldRefreshPromptContext(path, "PATCH")) {
-                notifyPromptContextChanged(deps, path, `context_patch:${path}`, {
-                    path,
-                    method: "PATCH",
-                    mode,
-                    section,
-                    content: newContent,
-                    previousContent: fileContent,
-                });
-            }
-            if (path.startsWith("routines/custom/")) {
-                deps.onCustomRoutinesChanged?.();
-            }
-            deps.onIndexableContextChange?.(`${path}${target.ext}`);
-            const resultStatus = mode === "append" ? "appended" : mode === "replace" ? "replaced" : "cleared";
-            logger.info({ path, method: "PATCH", section, mode, removedCount, trimmedCount }, "Context section " + resultStatus);
-            return c.json({ status: resultStatus, removedCount, trimmedCount });
-        });
-    });
-    // DELETE /context/* — File delete (currently limited to `routines/custom/*`
-    // via the write-permission whitelist). B-007 §5.8 Q3: the agent retires a
-    // custom routine after the user confirms. The scheduler listens via
-    // `onCustomRoutinesChanged` and unregisters the cron job on reload.
-    app.delete("/context/*", (c) => {
-        const path = normalizeContextPath(c.req.path.replace("/api/context/", ""));
-        const contextDir = getCurrentContextDir();
-        const fullPath = safePath(contextDir, path);
-        if (!fullPath) {
-            return respondWithAgentError(c, 400, [
-                composeIssue("context.path_invalid", {
-                    field: "path",
-                    received: path,
-                }),
-            ]);
-        }
-        if (!isWriteAllowed(path, "DELETE")) {
-            logger.warn({ path, method: "DELETE" }, "Context delete forbidden");
-            return respondWithAgentError(c, 403, [
-                composeIssue("context.write_forbidden", {
-                    field: "path",
-                    received: { path, method: "DELETE" },
-                }),
-            ]);
-        }
-        return withWriteLock(() => {
-            if (!existsSync(fullPath)) {
-                return respondWithAgentError(c, 404, [
-                    composeIssue("context.path_not_found", {
-                        field: "path",
-                        received: path,
-                    }),
-                ]);
-            }
-            const existing = readFileSync(fullPath, "utf-8");
-            const snapshotId = saveSnapshot(path, existing, "api_delete", true);
-            unlinkSync(fullPath);
-            if (path.startsWith("routines/custom/")) {
-                deps.onCustomRoutinesChanged?.();
-            }
-            deps.onIndexableContextChange?.(path);
-            logger.info({ path, method: "DELETE", snapshotId: snapshotId ?? undefined }, "Context file deleted");
-            return c.json({ status: "deleted", snapshotId: snapshotId ?? 0 });
-        });
-    });
-    return app;
-}
-// Path/permission helpers stay test-exported until PR 4 moves them into
-// `routes/context/{path-resolve,permissions}.ts`. The validator surface
-// previously exported here now lives in `core/context-validation/` and
-// is tested at its source.
-export { isWriteAllowed, safePath, resolveContextTarget };
-//# sourceMappingURL=context.js.map