@aitne/daemon 0.1.8 → 0.1.10

package/dist/api/routes/calendar.js

@@ -215,7 +215,12 @@ export function createCalendarRoutes(deps) {
             if (date === "today") {
                 date = localDateStr(new Date());
             }
-            const days = Math.min(Number(c.req.query("days") ?? "1"), 90);
+            // Guard non-finite `days` (e.g. `?days=abc` → NaN) — without it the
+            // NaN propagates into `new Date(startMs + NaN).toISOString()`, which
+            // throws RangeError and surfaces as an opaque 500 instead of a sane
+            // bounded window. Clamp finite values to [1, 90]; fall back to 1.
+            const daysRaw = Number(c.req.query("days") ?? "1");
+            const days = Number.isFinite(daysRaw) ? Math.min(Math.max(daysRaw, 1), 90) : 1;
             // Append Z to ensure UTC parsing regardless of OS timezone
             const startMs = new Date(`${date}T00:00:00Z`).getTime();
             if (Number.isNaN(startMs)) {
@@ -594,7 +599,12 @@ export function createCalendarRoutes(deps) {
             if (date === "today") {
                 date = localDateStr(new Date());
             }
-            const days = Math.min(Number(c.req.query("days") ?? "1"), 90);
+            // Guard non-finite `days` (e.g. `?days=abc` → NaN) — without it the
+            // NaN propagates into `new Date(startMs + NaN).toISOString()`, which
+            // throws RangeError and surfaces as an opaque 500 instead of a sane
+            // bounded window. Clamp finite values to [1, 90]; fall back to 1.
+            const daysRaw = Number(c.req.query("days") ?? "1");
+            const days = Number.isFinite(daysRaw) ? Math.min(Math.max(daysRaw, 1), 90) : 1;
             const startMs = new Date(`${date}T00:00:00Z`).getTime();
             if (Number.isNaN(startMs)) {
                 return respondWithAgentError(c, 400, [
@@ -623,4 +633,3 @@ export function createCalendarRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=calendar.js.map

package/dist/api/routes/commands.d.ts

@@ -1,4 +1,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createCommandsRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=commands.d.ts.map

package/dist/api/routes/commands.js

@@ -144,11 +144,17 @@ export function createCommandsRoutes(deps) {
         const backendId = parsed.data.backendId;
         // Bang commands fire through the BackendRouter at run time. Reject any
         // backend that is type-system-registered but does not have an
-        // `IAgentCore` wired into the router yet (Phase 1 = opencode). Without
-        // this gate, a saved row would persist and dispatch later with
+        // `IAgentCore` wired into the router yet. Without this gate, a saved
+        // row would persist and dispatch later with
         // `BackendDecisiveFailure(model_unavailable)` from
         // `BackendRouter.requireCore` — much harder to debug than a clear
-        // 400 at create time.
+        // 400 at create time. As of this writing every entry in `BACKEND_IDS`
+        // is also in `RUNTIME_AVAILABLE_BACKEND_IDS`, so the body is dead
+        // until a future backend (e.g. antigravity) is registered to the type
+        // system before it has runtime wiring. Coverage is exempted because
+        // exercising the branch requires mocking the shared constants in a
+        // way that doesn't reflect real product state.
+        /* c8 ignore start */
         if (!isRuntimeAvailableBackendId(backendId)) {
             return {
                 ok: false,
@@ -161,6 +167,7 @@ export function createCommandsRoutes(deps) {
                 },
             };
         }
+        /* c8 ignore stop */
         const modelKnown = getModelsForBackend(backendId).some((model) => model.modelId === parsed.data.modelId && model.available);
         if (!modelKnown) {
             return {
@@ -270,4 +277,3 @@ export function createCommandsRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=commands.js.map

package/dist/api/routes/context/frontmatter-merge.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Deep-merge a partial frontmatter object into a markdown file's existing
+ * YAML frontmatter, preserving the body verbatim.
+ *
+ * Drives the `frontmatterMerge` PATCH mode (docs/design/21-management-
+ * registry-and-entities.md §10.4 step 4b): the scheduled-managed-task flow
+ * links each contributing app into an entity file's nested `sources.<app>`
+ * map (plus scalars like `last_synced_at`) without clobbering other apps'
+ * source ids, other frontmatter keys, or the markdown body. The section /
+ * append PATCH modes only ever touch the body, so before this mode the agent
+ * had no chokepoint-safe way to edit nested frontmatter.
+ *
+ * Merge semantics: plain objects merge key-by-key recursively; every other
+ * value (scalar, array, null) from `partial` REPLACES the base value. This is
+ * exactly what "set sources.<app>.<id> = …" needs — a new app key is added,
+ * an existing app's fields are merged, and a scalar like `last_synced_at` is
+ * overwritten.
+ */
+export type FrontmatterMergeResult = {
+    ok: true;
+    content: string;
+} | {
+    ok: false;
+    message: string;
+};
+/** Recursively merge `partial` into `base`; returns a new object (inputs untouched). */
+export declare function deepMergePlainObjects(base: Record<string, unknown>, partial: Record<string, unknown>): Record<string, unknown>;
+export declare function mergeFrontmatter(fileContent: string, partial: Record<string, unknown>): FrontmatterMergeResult;

package/dist/api/routes/context/frontmatter-merge.js

@@ -0,0 +1,56 @@
+import yaml from "js-yaml";
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Recursively merge `partial` into `base`; returns a new object (inputs untouched). */
+export function deepMergePlainObjects(base, partial) {
+    const out = { ...base };
+    for (const [key, value] of Object.entries(partial)) {
+        const existing = out[key];
+        out[key] =
+            isPlainObject(existing) && isPlainObject(value)
+                ? deepMergePlainObjects(existing, value)
+                : value;
+    }
+    return out;
+}
+// Matches a leading YAML frontmatter block: `---\n … \n---\n?`. The body is
+// everything after the closing fence. Tolerant of CRLF.
+const FRONTMATTER_BLOCK_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+export function mergeFrontmatter(fileContent, partial) {
+    const eol = /\r\n/.test(fileContent) ? "\r\n" : "\n";
+    let base = {};
+    let body = fileContent;
+    const match = FRONTMATTER_BLOCK_RE.exec(fileContent);
+    if (match) {
+        let parsed;
+        try {
+            // js-yaml v4 `load` is the safe loader (no code execution).
+            parsed = yaml.load(match[1]);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                message: `existing frontmatter is not valid YAML: ${String(err)}`,
+            };
+        }
+        if (parsed != null) {
+            if (!isPlainObject(parsed)) {
+                return {
+                    ok: false,
+                    message: "existing frontmatter is not a YAML mapping (object)",
+                };
+            }
+            base = parsed;
+        }
+        body = fileContent.slice(match[0].length);
+    }
+    const merged = deepMergePlainObjects(base, partial);
+    // `lineWidth: -1` keeps long scalars (ids, paths) unwrapped; `sortKeys:
+    // false` preserves insertion order (existing keys first, then new ones).
+    const dumped = yaml.dump(merged, { lineWidth: -1, noRefs: true, sortKeys: false });
+    // yaml.dump always emits LF; rewrite to the file's EOL so a CRLF vault file
+    // (Obsidian on Windows) does not round-trip dirty under git autocrlf.
+    const dumpedEol = eol === "\r\n" ? dumped.replace(/\n/g, "\r\n") : dumped;
+    return { ok: true, content: `---${eol}${dumpedEol}---${eol}${body}` };
+}

package/dist/api/routes/context/index.d.ts

@@ -7,16 +7,24 @@ import type { LongTermPlanSource } from "../../../core/roadmap-horizon.js";
 export { resolveContextTarget, safePath } from "./path-resolve.js";
 /**
  * Shared closure bundle passed to every sub-registrar. Hosts the locks,
- * snapshot debounce, write mutex, and the per-request helpers that need
- * factory-time configuration (timezone, body parser). Sub-files import
- * this type with `import type` so there is no runtime cycle with index.ts.
+ * snapshot debounce, and the per-request helpers that need factory-time
+ * configuration (timezone, body parser). Sub-files import this type with
+ * `import type` so there is no runtime cycle with index.ts.
+ *
+ * Note: the legacy per-router `withWriteLock` mutex was retired in favour
+ * of the daemon-singleton {@link serializeContextFileWrite} (per-absolute-
+ * path), which also fences against in-process daemon-direct writers
+ * (today-direct-writer, agent-journal-appender, roadmap-maintenance,
+ * scheduled-tasks weekly-interests appender). The per-router mutex
+ * only covered HTTP-vs-HTTP within a single router instance, leaving
+ * the HTTP-vs-direct race that allowed silent today.md / agent/journal.md
+ * clobbers.
  */
 export interface ContextRouteContext {
     readonly deps: ApiDependencies;
     readonly getCurrentContextDir: () => string;
     readonly morningRoutineLock: TodayWriteLockManager;
     readonly roadmapWriteLock: RoadmapWriteLockManager;
-    readonly withWriteLock: <T>(fn: () => T) => Promise<T>;
     readonly saveSnapshot: (filePath: string, content: string, trigger: string, force?: boolean, sessionId?: string | null) => number | null;
     readonly isRoadmapValidationDisabled: (path: string, headerValue?: string) => boolean;
     readonly logRoadmapValidationBypass: (c: Context, method: string, path: string) => void;
@@ -30,4 +38,3 @@ export interface ContextRouteContext {
     }>;
 }
 export declare function createContextRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=index.d.ts.map

package/dist/api/routes/context/index.js

@@ -83,23 +83,6 @@ export function createContextRoutes(deps) {
         new InMemoryRoadmapWriteLockManager(getRoadmapWriteLockTimeoutMs(config.executeTimeoutMinutes));
     // Per-instance state (not shared across tests)
     const lastSnapshotTimes = new Map();
-    // Mutex for serialized writes
-    let writeLock = Promise.resolve();
-    function withWriteLock(fn) {
-        const prev = writeLock;
-        let resolve;
-        writeLock = new Promise((r) => {
-            resolve = r;
-        });
-        return prev.then(() => {
-            try {
-                return fn();
-            }
-            finally {
-                resolve();
-            }
-        });
-    }
     function saveSnapshot(filePath, content, trigger, force = false, sessionId) {
         const now = Date.now();
         const lastTime = lastSnapshotTimes.get(filePath) ?? 0;
@@ -113,7 +96,7 @@ export function createContextRoutes(deps) {
         return Number(result.lastInsertRowid);
     }
     function isRoadmapValidationDisabled(path, headerValue) {
-        return path === "roadmap" && headerValue?.toLowerCase() === "off";
+        return path === "plans/roadmap" && headerValue?.toLowerCase() === "off";
     }
     function logRoadmapValidationBypass(c, method, path) {
         logger.warn({
@@ -171,7 +154,6 @@ export function createContextRoutes(deps) {
         getCurrentContextDir,
         morningRoutineLock,
         roadmapWriteLock,
-        withWriteLock,
         saveSnapshot,
         isRoadmapValidationDisabled,
         logRoadmapValidationBypass,
@@ -190,4 +172,3 @@ export function createContextRoutes(deps) {
     registerWriteRoutes(app, ctx);
     return app;
 }
-//# sourceMappingURL=index.js.map

package/dist/api/routes/context/locks.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ContextRouteContext } from "./index.js";
 export declare function registerLockRoutes(app: Hono, ctx: ContextRouteContext): void;
-//# sourceMappingURL=locks.d.ts.map

package/dist/api/routes/context/locks.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { localDateStr } from "@aitne/shared";
+import { serializeContextFileWrite } from "../../../core/context-file-serializer.js";
 import { isValidYmd } from "../../../core/roadmap-horizon.js";
 import { extractRoadmapIds, generateRoadmapId, RoadmapIdGenerationError, } from "../../../core/roadmap-ids.js";
 import { createLogger } from "../../../logging.js";
@@ -7,7 +8,7 @@ import { composeIssue, respondWithAgentError, } from "../../helpers/agent-errors
 import { safePath } from "./path-resolve.js";
 const logger = createLogger("context-api");
 export function registerLockRoutes(app, ctx) {
-    const { deps, morningRoutineLock, roadmapWriteLock, withWriteLock, getCurrentContextDir, readOptionalJsonBody, } = ctx;
+    const { deps, morningRoutineLock, roadmapWriteLock, getCurrentContextDir, readOptionalJsonBody, } = ctx;
     const { config } = deps;
     // POST /context/lock/morning-routine — Acquire exclusive lock
     app.post("/context/lock/morning-routine", (c) => {
@@ -67,7 +68,7 @@ export function registerLockRoutes(app, ctx) {
         ]);
     });
     // POST /context/roadmap/id — Mint a stable daemon-owned roadmap entry id.
-    app.post("/context/roadmap/id", async (c) => {
+    app.post("/context/plans/roadmap/id", async (c) => {
         if (roadmapWriteLock.getHolder()) {
             const lockId = c.req.header("X-Lock-Id");
             if (!roadmapWriteLock.isHeldBy(lockId)) {
@@ -95,17 +96,17 @@ export function registerLockRoutes(app, ctx) {
                 }),
             ]);
         }
-        return withWriteLock(() => {
-            const contextDir = getCurrentContextDir();
-            const fullPath = safePath(contextDir, "roadmap");
-            if (!fullPath) {
-                return respondWithAgentError(c, 400, [
-                    composeIssue("context.path_invalid", {
-                        field: "path",
-                        received: "roadmap",
-                    }),
-                ]);
-            }
+        const contextDir = getCurrentContextDir();
+        const fullPath = safePath(contextDir, "roadmap");
+        if (!fullPath) {
+            return respondWithAgentError(c, 400, [
+                composeIssue("context.path_invalid", {
+                    field: "path",
+                    received: "roadmap",
+                }),
+            ]);
+        }
+        return serializeContextFileWrite(fullPath, () => {
             const content = existsSync(fullPath)
                 ? readFileSync(fullPath, "utf-8")
                 : "";
@@ -133,4 +134,3 @@ export function registerLockRoutes(app, ctx) {
         });
     });
 }
-//# sourceMappingURL=locks.js.map

package/dist/api/routes/context/path-resolve.d.ts

@@ -1,4 +1,16 @@
 import type { ResolvedContextTarget } from "../../../core/context-validation/index.js";
+/**
+ * Resolve a user-supplied path into a canonical `(base, ext)` pair.
+ *
+ * **Legacy alias translation** (CONTEXT_VAULT_REDESIGN_PLAN.md §7.3,
+ * §14.3, v4 V8): every entry point first canonicalises the path
+ * through `aliasVaultPath` so legacy spellings (e.g. `today.md`,
+ * `user/profile.md`, `rules/management.md`) resolve to their six-class
+ * destinations (`state/today.md`, `identity/profile.md`,
+ * `policies/management.md`). The alias is an in-process resolver — no
+ * HTTP 3xx — so existing `curl -s -X PATCH` callers that omit `-L`
+ * continue to work. Idempotent on already-canonical paths.
+ */
 export declare function resolveContextTarget(userPath: string): ResolvedContextTarget;
 export declare function normalizeContextPath(userPath: string): string;
 export declare function isDeniedPath(relativePath: string): boolean;
@@ -12,4 +24,3 @@ export declare function resolveRealPathBestEffort(path: string, seen?: Set<strin
  * deny list.
  */
 export declare function safePath(contextDir: string, userPath: string): string | null;
-//# sourceMappingURL=path-resolve.d.ts.map

package/dist/api/routes/context/path-resolve.js

@@ -1,6 +1,10 @@
+// drift-allow-file: this module documents the alias contract and
+// translates legacy `user/`, `rules/`, etc. paths to their six-class
+// destinations. Legacy refs in the docstring are load-bearing.
 import { lstatSync, readlinkSync, realpathSync, } from "node:fs";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { CONTEXT_BASE_FILE_STEMS, CONTEXT_FILE_EXTENSIONS, } from "../../../core/context-paths.js";
+import { aliasVaultPath } from "../../../core/context-vault-aliases.js";
 import { createLogger } from "../../../logging.js";
 const logger = createLogger("context-api");
 const CONTEXT_BASE_FILE_STEM_SET = new Set(CONTEXT_BASE_FILE_STEMS);
@@ -18,23 +22,41 @@ const CONTEXT_BASE_FILE_STEM_SET = new Set(CONTEXT_BASE_FILE_STEMS);
  * the agent may read or edit Obsidian's workspace state through this API.
  */
 const DENIED_SUBPATH_ROOTS = [".git", ".DS_Store", ".obsidian"];
+/**
+ * Resolve a user-supplied path into a canonical `(base, ext)` pair.
+ *
+ * **Legacy alias translation** (CONTEXT_VAULT_REDESIGN_PLAN.md §7.3,
+ * §14.3, v4 V8): every entry point first canonicalises the path
+ * through `aliasVaultPath` so legacy spellings (e.g. `today.md`,
+ * `user/profile.md`, `rules/management.md`) resolve to their six-class
+ * destinations (`state/today.md`, `identity/profile.md`,
+ * `policies/management.md`). The alias is an in-process resolver — no
+ * HTTP 3xx — so existing `curl -s -X PATCH` callers that omit `-L`
+ * continue to work. Idempotent on already-canonical paths.
+ */
 export function resolveContextTarget(userPath) {
+    const aliased = aliasVaultPath(userPath).canonicalPath;
     for (const ext of CONTEXT_FILE_EXTENSIONS) {
-        if (userPath.endsWith(ext)) {
-            return { base: userPath.slice(0, -ext.length), ext };
+        if (aliased.endsWith(ext)) {
+            return { base: aliased.slice(0, -ext.length), ext };
         }
     }
-    if (CONTEXT_BASE_FILE_STEM_SET.has(userPath)) {
-        return { base: userPath, ext: ".base" };
+    if (CONTEXT_BASE_FILE_STEM_SET.has(aliased)) {
+        return { base: aliased, ext: ".base" };
     }
-    return { base: userPath, ext: ".md" };
+    return { base: aliased, ext: ".md" };
 }
 export function normalizeContextPath(userPath) {
     return resolveContextTarget(userPath).base;
 }
 export function isDeniedPath(relativePath) {
+    // path.relative emits OS-native separators (backslash on Windows); the
+    // DENIED_SUBPATH_ROOTS prefixes are forward-slash. Normalize before the
+    // compare so nested `.git\config`, `.obsidian\workspace.json`, etc. are
+    // caught on Windows. POSIX paths contain no backslashes -> no-op there.
+    const normalized = relativePath.replace(/\\/g, "/");
     for (const root of DENIED_SUBPATH_ROOTS) {
-        if (relativePath === root || relativePath.startsWith(`${root}/`)) {
+        if (normalized === root || normalized.startsWith(`${root}/`)) {
             return true;
         }
     }
@@ -74,7 +96,7 @@ export function resolveRealPathBestEffort(path, seen = new Set()) {
  */
 export function safePath(contextDir, userPath) {
     const { base, ext } = resolveContextTarget(userPath);
-    if (base === "projects/_active" && ext !== ".base") {
+    if (base === "plans/projects/_active" && ext !== ".base") {
         logger.warn({ userPath, base, ext }, "Base file requested with wrong extension");
         return null;
     }
@@ -106,4 +128,3 @@ export function safePath(contextDir, userPath) {
     }
     return resolved;
 }
-//# sourceMappingURL=path-resolve.js.map

package/dist/api/routes/context/permissions.d.ts

@@ -1,13 +1,37 @@
 import type { ApiDependencies } from "../../server.js";
 import { classifyContextWriteStaleness } from "../../../core/context-staleness.js";
+/**
+ * Write-permission whitelist (CONTEXT_VAULT_REDESIGN_PLAN.md §7.1).
+ *
+ * After the six-class restructure the table collapses from 26 explicit
+ * patterns to one per class prefix plus a small number of exceptions
+ * (`CREATE_ONLY_PUT`, `git/{slug}` placeholders, lifecycle DELETEs).
+ * Legacy URLs (`PUT /api/context/today.md` etc.) are normalised by the
+ * API alias resolver before this table is consulted, so canonical paths
+ * are the only inputs we have to enumerate.
+ */
 export declare const CONTEXT_WRITE_PERMISSIONS: Record<string, string[]>;
 /**
  * Paths where PUT is only allowed when the file does not yet exist.
  * Subsequent writes must go through PATCH (append). This enforces the
  * append-only contract at the API level rather than relying on prompt
  * compliance alone.
+ *
+ * The contract has two sides — PUT-after-creation is denied here; the
+ * PATCH handler additionally restricts these paths to {@link APPEND_ONLY_PATCH_MODES},
+ * so `mode:"replace"` / `"clear"` / `"clear_before"` cannot erase existing
+ * sections behind the agent's back.
  */
 export declare const CREATE_ONLY_PUT: Set<string>;
+/**
+ * PATCH modes that count as "append-style" for paths in {@link CREATE_ONLY_PUT}.
+ * Every other mode (`"replace"`, `"clear"`, `"clear_before"`) MUST be
+ * rejected on append-only paths — otherwise a prompt-injected agent (or
+ * any caller with a valid bearer token) could PATCH `agent/journal` with
+ * `mode:"replace"` against a section and destroy historical entries the
+ * "create-only PUT" gate was meant to protect.
+ */
+export declare const APPEND_ONLY_PATCH_MODES: Set<string>;
 /**
  * Slug regex shared by `{slug}` and `{date}` placeholders. Matches the
  * sanitized output of `deriveSlug` (a-z, 0-9, dot, underscore, dash) and
@@ -32,4 +56,3 @@ export declare function isWriteAllowed(path: string, method: string): boolean;
  */
 export declare function shouldRefreshPromptContext(path: string, method: string): boolean;
 export declare function notifyPromptContextChanged(deps: ApiDependencies, path: string, reason: string, input: Parameters<typeof classifyContextWriteStaleness>[0]): void;
-//# sourceMappingURL=permissions.d.ts.map