@aitne/daemon 0.1.8 → 0.1.9

package/dist/services/voice/transcriber-impl.js

@@ -39,10 +39,9 @@ function resolveDtype(model) {
  * time a voice message arrives. See `transcriber.ts` for the test seam.
  */
 export const defaultLoadPipeline = async ({ model, modelDir, onProgress, }) => {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let mod;
     try {
-        mod = await import("@huggingface/transformers");
+        mod = (await import("@huggingface/transformers"));
     }
     catch (err) {
         throw new Error(`@huggingface/transformers not installed: ${err.message}`);
@@ -62,7 +61,6 @@ export const defaultLoadPipeline = async ({ model, modelDir, onProgress, }) => {
         mod.env.cacheDir = modelDir;
         mod.env.localModelPath = modelDir;
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const pipelineOptions = {};
     // `onnx-community/whisper-large-v3-turbo`'s default fp32 encoder is a tiny
     // 439 KB stub that references a 2.55 GB sibling `.onnx_data` external-data
@@ -75,35 +73,36 @@ export const defaultLoadPipeline = async ({ model, modelDir, onProgress, }) => {
     // straight through to transformers.js).
     const dtype = resolveDtype(model);
     if (dtype !== undefined) {
+        // Operator may pin to a dtype not yet enumerated in the upstream union
+        // (e.g. a new quantization variant). Pass the string through and let
+        // transformers.js validate at runtime instead of erroring at compile.
         pipelineOptions.dtype = dtype;
     }
     if (onProgress) {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        pipelineOptions.progress_callback = (event) => {
+        pipelineOptions.progress_callback = ((event) => {
             try {
                 onProgress(event);
             }
             catch {
                 // Never let a UI-progress observer break the actual download.
             }
-        };
+        });
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const transcriber = await mod.pipeline("automatic-speech-recognition", model, pipelineOptions);
     return async (samples, options) => {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const result = await transcriber(samples, {
+        const result = (await transcriber(samples, {
             language: options.language ?? undefined,
             task: options.task,
             return_timestamps: false,
             chunk_length_s: 30,
             stride_length_s: 5,
-        });
+        }));
         const text = typeof result?.text === "string"
             ? result.text
             : Array.isArray(result?.chunks)
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                ? result.chunks.map((c) => c.text ?? "").join(" ")
+                ? result.chunks
+                    .map((c) => (typeof c.text === "string" ? c.text : ""))
+                    .join(" ")
                 : "";
         const language = typeof result?.language === "string" ? result.language : null;
         return { text, language };
@@ -116,19 +115,22 @@ export const defaultLoadPipeline = async ({ model, modelDir, onProgress, }) => {
  * carries the samples directly.
  */
 export const decodeAudioWithFfmpeg = async ({ path }) => {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let ffmpegPathMod;
     try {
-        ffmpegPathMod = await import("ffmpeg-static");
+        ffmpegPathMod = (await import("ffmpeg-static"));
     }
     catch (err) {
         throw new Error(`ffmpeg-static not installed: ${err.message}`);
     }
-    const ffmpegPath = typeof ffmpegPathMod?.default === "string"
-        ? ffmpegPathMod.default
-        : typeof ffmpegPathMod === "string"
-            ? ffmpegPathMod
-            : "";
+    let ffmpegPath = "";
+    if (typeof ffmpegPathMod === "string") {
+        ffmpegPath = ffmpegPathMod;
+    }
+    else if (ffmpegPathMod) {
+        const def = ffmpegPathMod.default;
+        if (typeof def === "string")
+            ffmpegPath = def;
+    }
     if (!ffmpegPath) {
         throw new Error("ffmpeg-static: binary path not resolved");
     }
@@ -172,4 +174,3 @@ export const decodeAudioWithFfmpeg = async ({ path }) => {
         });
     });
 };
-//# sourceMappingURL=transcriber-impl.js.map

package/dist/services/voice/transcriber.d.ts

@@ -122,7 +122,6 @@ export interface VoiceTranscriptionResult {
  *
  * Inference strategy (per-attachment):
  *  - **Forced language set** (env override): single pass with `language=forced`.
- *    Same code path that has shipped with the feature.
  *  - **Otherwise (the default)**: pass 1 with auto-detect. If the output
  *    matches a known Whisper placeholder hallucination AND a primary
  *    language is configured, pass 2 retries with `language=primary`.
@@ -164,9 +163,8 @@ export declare class VoiceTranscriber {
     private transcribeUncached;
     private ensurePipeline;
     /**
-     * M5 (release-prep): pre-load the Whisper pipeline so the first
-     * inbound voice DM is not the one paying the 800 MB – 2.5 GB model-
-     * download cost on the request path.
+     * Pre-load the Whisper pipeline so the first inbound voice DM does
+     * not pay the 800 MB – 2.5 GB model-download cost on the request path.
      *
      * Wiring contract:
      *   - The daemon bootstrap (`bootstrap/event-pipeline.ts`) kicks this
@@ -187,4 +185,3 @@ export declare class VoiceTranscriber {
      */
     warmUp(timeoutMs?: number): Promise<void>;
 }
-//# sourceMappingURL=transcriber.d.ts.map

package/dist/services/voice/transcriber.js

@@ -33,8 +33,7 @@ const TARGET_SAMPLE_RATE = 16000;
  * step failed and the model fell back to its English-decoder placeholder
  * vocabulary. This is the trigger for the primary-language fallback pass.
  *
- * Patterns observed in production (see DB-cached transcripts before this
- * helper landed):
+ * Patterns to detect (model meta-tokens emitted when language ID fails):
  *   - "(speaking in foreign language)"
  *   - "(speaking foreign language)"
  *   - "(silence)" / "(silent)" / "[silence]"
@@ -50,16 +49,22 @@ const PLACEHOLDER_PHRASE_REGEX =
 // Whole string is a single bracketed/parenthesized phrase whose content
 // matches a known meta-token vocabulary. We anchor with ^...$ so partial
 // matches inside a longer transcript do not trigger the retry.
-/^\s*[([](?:\s*[a-z]{1,3}\s*\|\s*)?\s*(?:speaking(?:\s+in)?\s+(?:a\s+)?foreign\s+language|non[-\s]?english\s+speech|in\s+foreign\s+language|silence|silent|music|applause|laughter|inaudible|background\s+noise|静寂|無音|♪+|\.{3,}|\s*)\s*[)\]]\s*$/i;
+// English-only vocabulary as of the 2026-05-27 revision; the
+// brace-only fallback pattern below catches non-English placeholder
+// shapes (e.g. `[♪♪♪]`, `(***)`, bracketed CJK silence tokens) via
+// its script-agnostic `\P{L}*` content check.
+/^\s*[([](?:\s*[a-z]{1,3}\s*\|\s*)?\s*(?:speaking(?:\s+in)?\s+(?:a\s+)?foreign\s+language|non[-\s]?english\s+speech|in\s+foreign\s+language|silence|silent|music|applause|laughter|inaudible|background\s+noise|♪+|\.{3,}|\s*)\s*[)\]]\s*$/i;
 // Bracketed/parenthesized fallback for meta-tokens we did not enumerate
 // above (e.g. `(***)`, `[♪♪♪]`, `(...)`). Uses Unicode property escapes so
 // the "no word characters" check is script-agnostic — the previous
-// hard-coded whitelist (`A-Za-zĀ-ſ぀-ヿ一-鿿Ѐ-ӿ֐-׿؀-ۿऀ-ॿ`) wrongly
-// flagged short bracketed transcripts in scripts it omitted (Korean,
-// Thai, Greek, Tamil, etc.) as placeholders, causing the cache to be
-// skipped and the message to fall back to a path-only file reference.
-// Trimming has already happened by the time we test, so the bracket
-// characters can be matched directly without an additional `\s` slot.
+// hard-coded whitelist (Latin + Latin-Extended-A + Hiragana/Katakana +
+// CJK Unified Ideographs + Cyrillic + Hebrew + Arabic + Devanagari)
+// wrongly flagged short bracketed transcripts in scripts it omitted
+// (Korean, Thai, Greek, Tamil, etc.) as placeholders, causing the cache
+// to be skipped and the message to fall back to a path-only file
+// reference. Trimming has already happened by the time we test, so the
+// bracket characters can be matched directly without an additional `\s`
+// slot.
 const BRACKETED_NON_LETTER_REGEX = /^[([][^\p{L}\p{N}]*[)\]]$/u;
 export function isWhisperPlaceholderOutput(text) {
     const trimmed = text.trim();
@@ -86,7 +91,6 @@ export function isWhisperPlaceholderOutput(text) {
  *
  * Inference strategy (per-attachment):
  *  - **Forced language set** (env override): single pass with `language=forced`.
- *    Same code path that has shipped with the feature.
  *  - **Otherwise (the default)**: pass 1 with auto-detect. If the output
  *    matches a known Whisper placeholder hallucination AND a primary
  *    language is configured, pass 2 retries with `language=primary`.
@@ -326,9 +330,8 @@ export class VoiceTranscriber {
         return this.pipelinePromise;
     }
     /**
-     * M5 (release-prep): pre-load the Whisper pipeline so the first
-     * inbound voice DM is not the one paying the 800 MB – 2.5 GB model-
-     * download cost on the request path.
+     * Pre-load the Whisper pipeline so the first inbound voice DM does
+     * not pay the 800 MB – 2.5 GB model-download cost on the request path.
      *
      * Wiring contract:
      *   - The daemon bootstrap (`bootstrap/event-pipeline.ts`) kicks this
@@ -381,4 +384,3 @@ export class VoiceTranscriber {
         }
     }
 }
-//# sourceMappingURL=transcriber.js.map

package/dist/settings/runtime-settings.d.ts

@@ -13,7 +13,7 @@ import { z } from "zod";
  * contract — `chmod`, `chown`, destructive `git` flags. Allow mode skips
  * these per design, Safe mode keeps them.
  */
-export declare const DEFAULT_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification", "Bash(chmod *)", "Bash(chown *)", "Bash(git push --force *)", "Bash(git push -f *)", "Bash(git reset --hard *)", "Bash(git clean *)"];
+export declare const DEFAULT_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Bash(certutil *)", "Bash(rundll32.exe *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "Bash(sqlite3 *)", "Bash(cp ~/Library/Application Support/Google/Chrome/*)", "Bash(cp ~/Library/Application Support/Chromium/*)", "Bash(cp ~/Library/Application Support/Microsoft Edge/*)", "Bash(cp ~/Library/Application Support/BraveSoftware/*)", "Bash(cp ~/Library/Application Support/Comet/*)", "Bash(cp ~/Library/Application Support/Perplexity Comet/*)", "Bash(cp ~/Library/Application Support/com.openai.atlas/*)", "Bash(cp ~/.config/google-chrome/*)", "Bash(cp ~/.config/chromium/*)", "Bash(cp ~/.config/microsoft-edge/*)", "Bash(cp ~/.config/BraveSoftware/*)", "Bash(cp ~/.config/Comet/*)", "Bash(cp ~/.var/app/com.google.Chrome/*)", "Bash(cp /mnt/c/Users/*)", "Bash(curl file://*)", "Read(~/Library/Application Support/Google/Chrome/**)", "Read(~/Library/Application Support/Chromium/**)", "Read(~/Library/Application Support/Microsoft Edge/**)", "Read(~/Library/Application Support/BraveSoftware/**)", "Read(~/Library/Application Support/Comet/**)", "Read(~/Library/Application Support/Perplexity Comet/**)", "Read(~/Library/Application Support/com.openai.atlas/**)", "Read(~/.config/google-chrome/**)", "Read(~/.config/chromium/**)", "Read(~/.config/microsoft-edge/**)", "Read(~/.config/BraveSoftware/**)", "Read(~/.config/Comet/**)", "Read(~/.var/app/com.google.Chrome/**)", "Read(/mnt/c/Users/**)", "Write(~/Library/Application Support/Google/Chrome/**)", "Edit(~/Library/Application Support/Google/Chrome/**)", "Write(~/Library/Application Support/Chromium/**)", "Edit(~/Library/Application Support/Chromium/**)", "Write(~/Library/Application Support/Microsoft Edge/**)", "Edit(~/Library/Application Support/Microsoft Edge/**)", "Write(~/Library/Application Support/BraveSoftware/**)", "Edit(~/Library/Application Support/BraveSoftware/**)", "Write(~/Library/Application Support/Comet/**)", "Edit(~/Library/Application Support/Comet/**)", "Write(~/Library/Application Support/Perplexity Comet/**)", "Edit(~/Library/Application Support/Perplexity Comet/**)", "Write(~/Library/Application Support/com.openai.atlas/**)", "Edit(~/Library/Application Support/com.openai.atlas/**)", "Write(~/.config/google-chrome/**)", "Edit(~/.config/google-chrome/**)", "Write(~/.config/chromium/**)", "Edit(~/.config/chromium/**)", "Write(~/.config/microsoft-edge/**)", "Edit(~/.config/microsoft-edge/**)", "Write(~/.config/BraveSoftware/**)", "Edit(~/.config/BraveSoftware/**)", "Write(~/.config/Comet/**)", "Edit(~/.config/Comet/**)", "Write(~/.var/app/com.google.Chrome/**)", "Edit(~/.var/app/com.google.Chrome/**)", "Write(/mnt/c/Users/**)", "Edit(/mnt/c/Users/**)", "Bash(cp ~/.personal-agent/chromium-*)", "Bash(mv ~/.personal-agent/chromium-*)", "Bash(tar ~/.personal-agent/chromium-*)", "Bash(zip ~/.personal-agent/chromium-*)", "Bash(rsync ~/.personal-agent/chromium-*)", "Bash(cp $HOME/.personal-agent/chromium-*)", "Bash(mv $HOME/.personal-agent/chromium-*)", "Bash(tar $HOME/.personal-agent/chromium-*)", "Bash(zip $HOME/.personal-agent/chromium-*)", "Bash(rsync $HOME/.personal-agent/chromium-*)", "Read(~/.personal-agent/chromium-sync/**)", "Read(~/.personal-agent/chromium-automation/**)", "Read(~/.personal-agent/chromium-automation-anon/**)", "Read(~/.personal-agent/chromium-automation-auth/**)", "Read(~/.personal-agent/chromium-automation-purchase/**)", "Write(~/.personal-agent/chromium-sync/**)", "Edit(~/.personal-agent/chromium-sync/**)", "Write(~/.personal-agent/chromium-automation/**)", "Edit(~/.personal-agent/chromium-automation/**)", "Write(~/.personal-agent/chromium-automation-anon/**)", "Edit(~/.personal-agent/chromium-automation-anon/**)", "Write(~/.personal-agent/chromium-automation-auth/**)", "Edit(~/.personal-agent/chromium-automation-auth/**)", "Write(~/.personal-agent/chromium-automation-purchase/**)", "Edit(~/.personal-agent/chromium-automation-purchase/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification", "Bash(chmod *)", "Bash(chown *)", "Bash(git push --force *)", "Bash(git push -f *)", "Bash(git reset --hard *)", "Bash(git clean *)"];
 /**
  * Shape of a "watched git repository" — projected from the unified
  * `repositories` table by `selectGitWatchedRepos` for legacy consumers
@@ -142,6 +142,10 @@ export declare const runtimeSettingsSchema: z.ZodObject<{
     timezone: z.ZodDefault<z.ZodString>;
     dayBoundaryHour: z.ZodDefault<z.ZodNumber>;
     monthlyReviewEnabled: z.ZodDefault<z.ZodBoolean>;
+    browserTaskMaxConcurrent: z.ZodDefault<z.ZodNumber>;
+    browserTaskPendingQueueTimeoutMinutes: z.ZodDefault<z.ZodNumber>;
+    browserTaskRespectQuietHours: z.ZodDefault<z.ZodBoolean>;
+    browserTaskHostnameDenylist: z.ZodDefault<z.ZodArray<z.ZodString>>;
     hourlyCheckEnabled: z.ZodDefault<z.ZodBoolean>;
     hourlyCheckIntervalMinutes: z.ZodDefault<z.ZodNumber>;
     hourlyCheckActiveStartHour: z.ZodDefault<z.ZodNumber>;
@@ -190,6 +194,44 @@ export declare const runtimeSettingsSchema: z.ZodObject<{
     calendarPollIntervalSeconds: z.ZodDefault<z.ZodNumber>;
     gmailPollIntervalSeconds: z.ZodDefault<z.ZodNumber>;
     githubPollIntervalSeconds: z.ZodDefault<z.ZodNumber>;
+    browserHistoryConsentAccepted: z.ZodDefault<z.ZodBoolean>;
+    browserHistoryBrowserOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        auto: "auto";
+        "forced-on": "forced-on";
+        "forced-off": "forced-off";
+    }>>>;
+    browserHistoryCategories: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        work: "work";
+        research: "research";
+        shopping: "shopping";
+        social: "social";
+        news: "news";
+        entertainment: "entertainment";
+        dev: "dev";
+        banking: "banking";
+        health: "health";
+        adult: "adult";
+        "cloud-console": "cloud-console";
+        localhost: "localhost";
+        "app-config": "app-config";
+        other: "other";
+    }>>>;
+    browserHistoryRetentionDays: z.ZodDefault<z.ZodNumber>;
+    browserHistorySearchQueryRetentionDays: z.ZodDefault<z.ZodNumber>;
+    browserHistoryLifecycle: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        check_interval_minutes: z.ZodDefault<z.ZodNumber>;
+        per_browser: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            profiles_to_track: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            sync_flush_wait_seconds: z.ZodDefault<z.ZodNumber>;
+            check_interval_minutes_override: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+        respect_quiet_hours: z.ZodDefault<z.ZodBoolean>;
+        max_concurrent_launches: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    browserHistoryResearchDomainAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    browserHistoryResearchDomainDenylist: z.ZodDefault<z.ZodArray<z.ZodString>>;
     mcpAutoProbeIntervalMinutes: z.ZodDefault<z.ZodNumber>;
     delegatedProbeIntervalMinutes: z.ZodDefault<z.ZodNumber>;
     enabledMailProviders: z.ZodDefault<z.ZodArray<z.ZodEnum<{
@@ -239,9 +281,8 @@ export declare const runtimeSettingsSchema: z.ZodObject<{
     voiceTranscriptionPrimaryLanguage: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type RuntimeSettings = z.infer<typeof runtimeSettingsSchema>;
-export declare const RUNTIME_SETTING_KEYS: readonly ["slackOwnerUserId", "telegramOwnerChatId", "discordOwnerUserId", "whatsappEnabled", "whatsappOwnerPhone", "whatsappAuthDir", "googleCalendarId", "notionDatabaseIds", "primaryVaultPath", "primaryVaultName", "externalObsidianVaultPath", "externalObsidianVaultName", "externalObsidianWatch", "gitAccounts", "advisorEnabled", "advisorModel", "enforceReadToken", "maxConcurrentSessions", "maxReactiveSessions", "delegatedProxyMaxConcurrent", "delegatedTaskModeEnabled", "delegatedTaskMaxPerDay", "delegatedTaskDefaultMaxToolCalls", "delegatedTaskDefaultMaxBudgetUsd", "delegatedTaskDefaultTimeoutMs", "delegatedTaskHeavyEnabled", "delegatedTaskStructuredOutputEnabled", "delegatedTaskSubprocessPoolEnabled", "delegatedTaskSubprocessPoolTtlSeconds", "delegatedTaskCacheEnabled", "delegatedTaskCacheTtlSeconds", "delegatedTaskCacheMaxEntries", "executeTimeoutMinutes", "sessionTimeoutDmMinutes", "sessionTimeoutChannelMinutes", "sessionTimeoutDashboardMinutes", "historyInjectionMaxMessages", "historyInjectionMaxTokens", "historyOtherSurfaceWindowMinutes", "dmStalenessStrict", "proactiveForwardChannelTimelineEnabled", "proactiveForwardForceFreshSession", "agentDisplayName", "character", "timezone", "dayBoundaryHour", "monthlyReviewEnabled", "hourlyCheckEnabled", "hourlyCheckIntervalMinutes", "hourlyCheckActiveStartHour", "hourlyCheckActiveEndHour", "hourlyCheckMinObservations", "hourlyCheckStage2Enabled", "hourlyCheckHeartbeatHours", "hourlyCheckLowSignalPendingCeiling", "hourlyCheckPrePassFreshnessMinutes", "authProbeDisabled", "authPreflightFreshnessMs", "schedulePollIntervalSeconds", "maxBriefingDelayMinutes", "maxNotificationsPerHour", "maxNotificationsPerDay", "quietHoursStart", "quietHoursEnd", "batchIntervalMinutes", "primaryPlatform", "defaultNotificationPlatforms", "disallowedTools", "allowedToolsOverride", "claudeExecutionPermissionMode", "codexExecutionPermissionMode", "geminiExecutionPermissionMode", "opencodeExecutionPermissionMode", "opencodeBaseUrl", "opencodeServerUsername", "obsidianDebounceSeconds", "gitPollIntervalSeconds", "gitPushOverdueMinutes", "gitProjectUpdateDebounceMinutes", "notionPollIntervalSeconds", "calendarPollIntervalSeconds", "gmailPollIntervalSeconds", "githubPollIntervalSeconds", "mcpAutoProbeIntervalMinutes", "delegatedProbeIntervalMinutes", "enabledMailProviders", "mailPollIntervalSeconds", "mailIdleEnabled", "mailIdleInstabilityThreshold", "mailIdleFallbackRecoveryMinutes", "mailMaxMessagesPerPoll", "mailAuthFailureRetryHours", "hourlyObservationCharBudget", "prePassMaxAttemptsPerIntegration", "prePassBackoffMs", "prePassRetryEscalationTier", "prePassFanOutConcurrency", "prePassMaxBudgetUsdPerIntegration", "prePassMaxBudgetUsdPerRoutine", "prePassRetryOnPartial", "observationSummarizerEnabled", "observationSummarizerConcurrency", "observationSummarizerMaxCallsPerMinute", "observationSummarizerQueueLimit", "observationSummarizerTimeoutMs", "vipMailSenders", "outlookDeltaPageSize", "outlookGraphConcurrency", "imapReconnectBaseMs", "imapReconnectMaxMs", "autonomousDailyCostCapUsd", "autonomousMonthlyCostCapUsd", "primaryLanguage", "vaultMode", "useReviewDossiers", "useContextIndex", "voiceTranscriptionEnabled", "voiceTranscriptionPrimaryLanguage"];
+export declare const RUNTIME_SETTING_KEYS: readonly ["slackOwnerUserId", "telegramOwnerChatId", "discordOwnerUserId", "whatsappEnabled", "whatsappOwnerPhone", "whatsappAuthDir", "googleCalendarId", "notionDatabaseIds", "primaryVaultPath", "primaryVaultName", "externalObsidianVaultPath", "externalObsidianVaultName", "externalObsidianWatch", "gitAccounts", "advisorEnabled", "advisorModel", "enforceReadToken", "maxConcurrentSessions", "maxReactiveSessions", "delegatedProxyMaxConcurrent", "delegatedTaskModeEnabled", "delegatedTaskMaxPerDay", "delegatedTaskDefaultMaxToolCalls", "delegatedTaskDefaultMaxBudgetUsd", "delegatedTaskDefaultTimeoutMs", "delegatedTaskHeavyEnabled", "delegatedTaskStructuredOutputEnabled", "delegatedTaskSubprocessPoolEnabled", "delegatedTaskSubprocessPoolTtlSeconds", "delegatedTaskCacheEnabled", "delegatedTaskCacheTtlSeconds", "delegatedTaskCacheMaxEntries", "executeTimeoutMinutes", "sessionTimeoutDmMinutes", "sessionTimeoutChannelMinutes", "sessionTimeoutDashboardMinutes", "historyInjectionMaxMessages", "historyInjectionMaxTokens", "historyOtherSurfaceWindowMinutes", "dmStalenessStrict", "proactiveForwardChannelTimelineEnabled", "proactiveForwardForceFreshSession", "agentDisplayName", "character", "timezone", "dayBoundaryHour", "monthlyReviewEnabled", "browserTaskMaxConcurrent", "browserTaskPendingQueueTimeoutMinutes", "browserTaskRespectQuietHours", "browserTaskHostnameDenylist", "hourlyCheckEnabled", "hourlyCheckIntervalMinutes", "hourlyCheckActiveStartHour", "hourlyCheckActiveEndHour", "hourlyCheckMinObservations", "hourlyCheckStage2Enabled", "hourlyCheckHeartbeatHours", "hourlyCheckLowSignalPendingCeiling", "hourlyCheckPrePassFreshnessMinutes", "authProbeDisabled", "authPreflightFreshnessMs", "schedulePollIntervalSeconds", "maxBriefingDelayMinutes", "maxNotificationsPerHour", "maxNotificationsPerDay", "quietHoursStart", "quietHoursEnd", "batchIntervalMinutes", "primaryPlatform", "defaultNotificationPlatforms", "disallowedTools", "allowedToolsOverride", "claudeExecutionPermissionMode", "codexExecutionPermissionMode", "geminiExecutionPermissionMode", "opencodeExecutionPermissionMode", "opencodeBaseUrl", "opencodeServerUsername", "obsidianDebounceSeconds", "gitPollIntervalSeconds", "gitPushOverdueMinutes", "gitProjectUpdateDebounceMinutes", "notionPollIntervalSeconds", "calendarPollIntervalSeconds", "gmailPollIntervalSeconds", "githubPollIntervalSeconds", "browserHistoryConsentAccepted", "browserHistoryBrowserOverrides", "browserHistoryCategories", "browserHistoryRetentionDays", "browserHistorySearchQueryRetentionDays", "browserHistoryLifecycle", "browserHistoryResearchDomainAllowlist", "browserHistoryResearchDomainDenylist", "mcpAutoProbeIntervalMinutes", "delegatedProbeIntervalMinutes", "enabledMailProviders", "mailPollIntervalSeconds", "mailIdleEnabled", "mailIdleInstabilityThreshold", "mailIdleFallbackRecoveryMinutes", "mailMaxMessagesPerPoll", "mailAuthFailureRetryHours", "hourlyObservationCharBudget", "prePassMaxAttemptsPerIntegration", "prePassBackoffMs", "prePassRetryEscalationTier", "prePassFanOutConcurrency", "prePassMaxBudgetUsdPerIntegration", "prePassMaxBudgetUsdPerRoutine", "prePassRetryOnPartial", "observationSummarizerEnabled", "observationSummarizerConcurrency", "observationSummarizerMaxCallsPerMinute", "observationSummarizerQueueLimit", "observationSummarizerTimeoutMs", "vipMailSenders", "outlookDeltaPageSize", "outlookGraphConcurrency", "imapReconnectBaseMs", "imapReconnectMaxMs", "autonomousDailyCostCapUsd", "autonomousMonthlyCostCapUsd", "primaryLanguage", "vaultMode", "useReviewDossiers", "useContextIndex", "voiceTranscriptionEnabled", "voiceTranscriptionPrimaryLanguage"];
 export type RuntimeSettingKey = (typeof RUNTIME_SETTING_KEYS)[number];
 export declare const INTERNAL_RUNTIME_SETTING_KEYS: readonly ["enforceReadToken", "useReviewDossiers", "useContextIndex"];
 export type InternalRuntimeSettingKey = (typeof INTERNAL_RUNTIME_SETTING_KEYS)[number];
 export declare function isRuntimeSettingKey(value: string): value is RuntimeSettingKey;
-//# sourceMappingURL=runtime-settings.d.ts.map

package/dist/settings/runtime-settings.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ADVISOR_ALLOWED_MODELS, DEFAULT_AGENT_DISPLAY_NAME, EXECUTION_PERMISSION_MODES, INTEGRATION_KEYS, isAdvisorModel, isSupportedVoiceLanguage, validateAgentDisplayName, } from "@aitne/shared";
+import { ADVISOR_ALLOWED_MODELS, DEFAULT_AGENT_DISPLAY_NAME, EXECUTION_PERMISSION_MODES, INTEGRATION_KEYS, browserHistoryBrowserOverrideSchema, browserHistoryCategorySchema, browserHistoryLifecycleConfigSchema, isAdvisorModel, isSupportedVoiceLanguage, validateAgentDisplayName, } from "@aitne/shared";
 import { NOTIFICATION_DESTINATION_PLATFORMS, isNotificationDestinationPlatform, } from "../messaging/constants.js";
 import { ALWAYS_DISALLOWED_TOOLS } from "../safety/always-disallowed.js";
 /**
@@ -304,8 +304,8 @@ export const runtimeSettingsSchema = z.object({
     // Monthly Review kill switch — default OFF pre-release. The current
     // task-flow synthesises 30 days of daily files + 4-5 weekly files into
     // a user-facing snapshot whose downstream leverage is unimplemented
-    // (`<previous_month>` injection is documented as "未実装" in
-    // docs/design/06-memory.md §6.2.8). Cost-to-value ratio is therefore
+    // (`<previous_month>` injection is documented as not-yet-implemented
+    // in docs/design/06-memory.md §6.2.8). Cost-to-value ratio is therefore
     // poor in the current shape; the routine stays in-tree as a concept
     // pending the Mirror+Prune redesign (one trend observation + aged
     // carry-over kill/keep decisions, scoped to feed day-1-of-month
@@ -313,6 +313,68 @@ export const runtimeSettingsSchema = z.object({
     // or PATCH /api/config — the scheduler reads the live flag at fire time
     // so the flip takes effect on the next month-end without restart.
     monthlyReviewEnabled: z.boolean().default(false),
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5.1 — global concurrency cap for the
+     * `POST /api/browser-task` sub-agent surface. Per-siteKey slots are
+     * held across the entire non-terminal lifetime including parking
+     * (`awaiting_user` / `final_confirm`), so a parked context still
+     * occupies a slot until the round-trip resolves. Default 3; range
+     * [1, 5]. Lowering at runtime takes effect on the NEXT slot release
+     * (already-acquired slots are not preemptively yanked).
+     *
+     * Rationale for the upper bound: each parked context keeps a full
+     * Playwright BrowserContext resident in memory — the RAM ceiling at
+     * 5 is roughly 5 * ~200 MB. Users with more headroom can raise from
+     * the dashboard; the structural blocker for "checkpoint-to-disk and
+     * release the slot" (Plan B) is Chromium's SingletonLock on the
+     * per-siteKey user-data-dir.
+     */
+    browserTaskMaxConcurrent: z.number().int().min(1).max(5).default(3),
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §5.1 — safety valve for tasks that
+     * sit `pending` too long behind a parked task ahead of them. After
+     * this many minutes a queued task transitions directly to
+     * `failed (queue_timeout)` and DMs the originating channel. Default
+     * 30; range [5, 180]. The deadline scanner owns this sweep alongside
+     * the clarification-deadline scan on the same 30 s tick.
+     */
+    browserTaskPendingQueueTimeoutMinutes: z
+        .number()
+        .int()
+        .min(5)
+        .max(180)
+        .default(30),
+    /**
+     * BROWSER_TASK_REDESIGN_PLAN.md §12 Q#5 — when true (default), a
+     * `scheduled.browser_task` fire that would land inside quiet hours is
+     * deferred until quiet-hours-end. The scheduler writes a single
+     * `agent_actions(action_type='browser_task.deferred_for_quiet_hours')`
+     * row so the user can see the delay in audit. Flip to false for
+     * "run anyway" semantics — in which case the final-confirm DM is
+     * stashed in a pending queue and surfaced when quiet hours end (no
+     * quiet-hours DM noise either way).
+     */
+    browserTaskRespectQuietHours: z.boolean().default(true),
+    /**
+     * User-curated hostname denylist for the browser-task surface. Each
+     * entry is a bare hostname (`paypal.com`, `chase.com`, `*.example.com`);
+     * the runtime compiles them into suffix-anchored regexes via
+     * `compileUserHostnameDenylist` and passes the result to both the
+     * CDP route handler (`cdp-network-interception.ts`) and the §14.7
+     * screenshot retention check.
+     *
+     * Empty by default — the framework no longer ships hardcoded brand
+     * entries (payment processors, banks, government, healthcare, JP-
+     * specific). Operators add entries via Dashboard `/settings/browser`
+     * (PATCH /api/config). The IP CIDR layer (RFC1918 / loopback /
+     * cloud-metadata) remains hardcoded inside `shouldDenyEgress` and is
+     * NOT configurable here — it covers network-infrastructure protection,
+     * not third-party brand opinions.
+     */
+    browserTaskHostnameDenylist: z
+        .array(z.string().min(1).max(253))
+        .max(500)
+        .default([]),
     hourlyCheckEnabled: z.boolean().default(true),
     // Any positive integer in [1, 1440] minutes (1 minute up to 24 hours).
     // Despite the "hourly" name, the operator can dial this anywhere in that
@@ -480,6 +542,52 @@ export const runtimeSettingsSchema = z.object({
      * faster review-request alerts.
      */
     githubPollIntervalSeconds: z.number().int().min(60).default(1800),
+    /**
+     * Browser History P1 — dashboard consent latch and passive detector /
+     * lifecycle configuration. The integration's master enabled/disabled
+     * mode remains in the integrations registry; these fields carry the
+     * per-browser, category, retention, and lifecycle knobs behind that mode.
+     */
+    browserHistoryConsentAccepted: z.boolean().default(false),
+    browserHistoryBrowserOverrides: z
+        .record(z.string(), browserHistoryBrowserOverrideSchema)
+        .default({}),
+    browserHistoryCategories: z
+        .array(browserHistoryCategorySchema)
+        .default(["research", "news", "dev"]),
+    browserHistoryRetentionDays: z.number().int().min(1).max(365).default(30),
+    browserHistorySearchQueryRetentionDays: z.number().int().min(1).max(90).default(7),
+    browserHistoryLifecycle: browserHistoryLifecycleConfigSchema.prefault({}),
+    /**
+     * BROWSER_HISTORY_INTEGRATION_PLAN §5.F1.meaningful rule 6 — user-curated
+     * domain allowlist / denylist for the research-cluster meaningful filter.
+     *
+     * Both default to empty arrays. When empty, the filter runs in "emergent"
+     * mode (the design's default): any domain that passes rules 1-5 is
+     * eligible. When `browserHistoryResearchDomainAllowlist` is non-empty,
+     * the filter switches to allowlist-only: a visit is meaningful ONLY
+     * if its eTLD+1 is in the allowlist AND it passes rules 1-5.
+     * `browserHistoryResearchDomainDenylist` is always-on and wins over
+     * the allowlist (defensive — explicit deny always denies).
+     *
+     * Entries are eTLD+1 strings (`arxiv.org`, `simonwillison.net`). The
+     * meaningful-filter normalises inputs (`https://`/`www.`/paths/case)
+     * to eTLD+1 before lookup, so `arxiv.org`, `https://arxiv.org`, and
+     * `www.arxiv.org/abs/2402.06196` all resolve to the same key.
+     *
+     * Visits filtered out by this rule are still recorded in
+     * `browser_visits` (the integration's row history is unchanged) but
+     * do not contribute to `meaningful_*` totals on cluster rows. Settings
+     * changes take effect on the next poller cycle's new visits only;
+     * already-classified visits are not retroactively re-classified
+     * (they age out via `browserHistoryRetentionDays`).
+     */
+    browserHistoryResearchDomainAllowlist: z
+        .array(z.string().trim().min(1).max(253))
+        .default([]),
+    browserHistoryResearchDomainDenylist: z
+        .array(z.string().trim().min(1).max(253))
+        .default([]),
     /**
      * B-003 Phase 4.3 — auto-probe cadence for enabled MCP servers.
      *
@@ -646,7 +754,7 @@ export const runtimeSettingsSchema = z.object({
     vaultMode: z.enum(["obsidian", "plain"]).default("plain"),
     /**
      * B-004 Phase 1 — dossier injection for routine ProcessKeys. When true
-     * (default), `dossiers/<flow>.md` is appended to routine prompts as a
+     * (default), `knowledge/dossiers/<flow>.md` is appended to routine prompts as a
      * carry-forward state block. Flag exists to allow a fast disable if the
      * injection misbehaves in production; the design treats Phase 1 as
      * always-on once B-007 Phase 1 is shipped.
@@ -797,6 +905,10 @@ export const RUNTIME_SETTING_KEYS = [
     "timezone",
     "dayBoundaryHour",
     "monthlyReviewEnabled",
+    "browserTaskMaxConcurrent",
+    "browserTaskPendingQueueTimeoutMinutes",
+    "browserTaskRespectQuietHours",
+    "browserTaskHostnameDenylist",
     "hourlyCheckEnabled",
     "hourlyCheckIntervalMinutes",
     "hourlyCheckActiveStartHour",
@@ -833,6 +945,14 @@ export const RUNTIME_SETTING_KEYS = [
     "calendarPollIntervalSeconds",
     "gmailPollIntervalSeconds",
     "githubPollIntervalSeconds",
+    "browserHistoryConsentAccepted",
+    "browserHistoryBrowserOverrides",
+    "browserHistoryCategories",
+    "browserHistoryRetentionDays",
+    "browserHistorySearchQueryRetentionDays",
+    "browserHistoryLifecycle",
+    "browserHistoryResearchDomainAllowlist",
+    "browserHistoryResearchDomainDenylist",
     "mcpAutoProbeIntervalMinutes",
     "delegatedProbeIntervalMinutes",
     "enabledMailProviders",
@@ -879,4 +999,3 @@ const _assertRuntimeSettingCoverage = true;
 export function isRuntimeSettingKey(value) {
     return runtimeSettingKeySet.has(value);
 }
-//# sourceMappingURL=runtime-settings.js.map

package/dist/settings/settings-store.d.ts

@@ -10,4 +10,3 @@ export interface SettingsStore {
 }
 export declare function createSettingsStore(db: Database.Database): SettingsStore;
 export declare function getRuntimeSettingsDefaults(): RuntimeSettings;
-//# sourceMappingURL=settings-store.d.ts.map

package/dist/settings/settings-store.js

@@ -19,14 +19,57 @@ class SqliteSettingsStore {
             }
         }
         const defaults = runtimeSettingsSchema.parse({});
+        // Gather every persisted key, then attempt a SINGLE full-object parse.
+        // Validating each key in isolation against peer *defaults* breaks
+        // cross-field refinements (e.g. prePassBackoffMs length must be
+        // >= prePassMaxAttemptsPerIntegration - 1): during a peer's per-key parse
+        // the other field still holds its default, so a mutually-consistent
+        // persisted pair could be wrongly rejected and silently reverted. The full
+        // parse lets such peers see each other.
+        const known = {};
+        for (const key of RUNTIME_SETTING_KEYS) {
+            if (key in rawValues) {
+                known[key] = rawValues[key];
+            }
+        }
         const result = {};
+        const full = runtimeSettingsSchema.safeParse({ ...defaults, ...known });
+        if (full.success) {
+            // Project back down to only the persisted keys — getAll() returns a
+            // Partial of what was stored, never schema defaults for absent keys.
+            for (const key of RUNTIME_SETTING_KEYS) {
+                if (key in known) {
+                    result[key] = full.data[key];
+                }
+            }
+            return result;
+        }
+        // Fallback: the full parse failed, so at least one persisted row is
+        // corrupt or part of an inconsistent cross-field combination. Seed peers
+        // from the persisted values that are INDIVIDUALLY valid (over defaults) —
+        // not raw `known` — so a corrupt value (e.g. a string where a number is
+        // expected) can't poison every other key's per-key parse. A valid
+        // cross-field pair still sees its persisted peer through `validPeers`.
+        const validPeers = {};
+        for (const key of RUNTIME_SETTING_KEYS) {
+            if (!(key in rawValues)) {
+                continue;
+            }
+            const single = runtimeSettingsSchema.safeParse({
+                ...defaults,
+                [key]: rawValues[key],
+            });
+            if (single.success) {
+                validPeers[key] = rawValues[key];
+            }
+        }
         for (const key of RUNTIME_SETTING_KEYS) {
             if (!(key in rawValues)) {
                 continue;
             }
             const candidate = runtimeSettingsSchema.safeParse({
                 ...defaults,
-                ...result,
+                ...validPeers,
                 [key]: rawValues[key],
             });
             if (!candidate.success) {
@@ -84,4 +127,3 @@ export function createSettingsStore(db) {
 export function getRuntimeSettingsDefaults() {
     return runtimeSettingsSchema.parse({});
 }
-//# sourceMappingURL=settings-store.js.map

package/native/win-appcontainer/README.md

@@ -0,0 +1,66 @@
+# win-appcontainer — Windows AppContainer + Job Object launcher
+
+MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §5.4 / §7.4.
+
+This native binding wraps `CreateProcessAsUser` +
+`AssignProcessToJobObject` so the Aitne daemon can launch its managed
+Chromium inside an AppContainer with a Job-Object resource ceiling. The
+binding is **only built on win32** — non-Windows installs skip the
+`node-gyp rebuild` step automatically (see `loader.js`).
+
+## Build prerequisites (Windows only)
+
+- Node ≥ 22 with `npm config get python` pointing at a working Python.
+- Visual Studio Build Tools 2022 ("Desktop development with C++"
+  workload).
+- `npm install -g node-gyp@latest`.
+
+The daemon installer runs:
+
+```cmd
+npm rebuild --filter @aitne/daemon
+```
+
+and that triggers `node-gyp` for this binding. The output `.node` file
+lands at `build/Release/win_appcontainer.node`; the `loader.js`
+fallback emits a clear runtime error if the addon is missing on a
+Windows host (a fresh source checkout that has not been rebuilt).
+
+## API surface (exported from `loader.js → loadHelper()`)
+
+```ts
+interface WindowsHelper {
+  spawnInAppContainer(opts: {
+    profileName: string;       // AppContainer profile (created if absent)
+    binary: string;            // Resolved Chromium binary path
+    args: readonly string[];
+    detached: boolean;
+    readableBindings: readonly string[];
+    writableBindings: readonly string[];
+  }): ChildProcess;
+}
+```
+
+The returned `ChildProcess` behaves like a standard Node spawn handle —
+`pid`, `kill()`, `on("exit")` all work. The actual process executes
+under an AppContainer SID with a Job Object enforcing memory + CPU
+ceilings.
+
+## Why a native binding and not PowerShell
+
+The existing daemon spawn path for secrets reading uses PowerShell
+(DPAPI / `secret-tool` equivalents). AppContainer creation is a
+multi-call Win32 sequence (`CreateAppContainerProfile`,
+`DeriveAppContainerSidFromAppContainerName`,
+`UpdateProcThreadAttribute`, etc.) that would be brittle and slow over
+a PowerShell hop. A small N-API addon is the right choice — it ships
+prebuilt for users who install the npm package and only requires VC++
+when rebuilding from source.
+
+## Sandbox status (B-1 milestone)
+
+The binding is shipped as a stub on non-Windows hosts and the
+`loadHelper()` fallback throws with a clear message. Windows users
+exercising B-1 will build the addon as part of `npm install`; the
+binding source (`src/win_appcontainer.cc`) lives next to this README
+for inspection and contribution.