@aitne/daemon 0.1.8 → 0.1.10

package/dist/api/routes/dashboard/index.d.ts

@@ -24,4 +24,3 @@ import type { ApiDependencies } from "../../server.js";
  * `conversations.ts` and `snapshots.ts` sub-files respectively.
  */
 export declare function createDashboardRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=index.d.ts.map

package/dist/api/routes/dashboard/index.js

@@ -44,4 +44,3 @@ export function createDashboardRoutes(deps) {
     registerSnapshotsRoutes(app, deps);
     return app;
 }
-//# sourceMappingURL=index.js.map

package/dist/api/routes/dashboard/messaging.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerMessagingRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=messaging.d.ts.map

package/dist/api/routes/dashboard/messaging.js

@@ -6,9 +6,8 @@ export function registerMessagingRoutes(app, deps) {
      * POST /messaging/whatsapp/pair
      *
      * Triggers Baileys pairing and waits up to ~10s for the first scannable QR.
-     * If WhatsApp isn't enabled yet, returns 409 with a clear hint instead of
-     * silently 404'ing — this surfaces the original setup-flow bug where users
-     * clicked Pair without first enabling.
+     * Returns 409 (not 404) when WhatsApp isn't enabled yet so the dashboard
+     * can show an actionable hint instead of a generic not-found.
      */
     app.post("/messaging/whatsapp/pair", async (c) => {
         if (!deps.whatsappControls) {
@@ -348,4 +347,3 @@ export function registerMessagingRoutes(app, deps) {
         return c.json(deps.messagingControls.discord.getPairingStatus());
     });
 }
-//# sourceMappingURL=messaging.js.map

package/dist/api/routes/dashboard/notifications.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerNotificationsRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=notifications.d.ts.map

package/dist/api/routes/dashboard/notifications.js

@@ -106,4 +106,3 @@ export function registerNotificationsRoutes(app, deps) {
         });
     });
 }
-//# sourceMappingURL=notifications.js.map

package/dist/api/routes/dashboard/oauth-google.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerOauthGoogleRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=oauth-google.d.ts.map

package/dist/api/routes/dashboard/oauth-google.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { loopbackOrigins, resolveDashboardPort } from "@aitne/shared";
 import { getGoogleOAuthClientConfig, parseGoogleCredentialsJson, } from "../../../services/google-auth.js";
 import { createLogger, toSafeErrorMessage } from "../../../logging.js";
 const MAX_UPLOAD_SIZE = 100 * 1024; // 100 KB — credential files are small
@@ -21,7 +22,7 @@ export function registerOauthGoogleRoutes(app, deps) {
     // The OAuth callback HTML uses `window.opener.postMessage(..., target)`
     // to notify the dashboard that auth succeeded. `target` was previously
     // derived from the Origin/Referer headers at start time with a
-    // `http://localhost:3000` fallback when neither was present. Both
+    // `http://localhost:<dashboard port>` fallback when neither was present. Both
     // headers are attacker-controlled in the request that *initiates* the
     // flow (the attacker's page can be `http://attacker.com`), so the
     // postMessage notification could be steered off the trusted dashboard.
@@ -31,16 +32,12 @@ export function registerOauthGoogleRoutes(app, deps) {
     // and a future widening of the payload would leak silently. Defence is
     // a closed allowlist: only same-origin localhost variants on the
     // configured dashboard port are accepted; anything else rejects the
-    // OAuth start with 403.
-    const dashboardPort = Number.parseInt(process.env.PA_DASHBOARD_PORT ?? "", 10) || 3000;
-    const allowedDashboardOrigins = new Set([
-        `http://localhost:${dashboardPort}`,
-        `http://127.0.0.1:${dashboardPort}`,
-        // IPv6 loopback — some dev environments (Docker desktop with IPv6
-        // preference, certain Node IPv6-first configurations) emit origins
-        // in this form. URL.origin returns the bracketed literal.
-        `http://[::1]:${dashboardPort}`,
-    ]);
+    // OAuth start with 403. `loopbackOrigins` covers all three loopback
+    // forms — the `[::1]` variant matters because some IPv6-first
+    // environments (Docker Desktop with IPv6 preference, certain Node
+    // IPv6-first configs) emit it, and URL.origin returns the bracketed
+    // literal.
+    const allowedDashboardOrigins = new Set(loopbackOrigins(resolveDashboardPort()));
     function parseOriginSafely(value) {
         if (!value)
             return null;
@@ -163,17 +160,17 @@ export function registerOauthGoogleRoutes(app, deps) {
         if (!clientConfig) {
             return c.json({ error: "Invalid credentials format" }, 400);
         }
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         let google;
         try {
-            const mod = await import("googleapis");
+            const mod = (await import("googleapis"));
             google = mod.google;
         }
         catch {
             return c.json({ error: "googleapis package not installed" }, 500);
         }
-        // Use daemon's own port for the OAuth callback
-        const redirectUri = `http://localhost:${config.apiPort}/api/config/google-auth/callback`;
+        // Use daemon's own port for the OAuth callback.
+        // Use 127.0.0.1, not localhost: daemon binds IPv4 loopback only; on Windows localhost resolves to ::1 first and the callback would ECONNREFUSED. Google special-cases loopback redirects for installed-app clients.
+        const redirectUri = `http://127.0.0.1:${config.apiPort}/api/config/google-auth/callback`;
         const oauth2Client = new google.auth.OAuth2(clientConfig.client_id, clientConfig.client_secret, redirectUri);
         // Request scopes for Calendar + Gmail
         const scopes = [
@@ -259,7 +256,8 @@ export function registerOauthGoogleRoutes(app, deps) {
                 throw new Error("Invalid credentials");
             const mod = await import("googleapis");
             const google = mod.google;
-            const redirectUri = `http://localhost:${config.apiPort}/api/config/google-auth/callback`;
+            // Use 127.0.0.1, not localhost: must byte-match the auth-start redirect_uri (Google re-validates an exact string at getToken); daemon binds IPv4 loopback only, and on Windows localhost resolves to ::1 first.
+            const redirectUri = `http://127.0.0.1:${config.apiPort}/api/config/google-auth/callback`;
             const oauth2Client = new google.auth.OAuth2(clientConfig.client_id, clientConfig.client_secret, redirectUri);
             // Exchange authorization code for tokens
             const { tokens } = await oauth2Client.getToken(code);
@@ -290,4 +288,3 @@ export function registerOauthGoogleRoutes(app, deps) {
         }
     });
 }
-//# sourceMappingURL=oauth-google.js.map

package/dist/api/routes/dashboard/schedule-readonly.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerScheduleReadonlyRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=schedule-readonly.d.ts.map

package/dist/api/routes/dashboard/schedule-readonly.js

@@ -4,12 +4,21 @@ export function registerScheduleReadonlyRoutes(app, deps) {
     /** GET /schedule/next — next pending scheduled task */
     app.get("/schedule/next", (c) => {
         const row = db
-            .prepare(`SELECT id, scheduled_for, task_type, task_description
+            .prepare(`SELECT id, scheduled_for, task_type, task_description, task_prompt
          FROM agent_schedule
          WHERE status = 'pending' AND scheduled_for > datetime('now')
          ORDER BY scheduled_for ASC LIMIT 1`)
             .get();
-        return c.json({ next: row ?? null });
+        if (!row)
+            return c.json({ next: null });
+        // One-off rows make `task_description` an optional label, so it can be
+        // empty. Coalesce to a prompt excerpt so the dashboard's "Next Up" card
+        // always shows meaningful text. `task_prompt` is not surfaced raw.
+        const { task_prompt, ...rest } = row;
+        const label = rest.task_description && rest.task_description.trim().length > 0
+            ? rest.task_description
+            : (task_prompt ?? "").slice(0, 200);
+        return c.json({ next: { ...rest, task_description: label } });
     });
     /** GET /schedule/list — all scheduled tasks (paginated) */
     app.get("/schedule/list", (c) => {
@@ -43,4 +52,3 @@ export function registerScheduleReadonlyRoutes(app, deps) {
         });
     });
 }
-//# sourceMappingURL=schedule-readonly.js.map

package/dist/api/routes/dashboard/secrets.d.ts

@@ -21,4 +21,3 @@ export interface SecretConfigSummary {
 }
 export declare function getSecretConfigSummary(deps: ApiDependencies): Promise<SecretConfigSummary>;
 export declare function registerSecretsRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=secrets.d.ts.map

package/dist/api/routes/dashboard/secrets.js

@@ -304,4 +304,3 @@ export function registerSecretsRoutes(app, deps) {
         });
     });
 }
-//# sourceMappingURL=secrets.js.map

package/dist/api/routes/dashboard/snapshots.d.ts

@@ -1,4 +1,3 @@
 import type { Hono } from "hono";
 import type { ApiDependencies } from "../../server.js";
 export declare function registerSnapshotsRoutes(app: Hono, deps: ApiDependencies): void;
-//# sourceMappingURL=snapshots.d.ts.map

package/dist/api/routes/dashboard/snapshots.js

@@ -30,4 +30,3 @@ export function registerSnapshotsRoutes(app, deps) {
         return c.json({ snapshots: rows });
     });
 }
-//# sourceMappingURL=snapshots.js.map

package/dist/api/routes/delegated-sync.d.ts

@@ -1,4 +1,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createDelegatedSyncRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=delegated-sync.d.ts.map

package/dist/api/routes/delegated-sync.js

@@ -189,4 +189,3 @@ export function createDelegatedSyncRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=delegated-sync.js.map

package/dist/api/routes/delegated.d.ts

@@ -40,4 +40,3 @@ import type { ApiDependencies } from "../server.js";
  * registry — both are deferrable.
  */
 export declare function createDelegatedRunRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=delegated.d.ts.map

package/dist/api/routes/delegated.js

@@ -248,4 +248,3 @@ function clampNumber(raw, defaultValue, min, max, allowFloat = false) {
         return null;
     return raw;
 }
-//# sourceMappingURL=delegated.js.map

package/dist/api/routes/docs.d.ts

@@ -31,4 +31,3 @@ export declare function createDocsRoutesFromDeps(deps: Pick<ApiDependencies, "db
     indexer?: DocsIndexerHandle;
     docsQAAdapter?: DocsQAAdapter;
 }): Hono;
-//# sourceMappingURL=docs.d.ts.map

package/dist/api/routes/docs.js

@@ -640,4 +640,3 @@ function rebindDocsQASessionChannel(db, newChannelId) {
 export function createDocsRoutesFromDeps(deps, extra = {}) {
     return createDocsRoutes({ db: deps.db, ...extra });
 }
-//# sourceMappingURL=docs.js.map

package/dist/api/routes/entities.d.ts

@@ -6,4 +6,3 @@ export interface EntitiesRoutesDeps {
 }
 export declare function createEntitiesRoutes(deps: EntitiesRoutesDeps): Hono;
 export declare function buildEntitiesRoutesDepsFromApi(deps: ApiDependencies): EntitiesRoutesDeps;
-//# sourceMappingURL=entities.d.ts.map

package/dist/api/routes/entities.js

@@ -135,7 +135,8 @@ export function createEntitiesRoutes(deps) {
                 items: items.map(toResponse),
             });
         }
-        // tier-2
+        // Tier-2 fallback — domain/type/date triple is required for the
+        // structured lookup below.
         if (!domain || !type || !date) {
             return respondWithAgentError(c, 400, [
                 composeIssue("entities.validation_error", {
@@ -222,7 +223,7 @@ export function createEntitiesRoutes(deps) {
                 }),
             ], {
                 legacyFields: {
-                    message: "provide `path` query parameter (e.g. work/meetings/foo.md)",
+                    message: "provide `path` query parameter (e.g. knowledge/entities/work/meetings/foo.md)",
                 },
             });
         }
@@ -242,4 +243,3 @@ export function createEntitiesRoutes(deps) {
 export function buildEntitiesRoutesDepsFromApi(deps) {
     return { db: deps.db };
 }
-//# sourceMappingURL=entities.js.map

package/dist/api/routes/feedback.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from "hono";
+import type { ApiDependencies } from "../server.js";
+export declare function createFeedbackRoutes(deps: ApiDependencies): Hono;

package/dist/api/routes/feedback.js

@@ -0,0 +1,349 @@
+import { Hono } from "hono";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { redactSensitiveString } from "@aitne/shared";
+import { readJsonBody } from "../json-body.js";
+import { getAgent } from "../../db/agents-store.js";
+import { consumeFeedbackSignals, countPendingFeedbackSignals, findRecentFeedbackSignal, recordFeedbackSignal, } from "../../db/feedback-signals-store.js";
+import { getContextDir } from "../../config.js";
+import { CONTEXT_RELATIVE_PATHS, agentLessonsPath, } from "../../core/context-paths.js";
+import { GLOBAL_LESSON_ENTRY_CAP, PER_AGENT_LESSON_ENTRY_CAP, } from "../../core/feedback/consolidation-prep.js";
+import { summarizeLessonStore } from "../../core/feedback/lesson-store-overview.js";
+import { isSafeAgentSlug } from "../../core/feedback/scope-parser.js";
+import { createLogger } from "../../logging.js";
+const logger = createLogger("feedback-api");
+const DEDUP_TTL_SECONDS = 10 * 60;
+const MAX_SUMMARY_CHARS = 280;
+const MAX_SCOPE_REF_CHARS = 120;
+const MAX_ACTION_REF_CHARS = 160;
+const MAX_EVIDENCE_STRING_CHARS = 500;
+const ALLOWED_SOURCES = new Set([
+    "explicit",
+    "self_critique",
+]);
+const ALL_SOURCES = new Set([
+    "behavioral",
+    "explicit",
+    "self_critique",
+]);
+const VALENCES = new Set([
+    "positive",
+    "negative",
+    "neutral",
+    "correction",
+]);
+const API_SCOPE_TYPES = new Set([
+    "user",
+    "agent",
+    "agent_slug",
+]);
+const ACTION_KINDS = new Set([
+    "notification",
+    "agent_execution",
+    "vault_write",
+    "dm_reply",
+]);
+const KINDS = new Set([
+    "preference",
+    "correction",
+    "do-more",
+    "do-less",
+    "constraint",
+]);
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function truncate(value, maxChars) {
+    return value.length <= maxChars ? value : value.slice(0, maxChars);
+}
+function sanitizeString(value, maxChars = MAX_EVIDENCE_STRING_CHARS) {
+    return redactSensitiveString(truncate(value.replace(/[\u0000-\u001f\u007f]/g, " "), maxChars)).trim();
+}
+function sanitizeEvidence(value, depth = 0) {
+    if (depth > 4)
+        return "[truncated]";
+    if (typeof value === "string")
+        return sanitizeString(value);
+    if (typeof value === "number" || typeof value === "boolean" || value === null)
+        return value;
+    if (Array.isArray(value)) {
+        return value.slice(0, 20).map((entry) => sanitizeEvidence(entry, depth + 1));
+    }
+    if (!isRecord(value))
+        return null;
+    const out = {};
+    for (const [key, entry] of Object.entries(value).slice(0, 50)) {
+        out[sanitizeString(key, 80)] = sanitizeEvidence(entry, depth + 1);
+    }
+    return out;
+}
+function describeType(value) {
+    if (value === undefined)
+        return "missing";
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+function buildLessonStoreEntry(contextDir, scope, relPath, caps) {
+    const full = join(contextDir, relPath);
+    if (!existsSync(full)) {
+        return {
+            scope,
+            path: relPath,
+            exists: false,
+            lastModified: null,
+            bytes: 0,
+            capBytes: caps.capBytes,
+            entries: 0,
+            maxEntries: caps.maxEntries,
+            active: 0,
+            provisional: 0,
+            overCap: false,
+        };
+    }
+    const summary = summarizeLessonStore(readFileSync(full, "utf-8"), caps);
+    return {
+        scope,
+        path: relPath,
+        exists: true,
+        lastModified: statSync(full).mtime.toISOString(),
+        ...summary,
+    };
+}
+export function createFeedbackRoutes(deps) {
+    const app = new Hono();
+    const { db, config } = deps;
+    /**
+     * GET /feedback/lessons — read-only overview of the consolidated lesson
+     * stores for the dashboard "view/edit lessons and tune caps/threshold"
+     * surface (FEEDBACK_LEARNING_LOOP_DESIGN.md §9 Phase 5). Lists the global
+     * `agent` store (always, so its cap shows even before first write) plus every
+     * per-agent `agent:<slug>` store that exists on disk, each with cap-utilisation
+     * metrics. The file bodies are read/edited through the existing
+     * `GET/PUT /api/context/<path>` chokepoint — this endpoint only enumerates +
+     * summarises. `RiskTier.Autonomous` (read-only, no secrets — lesson prose was
+     * redaction-scrubbed at capture).
+     */
+    app.get("/feedback/lessons", (c) => {
+        const contextDir = getContextDir(config, db);
+        const globalCaps = {
+            capBytes: config.feedbackLessonMaxBytesGlobal,
+            maxEntries: GLOBAL_LESSON_ENTRY_CAP,
+        };
+        const perAgentCaps = {
+            capBytes: config.feedbackLessonMaxBytesPerAgent,
+            maxEntries: PER_AGENT_LESSON_ENTRY_CAP,
+        };
+        const stores = [
+            buildLessonStoreEntry(contextDir, "agent", CONTEXT_RELATIVE_PATHS.agentLessons, globalCaps),
+        ];
+        const agentsDir = join(contextDir, "policies", "agents");
+        if (existsSync(agentsDir)) {
+            const slugs = readdirSync(agentsDir, { withFileTypes: true })
+                .filter((entry) => entry.isDirectory() && isSafeAgentSlug(entry.name))
+                .map((entry) => entry.name)
+                .sort();
+            for (const slug of slugs) {
+                const rel = agentLessonsPath(slug);
+                if (!existsSync(join(contextDir, rel)))
+                    continue;
+                stores.push(buildLessonStoreEntry(contextDir, `agent:${slug}`, rel, perAgentCaps));
+            }
+        }
+        return c.json({
+            enabled: config.feedbackLearningEnabled !== false,
+            promotionThreshold: config.feedbackPromotionThreshold,
+            pendingSignals: countPendingFeedbackSignals(db),
+            stores,
+        });
+    });
+    app.post("/feedback", async (c) => {
+        // Master kill-switch (FEEDBACK_LEARNING_LOOP_DESIGN.md §7). When the loop is
+        // disabled the daemon-side behavioral sink already short-circuits
+        // (`SignalDetector`); mirror that here so explicit / self_critique captures
+        // from the always-included DM + review task-flows are dropped too. Otherwise
+        // unconsumed rows would accumulate unbounded — the nightly consolidation that
+        // would consume them is gated off, and the retention sweep only deletes
+        // already-consumed rows. Returns 200 so the calling turn neither errors nor
+        // retries. `config` is optional in some test harnesses → default-on.
+        if (config?.feedbackLearningEnabled === false) {
+            return c.json({ disabled: true });
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (!isRecord(body)) {
+            return c.json({
+                error: "validation_error",
+                message: "Body must be a JSON object",
+            }, 400);
+        }
+        const issues = [];
+        const rawSource = body.source;
+        const source = typeof rawSource === "string" ? rawSource : "";
+        if (!ALL_SOURCES.has(source)) {
+            issues.push({
+                field: "source",
+                expected: "'explicit' | 'self_critique'",
+                got: describeType(rawSource),
+            });
+        }
+        else if (!ALLOWED_SOURCES.has(source)) {
+            issues.push({
+                field: "source",
+                expected: "'explicit' | 'self_critique'",
+                got: "'behavioral'",
+                hint: "Behavioral feedback is daemon-only and is written by SignalDetector.",
+            });
+        }
+        const summary = typeof body.summary === "string"
+            ? sanitizeString(body.summary, MAX_SUMMARY_CHARS)
+            : "";
+        if (summary.length === 0) {
+            issues.push({
+                field: "summary",
+                expected: "non-empty string",
+                got: describeType(body.summary),
+            });
+        }
+        const rawValence = body.valence;
+        const valence = typeof rawValence === "string" ? rawValence : null;
+        if (valence === null || !VALENCES.has(valence)) {
+            issues.push({
+                field: "valence",
+                expected: "'positive' | 'negative' | 'neutral' | 'correction'",
+                got: describeType(rawValence),
+            });
+        }
+        const rawKind = body.kind;
+        const kind = typeof rawKind === "string" ? rawKind : null;
+        if (kind !== null && !KINDS.has(kind)) {
+            issues.push({
+                field: "kind",
+                expected: "'preference' | 'correction' | 'do-more' | 'do-less' | 'constraint' (optional)",
+                got: kind,
+            });
+        }
+        const rawScopeType = body.scope_type;
+        const scopeType = typeof rawScopeType === "string" ? rawScopeType : "";
+        if (!API_SCOPE_TYPES.has(scopeType)) {
+            issues.push({
+                field: "scope_type",
+                expected: "'user' | 'agent' | 'agent_slug'",
+                got: describeType(rawScopeType),
+            });
+        }
+        const scopeRef = typeof body.scope_ref === "string"
+            ? sanitizeString(body.scope_ref, MAX_SCOPE_REF_CHARS)
+            : null;
+        let agentId = null;
+        if (scopeType === "agent_slug") {
+            if (!scopeRef) {
+                issues.push({
+                    field: "scope_ref",
+                    expected: "existing agent slug when scope_type='agent_slug'",
+                    got: describeType(body.scope_ref),
+                });
+            }
+            else if (!getAgent(db, scopeRef)) {
+                issues.push({
+                    field: "scope_ref",
+                    expected: "existing agent slug",
+                    got: scopeRef,
+                });
+            }
+            else {
+                agentId = scopeRef;
+            }
+        }
+        const rawActionKind = body.action_kind;
+        const actionKind = typeof rawActionKind === "string" ? rawActionKind : null;
+        if (actionKind !== null
+            && !ACTION_KINDS.has(actionKind)) {
+            issues.push({
+                field: "action_kind",
+                expected: "'notification' | 'agent_execution' | 'vault_write' | 'dm_reply' (optional)",
+                got: actionKind,
+            });
+        }
+        const actionRef = typeof body.action_ref === "string"
+            ? sanitizeString(body.action_ref, MAX_ACTION_REF_CHARS)
+            : null;
+        if (issues.length > 0) {
+            return c.json({
+                error: "validation_error",
+                message: "Request body failed schema validation",
+                issues,
+            }, 400);
+        }
+        const normalizedScopeRef = scopeType === "agent_slug" ? scopeRef : null;
+        const deduped = findRecentFeedbackSignal(db, {
+            scopeType: scopeType,
+            scopeRef: normalizedScopeRef,
+            summary,
+            withinSeconds: DEDUP_TTL_SECONDS,
+        });
+        if (deduped) {
+            return c.json({ id: deduped.id, deduped: true });
+        }
+        const evidence = sanitizeEvidence(body.evidence);
+        const id = recordFeedbackSignal(db, {
+            source: source,
+            valence: valence,
+            scopeType: scopeType,
+            scopeRef: normalizedScopeRef,
+            actionKind: actionKind,
+            actionRef,
+            agentId,
+            summary,
+            evidence: {
+                ...(isRecord(evidence)
+                    ? evidence
+                    : evidence === null
+                        ? {}
+                        : { value: evidence }),
+                ...(kind ? { kind } : {}),
+            },
+        });
+        logger.info({ id, source, scopeType, scopeRef: normalizedScopeRef }, "Feedback signal recorded");
+        return c.json({ id });
+    });
+    app.post("/feedback/consume", async (c) => {
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (!isRecord(body)) {
+            return c.json({
+                error: "validation_error",
+                message: "Body must be a JSON object",
+                expectedShape: '{"ids": number[], "lessonRef"?: string}',
+            }, 400);
+        }
+        if (!Array.isArray(body.ids)) {
+            return c.json({
+                error: "validation_error",
+                message: "'ids' must be an array of integer feedback signal ids",
+                expectedShape: '{"ids": number[], "lessonRef"?: string}',
+            }, 400);
+        }
+        const nonInt = body.ids.find((id) => typeof id !== "number" || !Number.isInteger(id));
+        if (nonInt !== undefined) {
+            return c.json({
+                error: "validation_error",
+                message: "'ids' must contain only integers",
+                got: JSON.stringify(nonInt),
+            }, 400);
+        }
+        const lessonRef = typeof body.lessonRef === "string"
+            ? sanitizeString(body.lessonRef, 240)
+            : null;
+        const result = consumeFeedbackSignals(db, body.ids, lessonRef);
+        logger.info({ consumed: result.consumed }, "Feedback signals consumed");
+        return c.json(result);
+    });
+    return app;
+}

package/dist/api/routes/fs.d.ts

@@ -20,4 +20,3 @@ import type { ApiDependencies } from "../server.js";
  * filesystem call is made.
  */
 export declare function createFsRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=fs.d.ts.map

package/dist/api/routes/fs.js

@@ -168,4 +168,3 @@ function mapValidationError(error) {
         /* c8 ignore stop */
     }
 }
-//# sourceMappingURL=fs.js.map

package/dist/api/routes/fs.logic.d.ts

@@ -59,4 +59,3 @@ export type NormalizeResult = {
     message: string;
 };
 export type NormalizeError = "invalid_path" | "relative_path" | "forbidden_prefix" | "secret_path";
-//# sourceMappingURL=fs.logic.d.ts.map

package/dist/api/routes/fs.logic.js

@@ -77,7 +77,12 @@ export const SECRET_ABS_PATTERNS = [
     /(^|\/)id_ed25519(\..*)?$/,
 ];
 export function isSecretPath(absPath) {
-    return SECRET_ABS_PATTERNS.some((re) => re.test(absPath));
+    // SECRET_ABS_PATTERNS are POSIX-slash anchored, so a backslash-delimited
+    // Windows path (e.g. `C:\Users\me\.ssh\id_rsa`) would slip past them.
+    // Normalising separators is inert on macOS/Linux (legitimate secret-dir
+    // paths there contain no backslashes) and closes the Windows gap.
+    const p = absPath.replace(/\\/g, "/");
+    return SECRET_ABS_PATTERNS.some((re) => re.test(p));
 }
 export function isUnderForbidden(absPath) {
     // Exemptions take precedence — a path under `/var/folders/...`
@@ -134,4 +139,3 @@ export function normalizeRequestedPath(raw) {
     }
     return { ok: true, path: absPath };
 }
-//# sourceMappingURL=fs.logic.js.map

package/dist/api/routes/git-accounts.d.ts

@@ -20,4 +20,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createGitAccountsRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=git-accounts.d.ts.map