@aitne/daemon 0.1.8 → 0.1.9

package/dist/api/server.js

@@ -10,6 +10,7 @@ import { auditRiskClassifications, classifyRisk, findExplicitRiskClassification,
 import { createHealthRoutes } from "./routes/health.js";
 import { createContextRoutes } from "./routes/context/index.js";
 import { createAgentRoutes } from "./routes/agent.js";
+import { createAgentDefinitionRoutes } from "./routes/agents/index.js";
 import { createDashboardRoutes } from "./routes/dashboard/index.js";
 import { createNotionRoutes } from "./routes/notion.js";
 import { createGitHubRoutes } from "./routes/github.js";
@@ -36,7 +37,6 @@ import { createScheduleOptionsRoutes } from "./routes/schedule-options.js";
 import { createTriggerRoutes } from "./routes/triggers.js";
 import { createTravelBookingRoutes } from "./routes/travel-bookings.js";
 import { createReceiptRoutes } from "./routes/receipts.js";
-import { createTravelTimeRoutes } from "./routes/travel-time.js";
 import { createBookRoutes } from "./routes/books.js";
 import { createDelegatedRunRoutes } from "./routes/delegated.js";
 import { createDelegatedSyncRoutes } from "./routes/delegated-sync.js";
@@ -49,6 +49,11 @@ import { createCommandsRoutes } from "./routes/commands.js";
 import { createVoiceRoutes } from "./routes/voice.js";
 import { createWikiRoutes } from "./routes/wiki.js";
 import { createFsRoutes } from "./routes/fs.js";
+import { createBrowserHistoryRoutes } from "./routes/browser-history.js";
+import { createBrowserHistoryManagedRoutes } from "./routes/browser-history-managed.js";
+import { createBrowserAutomationSitesRoutes } from "./routes/browser-automation-sites.js";
+import { createBrowserAutomationPurchaseRoutes } from "./routes/browser-automation-purchase.js";
+import { createBrowserTaskRoutes } from "./routes/browser-task.js";
 import { buildManagedTasksRoutesDepsFromApi, createManagedTasksRoutes, } from "./routes/managed-tasks.js";
 import { buildSotBindingsRoutesDepsFromApi, createSotBindingsRoutes, } from "./routes/sot-bindings.js";
 import { buildEntitiesRoutesDepsFromApi, createEntitiesRoutes, } from "./routes/entities.js";
@@ -58,6 +63,7 @@ import { createMcpRoutes } from "./routes/mcp.js";
 import { createAttachmentRoutes } from "./routes/attachments.js";
 import { InMemoryManagementMdWriteLockManager, } from "../core/management-md-write-lock.js";
 import { isRuntimeAvailableBackendId } from "@aitne/shared";
+import { loopbackOrigins, resolveDashboardPort } from "@aitne/shared";
 import { queryChatBinding } from "./chat-binding-query.js";
 import { DEFAULT_CLAUDE_HIGH_MODEL, getModelsForBackend, } from "../core/backends/model-registry.js";
 import { createLogger } from "../logging.js";
@@ -107,11 +113,7 @@ function getRequestHostname(c) {
     /* c8 ignore stop */
 }
 function buildAllowedDaemonOrigins(apiPort) {
-    return new Set([
-        `http://localhost:${apiPort}`,
-        `http://127.0.0.1:${apiPort}`,
-        `http://[::1]:${apiPort}`,
-    ]);
+    return new Set(loopbackOrigins(apiPort));
 }
 function evaluateLoopbackBrowserGate(input) {
     if (SAFE_METHODS.has(input.method)) {
@@ -190,7 +192,12 @@ export function createApp(deps) {
         }
         await next();
     });
-    app.use("*", cors({ origin: "http://localhost:3000" }));
+    // CORS for direct browser → daemon requests. The dashboard normally proxies
+    // server-side (no CORS), but this keeps the daemon reachable from the
+    // dashboard's own loopback origin on whatever port it runs (PA_DASHBOARD_PORT
+    // default = DEFAULT_DASHBOARD_PORT). Previously hardcoded to localhost:3000,
+    // which silently broke whenever the dashboard ran on any other port.
+    app.use("*", cors({ origin: loopbackOrigins(resolveDashboardPort()) }));
     app.use("*", honoLogger());
     // Risk-based auth middleware — Approve-tier endpoints require Bearer token;
     // ReadSensitive-tier endpoints require Bearer or X-Read-Token when
@@ -288,6 +295,7 @@ export function createApp(deps) {
     const healthRoutes = createHealthRoutes(deps);
     const contextRoutes = createContextRoutes(deps);
     const agentRoutes = createAgentRoutes(deps);
+    const agentDefinitionRoutes = createAgentDefinitionRoutes(deps);
     const dashboardRoutes = createDashboardRoutes(deps);
     const notionRoutes = createNotionRoutes({
         notionService: deps.services.notion,
@@ -327,7 +335,6 @@ export function createApp(deps) {
     const triggerRoutes = createTriggerRoutes(deps);
     const travelBookingRoutes = createTravelBookingRoutes(deps);
     const receiptRoutes = createReceiptRoutes(deps);
-    const travelTimeRoutes = createTravelTimeRoutes({ services: deps.services });
     const bookRoutes = createBookRoutes(deps);
     const integrationRoutes = createIntegrationRoutes(deps);
     const integrationReconcileRoutes = createIntegrationReconcileRoutes(deps);
@@ -340,6 +347,27 @@ export function createApp(deps) {
     const voiceRoutes = createVoiceRoutes(deps);
     const wikiRoutes = createWikiRoutes(deps);
     const fsRoutes = createFsRoutes(deps);
+    const browserHistoryRoutes = createBrowserHistoryRoutes(deps);
+    const browserHistoryManagedRoutes = createBrowserHistoryManagedRoutes(deps);
+    // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.9 — Phase B-2.5
+    // per-site sign-in surface. Same mounting rationale as the parent
+    // automation routes: the per-site list is the dashboard's "available
+    // sites" probe, so it stays mounted unconditionally and gates on the
+    // master managed-chromium toggle inside the connect / reauth handlers.
+    const browserAutomationSitesRoutes = createBrowserAutomationSitesRoutes(deps);
+    // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.8 — Phase B-4
+    // experimental purchase config + audit surface. Mounted
+    // unconditionally; every route checks `getB4Enabled` / per-site
+    // config presence before producing meaningful output, so absent
+    // wiring is benign (returns empty lists + 403-equivalent JSON on
+    // attempted enable).
+    const browserAutomationPurchaseRoutes = createBrowserAutomationPurchaseRoutes(deps);
+    // BROWSER_TASK_REDESIGN_PLAN.md §3 — Phase 1 browser-task surface.
+    // Mounted unconditionally so the dashboard /browser-tasks page
+    // (Phase 7a) reaches a stable surface even when the runner is not
+    // wired (tests / lite installs). The route handlers degrade
+    // gracefully on absent runner / slot ref.
+    const browserTaskRoutes = createBrowserTaskRoutes(deps);
     // Management Registry & Entities (docs/design/21-management-registry-
     // and-entities.md). The managed-tasks and sot-bindings routes MUST
     // share one lock manager — separate instances would let back-to-back
@@ -355,6 +383,7 @@ export function createApp(deps) {
     app.route("/api", healthRoutes);
     app.route("/api", contextRoutes);
     app.route("/api", agentRoutes);
+    app.route("/api", agentDefinitionRoutes);
     app.route("/api", dashboardRoutes);
     app.route("/api", notionRoutes);
     app.route("/api", metricsRoutes);
@@ -377,7 +406,6 @@ export function createApp(deps) {
     app.route("/api", triggerRoutes);
     app.route("/api", travelBookingRoutes);
     app.route("/api", receiptRoutes);
-    app.route("/api", travelTimeRoutes);
     app.route("/api", bookRoutes);
     app.route("/api", integrationRoutes);
     app.route("/api", integrationReconcileRoutes);
@@ -390,6 +418,11 @@ export function createApp(deps) {
     app.route("/api", voiceRoutes);
     app.route("/api", wikiRoutes);
     app.route("/api", fsRoutes);
+    app.route("/api", browserHistoryRoutes);
+    app.route("/api", browserHistoryManagedRoutes);
+    app.route("/api", browserAutomationSitesRoutes);
+    app.route("/api", browserAutomationPurchaseRoutes);
+    app.route("/api", browserTaskRoutes);
     // ── Chat file attachments (Phase 1) ──
     if (deps.attachmentStore) {
         const attachmentRoutes = createAttachmentRoutes({
@@ -571,8 +604,8 @@ export function createApp(deps) {
     // rely on the default-Approve fallback. Most are intentional admin
     // surfaces (secrets, pairing, restore-snapshot, dashboard-only
     // controls) for which fail-closed is correct — but the same fallback
-    // historically masked the `POST /api/context/roadmap/id` regression
-    // that 7×401'd inside roadmap_refresh on 2026-04-28.
+    // can mask a missing classifier entry on an agent-callable route,
+    // producing a 401 retry spiral inside the routine that hits it.
     //
     // Gating: log only when the unclassified set CHANGES from the last
     // boot. A warning that fires identically on every restart turns into
@@ -603,4 +636,3 @@ export function createApp(deps) {
     }
     return app;
 }
-//# sourceMappingURL=server.js.map

package/dist/bootstrap/adapters.d.ts

@@ -106,4 +106,3 @@ export declare function createAdapterReloaders(deps: BootstrapAdapterDeps): Adap
  * own.
  */
 export declare function whatsappQrResponseFromAdapter(adapter: WhatsAppAdapter | null, snapshotOverride?: WhatsAppQrSnapshot | null): WhatsAppQrResponse;
-//# sourceMappingURL=adapters.d.ts.map

package/dist/bootstrap/adapters.js

@@ -237,4 +237,3 @@ export function whatsappQrResponseFromAdapter(adapter, snapshotOverride) {
         error: adapter.getStatusError(),
     };
 }
-//# sourceMappingURL=adapters.js.map

package/dist/bootstrap/api.d.ts

@@ -121,6 +121,13 @@ export interface BootstrapApiDeps {
     readonly dispatcher: EventDispatcher;
     readonly sessionManager: SessionManager;
     readonly scheduler: AgentScheduler;
+    /**
+     * Agent Definitions enabled-cache built by `bootstrapAgents` (§10.5) — the
+     * same instance the scheduler's per-built-in cron gate consults. Threaded
+     * into `ApiDependencies` so `PATCH`/`DELETE /api/agents/:slug` can invalidate
+     * it on an `enabled` change. Optional so partial test harnesses can omit it.
+     */
+    readonly agentEnabledCache?: import("../core/agents/loader.js").AgentEnabledCache;
     readonly customRoutineScheduler: CustomRoutineScheduler;
     readonly healthMonitor: HealthMonitor;
     readonly heartbeat: Heartbeat;
@@ -130,6 +137,14 @@ export interface BootstrapApiDeps {
     readonly primaryVaultWatcher: PrimaryVaultWatcher;
     readonly delegatedBackendInvoker: DelegatedBackendInvoker;
     readonly gitAccountRegistry: GitAccountRegistry;
+    /** Shared in-memory slot state — the runner + route layer mutate one
+     *  instance so cancel-while-pending and runner-side promote see each
+     *  other. Constructed in `event-pipeline.ts`. */
+    readonly browserTaskSlotStateRef: import("../services/browser-task/browser-task-runner.js").SlotStateRef;
+    /** Per-install browser-task runner. Phase 1 runs without `driver`
+     *  wired so the runner returns `failed (not_implemented)`; Phase 2
+     *  passes the Playwright + Claude SDK driver into the same factory. */
+    readonly browserTaskRunner: import("../services/browser-task/browser-task-runner.js").BrowserTaskRunner;
     readonly writeTracker: AgentWriteTracker;
     readonly auditLogger: AuditLogger;
     readonly attachmentStore: AttachmentStore;
@@ -155,7 +170,7 @@ export interface BootstrapApiDeps {
         summary: RefreshDmSessionWorkdirsResult;
         mailAccounts: ReadonlyArray<unknown>;
     } | null;
-    readonly fireRoadmapMaintenance: () => RoadmapMaintenanceResult;
+    readonly fireRoadmapMaintenance: () => Promise<RoadmapMaintenanceResult>;
     readonly buildCalendarPoller: () => CalendarPoller | null;
     readonly buildNotionPoller: () => NotionPoller | null;
     readonly buildGitWatcher: () => GitWatcher | null;
@@ -202,4 +217,3 @@ export interface BootstrapApiResult {
  * dispatcher / heartbeat work that depends on the listener being live.
  */
 export declare function startApiServer(deps: BootstrapApiDeps): BootstrapApiResult;
-//# sourceMappingURL=api.d.ts.map

package/dist/bootstrap/api.js

@@ -43,6 +43,8 @@ import { serve } from "@hono/node-server";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
+import { BrowserLifecycleSupervisor } from "../services/browser-history/lifecycle/supervisor.js";
+import { BrowserHistoryPoller } from "../observers/browser-history-poller.js";
 import { applyIntegrationModeChange, } from "../core/integration-lifecycle.js";
 import { continueDashboardSession as continueDashboardSessionFromHistory, endDashboardSession as endDashboardSessionFromChannel, } from "../core/dashboard-session-controls.js";
 import { sendSetupWelcomeDm } from "../messaging/setup-welcome-dm.js";
@@ -93,6 +95,23 @@ export function startApiServer(deps) {
         // `Response` instances directly anywhere in the daemon.
         overrideGlobalObjects: false,
     });
+    // @hono/node-server's serve() calls http.Server.listen() without attaching
+    // an 'error' listener, so a failed bind (most commonly EADDRINUSE from a
+    // stale daemon or PID reuse) escalates into an uncaughtException that
+    // surfaces as an opaque "process will exit" crash. Attach a listener so the
+    // port-conflict case produces an actionable message. ServerType extends
+    // net.Server/EventEmitter on every platform and libuv reports EADDRINUSE
+    // identically on macOS/Linux/Windows, so no platform branch is warranted.
+    server.on("error", (err) => {
+        const e = err;
+        if (e.code === "EADDRINUSE") {
+            logger.fatal({ port: deps.config.apiPort }, `API port ${deps.config.apiPort} already in use — another daemon may be running; run 'aitne stop' first, or set PA_API_PORT to a free port`);
+        }
+        else {
+            logger.fatal({ err }, "API server error — process will exit");
+        }
+        process.exit(1);
+    });
     logger.info({ port: deps.config.apiPort }, "API server listening");
     return { app, server, eventBroadcaster: deps.eventBroadcaster };
 }
@@ -106,7 +125,7 @@ export function startApiServer(deps) {
  * call site reads as one factory call.
  */
 function composeApiDependencies(deps) {
-    const { db, config, secretBroker, services, blobStore, agentBackends, authHealthMonitor, authRecovery, authTelemetry, eventBus, readTokenManager, morningRoutineLock, roadmapWriteLock, migrationLock, contextWriteGate, managementMdWriteLockManager, dispatcher, scheduler, customRoutineScheduler, healthMonitor, heartbeat, messageHub, observerManager, contextIndexReconciler, primaryVaultWatcher, delegatedBackendInvoker, gitAccountRegistry, writeTracker, auditLogger, attachmentStore, dashboardAdapter, eventBroadcaster, getIntegrationStatus, getMessagingStatus, isStartupComplete, getDelegatedSyncWorker, handleSecretChange, handlePromptContextChanged, onGoogleServicesReady, rematerializeActiveDmWorkdirs, fireRoadmapMaintenance, buildCalendarPoller, buildNotionPoller, buildGitWatcher, buildGithubPoller, buildDelegatedSyncWorker, buildGitDelegatedCronObserver, clearGitWatcher, queueGitProjectInitsForCurrentConfig, } = deps;
+    const { db, config, secretBroker, services, blobStore, agentBackends, authHealthMonitor, authRecovery, authTelemetry, eventBus, readTokenManager, morningRoutineLock, roadmapWriteLock, migrationLock, contextWriteGate, managementMdWriteLockManager, dispatcher, scheduler, agentEnabledCache, customRoutineScheduler, healthMonitor, heartbeat, messageHub, observerManager, contextIndexReconciler, primaryVaultWatcher, delegatedBackendInvoker, gitAccountRegistry, writeTracker, auditLogger, attachmentStore, dashboardAdapter, eventBroadcaster, getIntegrationStatus, getMessagingStatus, isStartupComplete, getDelegatedSyncWorker, handleSecretChange, handlePromptContextChanged, onGoogleServicesReady, rematerializeActiveDmWorkdirs, fireRoadmapMaintenance, buildCalendarPoller, buildNotionPoller, buildGitWatcher, buildGithubPoller, buildDelegatedSyncWorker, buildGitDelegatedCronObserver, clearGitWatcher, queueGitProjectInitsForCurrentConfig, } = deps;
     const whatsappControls = buildWhatsAppControls(deps);
     const messagingControls = {
         telegram: deps.buildTelegramControls(),
@@ -163,6 +182,19 @@ function composeApiDependencies(deps) {
                 return buildGitWatcher();
             if (observerName === "github")
                 return buildGithubPoller();
+            if (observerName === "browser-lifecycle-supervisor") {
+                return new BrowserLifecycleSupervisor(db, config);
+            }
+            if (observerName === "browser-history-poller") {
+                return new BrowserHistoryPoller(db, config, {
+                    // BROWSER_HISTORY_INTEGRATION_PLAN §5.F1 (seventh-pass) —
+                    // poller enqueues `routine.research_offer_dm` events; the
+                    // agent session composes + sends the natural-language DM.
+                    enqueueEvent: async (event) => {
+                        await eventBus.put(event);
+                    },
+                });
+            }
             return null;
         };
         await applyIntegrationModeChange({
@@ -310,6 +342,33 @@ function composeApiDependencies(deps) {
         },
         onGoogleServicesReady,
         onScheduleConfigChanged: () => scheduler.reloadCrons(),
+        // Phase B-4 — the dispatcher holds the canonical PurchaseHandler
+        // instance (constructed in `event-pipeline.ts` once the message
+        // hub is available). We thread it through the API deps via a
+        // getter so the route layer's `deps.purchaseHandler` reads the
+        // live reference instead of a snapshot — important for the
+        // future "Disable B-4" dashboard flow that swaps the handler out.
+        get purchaseHandler() {
+            return dispatcher.getPurchaseHandler() ?? undefined;
+        },
+        // BROWSER_TASK_REDESIGN_PLAN.md §5 / §14.11 — lite-final-confirm
+        // handler. Constructed in `event-pipeline.ts` (parallel to the B-4
+        // block) once the message hub is up; surfaced here via the
+        // dispatcher getter so the route layer + the inbound message
+        // classifier always see the same live instance.
+        get finalConfirmHandler() {
+            return dispatcher.getFinalConfirmHandler() ?? undefined;
+        },
+        // BROWSER_TASK_REDESIGN_PLAN.md §5 / §5.1 — browser-task runner +
+        // shared slot state. Both originate from `event-pipeline.ts` so
+        // every consumer (route handler, runner, deadline tick) operates
+        // on a single in-memory state. The route layer's
+        // `deps.browserTaskRunner` and `deps.browserTaskSlotStateRef`
+        // resolve through this object — never re-instantiated in
+        // `createApp` so cancel-while-pending and runner-side promote
+        // race on the same value.
+        browserTaskRunner: deps.browserTaskRunner,
+        browserTaskSlotStateRef: deps.browserTaskSlotStateRef,
         onIntegrationModeChange,
         onMainBackendChange,
         onSetupStart: (mode) => {
@@ -362,6 +421,7 @@ function composeApiDependencies(deps) {
         validateAttachmentTurnToken: (token) => dispatcher.validateAttachmentTurnToken(token),
         whatsappControls,
         messagingControls,
+        ...(agentEnabledCache ? { agentEnabledCache } : {}),
     };
 }
 /**
@@ -440,4 +500,3 @@ function buildWhatsAppControls(deps) {
         },
     };
 }
-//# sourceMappingURL=api.js.map

package/dist/bootstrap/catchup.d.ts

@@ -20,4 +20,3 @@ export interface StartupCatchupResult {
 export declare function runCatchup(db: Database.Database, dispatcher: EventDispatcher, config: AgentConfig): Promise<StartupCatchupResult>;
 export declare function runPostMessagingCatchup(dispatcher: EventDispatcher, catchup: StartupCatchupResult): Promise<void>;
 export declare function processRoutineCatchup(dispatcher: EventDispatcher, routine: string): Promise<void>;
-//# sourceMappingURL=catchup.d.ts.map

package/dist/bootstrap/catchup.js

@@ -35,7 +35,7 @@ export async function runCatchup(db, dispatcher, config) {
     const now = new Date();
     const tz = config.timezone || undefined;
     const contextDir = getContextDir(config);
-    const todayMdPath = join(contextDir, "today.md");
+    const todayMdPath = join(contextDir, "state", "today.md");
     const { start: agentDayStartUtc, end: agentDayEndUtc } = getAgentDayBoundsUtc(tz, config.dayBoundaryHour, now);
     const skippedPending = discardStalePendingSchedules(db, agentDayStartUtc);
     if (skippedPending > 0) {
@@ -121,4 +121,3 @@ export async function processRoutineCatchup(dispatcher, routine) {
         routine,
     });
 }
-//# sourceMappingURL=catchup.js.map

package/dist/bootstrap/db.d.ts

@@ -8,18 +8,24 @@
  *
  * Responsibilities (in run order):
  *  1. Open the SQLite file and apply the idempotent schema.
- *  2. Register the wiki workspace token resolver so skill compilation can
+ *  2. Load persisted `settings` rows and merge them on top of env
+ *     defaults. **Must run before step 3** so `getContextDir(config)`
+ *     sees DB-persisted `vaultMode` / `primaryVaultPath` before the
+ *     context-vault-restructure migration (0004) walks the vault.
+ *     CONTEXT_VAULT_REDESIGN_PLAN.md §11.8 + V21.
+ *  3. Resolve `contextDir`, evaluate the Obsidian-mode consent gate, and
+ *     run the forward-only schema migrations.
+ *  4. Register the wiki workspace token resolver so skill compilation can
  *     resolve `<wiki_workspace>` tokens via the DB.
- *  3. Backfill the content-less `fts_wiki` virtual table once per workspace.
- *  4. Bump `managed_task_seq.next_id` past any restored backup rows.
- *  5. Close orphaned `dashboard_chat` sessions left active by a crash so
+ *  5. Backfill the content-less `fts_wiki` virtual table once per workspace.
+ *  6. Bump `managed_task_seq.next_id` past any restored backup rows.
+ *  7. Close orphaned `dashboard_chat` sessions left active by a crash so
  *     the setup wizard's resume gate flips correctly on next dashboard load.
- *  6. Construct the chat `AttachmentStore` (top-level so adapter reloaders
+ *  8. Construct the chat `AttachmentStore` (top-level so adapter reloaders
  *     can capture it in closure) and reap orphan rows.
- *  7. Fire-and-forget price refresh (best-effort, network call).
- *  8. Load persisted `settings` rows and merge them on top of env defaults.
- *  9. Best-effort seed of git-project document templates (filesystem write).
- *  10. Heal the `delegatedTaskModeEnabled` Phase-1 canary default for users
+ *  9. Fire-and-forget price refresh (best-effort, network call).
+ *  10. Best-effort seed of git-project document templates (filesystem write).
+ *  11. Heal the `delegatedTaskModeEnabled` Phase-1 canary default for users
  *      who have delegated integrations but never explicitly set the flag.
  *
  * Each step that has its own peer-test surface is exported by name so the
@@ -36,6 +42,7 @@
  */
 import type Database from "better-sqlite3";
 import type { AgentConfig } from "../config.js";
+import { type Migration } from "../db/migrations.js";
 import { type SettingsStore } from "../settings/settings-store.js";
 import type { RuntimeSettings } from "../settings/runtime-settings.js";
 import { AttachmentStore } from "../services/attachments/store.js";
@@ -48,6 +55,72 @@ export interface BootstrapDbResult {
     readonly persistedSettings: Partial<RuntimeSettings>;
     readonly attachmentStore: AttachmentStore;
 }
+/**
+ * CONTEXT_VAULT_REDESIGN_PLAN.md V16 — env-var override for the Obsidian
+ * consent gate. Set to `"1"` (or any non-empty string) to declare that
+ * the user has accepted the sidebar reorganization without going
+ * through the dashboard surface. Recorded into
+ * `runtime_state.context_vault_restructure_acknowledged_at` with
+ * `source="env"` so subsequent boots short-circuit the env check.
+ */
+export declare const VAULT_RESTRUCTURE_ACK_ENV_VAR = "PA_VAULT_RESTRUCTURE_ACK";
+export interface VaultRestructureConsentDecision {
+    /** True when the migration is deferred awaiting user consent. */
+    deferred: boolean;
+    /** Migrations to pass into `runMigrations`. `undefined` means "use the
+     *  default MIGRATIONS list" (steady-state proceed). A concrete array
+     *  is the filtered list when the migration is deferred. */
+    migrationsToRun: readonly Migration[] | undefined;
+}
+export interface ResolveVaultRestructureConsentDeps {
+    readonly db: Database.Database;
+    readonly dataDir: string;
+    readonly contextDir: string;
+    /** Test seam — production reads `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Test seam — defaults to `() => new Date().toISOString()`. */
+    readonly nowIso?: () => string;
+}
+/**
+ * Decide whether to run, defer, or short-circuit the context-vault
+ * restructure migration (CONTEXT_VAULT_REDESIGN_PLAN.md §11.3.4 / V16).
+ *
+ * Branches:
+ *  - Vault is in plain mode (under `<dataDir>/context/`): always proceed.
+ *  - Vault is Obsidian-rooted and an explicit ack exists: proceed.
+ *  - Vault is Obsidian-rooted and `PA_VAULT_RESTRUCTURE_ACK` is set:
+ *    record the ack with `source="env"` and proceed.
+ *  - Vault is Obsidian-rooted with no ack: defer. The migration is
+ *    filtered out of the run list (so `schema_migrations` doesn't get
+ *    its row), pending-consent state is recorded, the daemon boots
+ *    normally on the legacy layout, and the alias resolver continues to
+ *    translate legacy paths until the user acks. The Obsidian-mode
+ *    vault-health probe (`config.ts:runVaultHealthProbe`) sees the
+ *    missing `policies/management.md` marker on a legacy vault and
+ *    enters degraded mode for reason `primary_vault_missing_content`
+ *    on its own — that's what 503s context writes during the consent
+ *    window. `bootstrapManagementMd` in `index.ts` reads
+ *    `getVaultRestructurePendingConsent(db)` and skips its write so the
+ *    legacy vault doesn't grow a stray `policies/` directory before the
+ *    user has acknowledged the move.
+ *
+ * **Subsequent-migration ordering caveat**: only the 0004 entry is
+ * filtered out. Any future migration appended AFTER 0004 will still
+ * run while the vault is at the legacy layout. Authors of post-0004
+ * migrations whose body reads from `<contextDir>/policies/...`,
+ * `identity/...`, etc. must either (a) be idempotent against both
+ * layouts, or (b) detect the pending-consent state via
+ * `getVaultRestructurePendingConsent(db)` and skip their body
+ * gracefully. Both are simpler than reintroducing a dependency-graph
+ * framework just for this one transitional window. The window closes
+ * the first time a deferred-consent user runs the daemon with the
+ * env / dashboard ack set — at that point the migration runner picks
+ * up 0004 (and only 0004; later entries already ran on the legacy
+ * layout boot).
+ *
+ * Exported for peer testing.
+ */
+export declare function resolveVaultRestructureConsent(deps: ResolveVaultRestructureConsentDeps): VaultRestructureConsentDecision;
 /**
  * Open the SQLite file, apply schema, run boot-time backfills, hydrate
  * persisted settings, and apply the delegated-task-mode default
@@ -115,5 +188,26 @@ export interface DelegatedTaskModeCorrectionDeps {
     readonly settingsStore: SettingsStore;
     readonly persistedSettings: Partial<RuntimeSettings>;
 }
+/**
+ * BROWSER_TASK_REDESIGN_PLAN.md §6.5 boot-recovery — flip every
+ * non-terminal `browser_task` row to `failed (daemon_restarted)` and
+ * emit a single `agent_actions(action_type='browser_task.boot_recovery')`
+ * row per affected task so the operator can DM-fan them out post-boot
+ * via a reconciliation tool. We do NOT call the sender here because
+ * the messaging adapters are still constructing at this stage of boot.
+ *
+ * Pure SQL UPDATE inside `sweepNonTerminalRowsForBootRecovery`; this
+ * wrapper handles the audit-row emission + the log line. Exported so
+ * a peer test can exercise both branches (no rows vs. some rows).
+ */
+export declare function surfaceBrowserTaskBootRecovery(db: Database.Database): number;
+/**
+ * AGENT_DEFINITIONS_DESIGN.md §7.4 — boot-time agent-execution crash janitor.
+ * Force-closes every `agent_executions` row left non-terminal (`result IS
+ * NULL`) by a crashed prior run, stamping `result='error', error_kind='crash'`.
+ * Idempotent (a second boot finds nothing non-terminal). Best-effort: a sweep
+ * failure (e.g. a hand-crafted partial DB missing the table) logs and returns 0
+ * so boot proceeds. Exported so a peer test can exercise both branches.
+ */
+export declare function sweepAbandonedAgentExecutions(db: Database.Database, bootTime?: number): number;
 export declare function applyDelegatedTaskModeDefaultCorrection(deps: DelegatedTaskModeCorrectionDeps): void;
-//# sourceMappingURL=db.d.ts.map