@aitne/daemon 0.1.8 → 0.1.9

package/dist/safety/audit.js

@@ -38,8 +38,21 @@ export class AuditLogger {
         this.hasSourceKindColumn = this.actionColumns.has("source_kind");
         this.hasSourceRefColumn = this.actionColumns.has("source_ref");
     }
+    /**
+     * AGENT_DEFINITIONS_DESIGN.md §8.1 — resolver that maps a live event to the
+     * owning Agent slug for the in-flight firing, so every `logAction` row the
+     * run produces is stamped with `agent_actions.agent_id` without threading the
+     * slug through each caller (morning orchestrator, scheduled tasks, DMs). The
+     * dispatcher wires `AgentExecutionTracker.currentAgentId(correlationId)` here
+     * after both exist; until then (and for events with no resolved Agent) the
+     * stamp stays NULL, preserving the legacy row shape.
+     */
+    agentIdResolver = null;
+    setAgentIdResolver(resolver) {
+        this.agentIdResolver = resolver;
+    }
     logAction(params) {
-        const { event, model, costUsd, usage, modelUsage, durationMs, numTurns, trigger, backend, costSource, contextUpdated = false, advisorCallCount = 0, dmFreshness, prePass, } = params;
+        const { event, model, costUsd, usage, modelUsage, durationMs, numTurns, trigger, backend, costSource, contextUpdated = false, advisorCallCount = 0, dmFreshness, prePass, dailyWrite, } = params;
         try {
             const modelUsageJson = Object.keys(modelUsage).length > 0
                 ? JSON.stringify(modelUsage)
@@ -114,6 +127,16 @@ export class AuditLogger {
                 columns.splice(columns.length - 2, 0, "source_ref");
                 values.splice(values.length, 0, typeof event.data.workspace === "string" ? event.data.workspace : null);
             }
+            // AGENT_DEFINITIONS_DESIGN.md §5.3 / §8.1 — stamp the owning Agent slug
+            // when the in-flight firing resolved to one. The `agent_id` column ships
+            // since migration 0007, so no column-existence guard is needed; an
+            // unresolved firing leaves it NULL (legacy row shape). The in_progress
+            // UPDATE path below carries it automatically (the generic column loop).
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            if (resolvedAgentId !== null) {
+                columns.splice(columns.length - 2, 0, "agent_id");
+                values.splice(values.length, 0, resolvedAgentId);
+            }
             const detailPayload = {};
             // STAGE-C-DM-FRESHNESS-PLAN §Task 4 — persist DM freshness telemetry
             // into `detail`. Inserted only when supplied so non-DM rows stay
@@ -151,6 +174,12 @@ export class AuditLogger {
                         : {}),
                 };
             }
+            // daily-journal-daemon-write.md §4.11 — Stage B daily journal
+            // compose outcome. Lands on the same INSERT/UPSERT as the row's
+            // terminal `result`, no post-UPDATE required.
+            if (dailyWrite) {
+                detailPayload.dailyWrite = dailyWrite;
+            }
             if (Object.keys(detailPayload).length > 0) {
                 columns.splice(columns.length - 2, 0, "detail");
                 values.splice(values.length, 0, JSON.stringify(detailPayload));
@@ -303,11 +332,23 @@ export class AuditLogger {
     }
     logSkip(event, reason, trigger) {
         try {
-            const insertResult = this.db
-                .prepare(`INSERT INTO agent_actions
-         (event_id, action_type, trigger, result, error, started_at)
-         VALUES (?, ?, ?, 'skipped', ?, datetime('now'))`)
-                .run(event.correlationId, event.type, trigger, reason);
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — stamp the owning Agent when the
+            // in-flight firing resolved to one (e.g. a review routine skipped by the
+            // morning-pending gate), so the skip row is attributable. Pre-`begin`
+            // skips (setup-mode / cost-cap) resolve to NULL — no execution context
+            // exists yet — which is the legacy row shape.
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            const insertResult = resolvedAgentId !== null
+                ? this.db
+                    .prepare(`INSERT INTO agent_actions
+               (event_id, action_type, trigger, result, error, agent_id, started_at)
+               VALUES (?, ?, ?, 'skipped', ?, ?, datetime('now'))`)
+                    .run(event.correlationId, event.type, trigger, reason, resolvedAgentId)
+                : this.db
+                    .prepare(`INSERT INTO agent_actions
+               (event_id, action_type, trigger, result, error, started_at)
+               VALUES (?, ?, ?, 'skipped', ?, datetime('now'))`)
+                    .run(event.correlationId, event.type, trigger, reason);
             this.emitInsertedRow(Number(insertResult.lastInsertRowid), event.type);
         }
         catch (err) {
@@ -371,10 +412,9 @@ export class AuditLogger {
      * Optional partial-run context the dispatcher recovers from the catch
      * site (wall-clock duration) and from `BackendRouterHandledError`
      * (backend / model / failure kind+code). Without this, the row is a
-     * black hole: the dashboard shows "Duration: 0ms" for a 60-second run
-     * that hit `max_budget_usd` because the row was written with no
-     * timing/backend/model info — see drift-effects regression
-     * 2026-05-04 (today_refresh hit the $0.10 cap; row 62 was unfilled).
+     * black hole: the dashboard shows "Duration: 0ms" for a long run that
+     * hit `max_budget_usd` because the row was written with no
+     * timing/backend/model info.
      *
      * Tokens / cost / num_turns are intentionally NOT passed: an aborted
      * SDK stream doesn't surface a usable AgentResult, so any value here
@@ -401,18 +441,38 @@ export class AuditLogger {
                 "failed",
                 error.message,
             ];
+            // Optional columns are inserted BEFORE the started_at/completed_at
+            // tail (`columns.length - 2`) and APPENDED to `values` (which has
+            // no started_at/completed_at entries — those are SQL expressions
+            // in the INSERT placeholder map). The lockstep invariant
+            // `columns.length - 2 === values.length` is what makes the
+            // in_progress UPSERT branch's iteration `values[i]` align with
+            // columns[i]: any other splice pattern (e.g. inserting at
+            // `columns.length`, AFTER the timestamps) would shift columns
+            // ahead of values and the UPDATE assignments would bind the wrong
+            // value to each column. Mirrors the identically-shaped block in
+            // `logAction` (above).
             if (typeof context?.durationMs === "number" && context.durationMs >= 0) {
-                columns.splice(columns.length, 0, "duration_ms");
+                columns.splice(columns.length - 2, 0, "duration_ms");
                 values.splice(values.length, 0, Math.round(context.durationMs));
             }
             if (context?.modelId) {
-                columns.splice(columns.length, 0, "model_used");
+                columns.splice(columns.length - 2, 0, "model_used");
                 values.splice(values.length, 0, context.modelId);
             }
             if (this.hasBackendColumn && context?.backendId) {
-                columns.splice(columns.length, 0, "backend");
+                columns.splice(columns.length - 2, 0, "backend");
                 values.splice(values.length, 0, context.backendId);
             }
+            // AGENT_DEFINITIONS_DESIGN.md §8.1 — stamp the owning Agent when the
+            // in-flight firing resolved to one, so a FAILED routine's audit row is
+            // attributable to its Agent (the same resolver `logAction` uses). The
+            // in_progress UPSERT loop below carries it via the generic column path.
+            const resolvedAgentId = this.agentIdResolver?.(event) ?? null;
+            if (resolvedAgentId !== null) {
+                columns.splice(columns.length - 2, 0, "agent_id");
+                values.splice(values.length, 0, resolvedAgentId);
+            }
             const detailPayload = {};
             if (context?.failureKind)
                 detailPayload.failureKind = context.failureKind;
@@ -441,8 +501,15 @@ export class AuditLogger {
                         : {}),
                 };
             }
+            // daily-journal-daemon-write.md §4.11 — Stage B daily journal
+            // compose outcome (failure-path twin of the success-path block
+            // above). Lets the streak detector see `ok: false, reason: ...`
+            // rows when Stage B threw mid-flight.
+            if (context?.dailyWrite) {
+                detailPayload.dailyWrite = context.dailyWrite;
+            }
             if (Object.keys(detailPayload).length > 0) {
-                columns.splice(columns.length, 0, "detail");
+                columns.splice(columns.length - 2, 0, "detail");
                 values.splice(values.length, 0, JSON.stringify(detailPayload));
             }
             // Backdate started_at so the dashboard "Started" column reflects when
@@ -454,6 +521,62 @@ export class AuditLogger {
             const startedAtExpr = backdateSeconds > 0
                 ? `datetime('now', '-${backdateSeconds.toFixed(3)} seconds')`
                 : "datetime('now')";
+            // UPSERT semantics for the in_progress sentinel row — mirrors the
+            // identically-shaped branch in `logAction` (lines 297-344). Callers
+            // (notably the morning-routine pipeline orchestrator) pre-insert a
+            // `result='in_progress'` row before spawning Stage A so the agent's
+            // `PATCH /api/agent-actions/self` can resolve and write structured
+            // metadata; without this branch a subsequent throw inside the same
+            // stage would leave the in_progress row orphaned AND emit a parallel
+            // `result='failed'` row, causing `loadMorningRoutineActionRows`
+            // (which picks the most-recent matching row) to read whichever
+            // landed last and producing misleading audit-trail entries. The
+            // UPDATE preserves the row's original `started_at` and `metadata`
+            // column so any agent-side PATCH writes that landed before the
+            // throw survive the settle.
+            //
+            // Lookup is `event_id IS ?` so a NULL correlationId matches a NULL
+            // row — same NULL-tolerant predicate `logAction` uses.
+            const inProgressId = this.findInProgressRowId(event.correlationId, event.type);
+            if (inProgressId !== null) {
+                const assignments = [];
+                const updateValues = [];
+                for (let i = 0; i < columns.length; i++) {
+                    const column = columns[i];
+                    // event_id / action_type / started_at are immutable on settle —
+                    // event_id/action_type are the lookup key; started_at was
+                    // captured at the pre-insert and IS the actual start time.
+                    if (column === "event_id" || column === "action_type")
+                        continue;
+                    if (column === "started_at")
+                        continue;
+                    if (column === "completed_at") {
+                        assignments.push(`${column} = datetime('now')`);
+                        continue;
+                    }
+                    if (column === "detail") {
+                        assignments.push(`${column} = json(?)`);
+                        updateValues.push(values[i]);
+                        continue;
+                    }
+                    assignments.push(`${column} = ?`);
+                    updateValues.push(values[i]);
+                }
+                try {
+                    this.db
+                        .prepare(`UPDATE agent_actions SET ${assignments.join(", ")} WHERE id = ?`)
+                        .run(...updateValues, inProgressId);
+                    this.emitInsertedRow(inProgressId, event.type);
+                    logger.error({ event: event.type, error: error.message }, "Event error");
+                    return;
+                }
+                catch (err) {
+                    // Fall through to INSERT on UPDATE failure (e.g. row was
+                    // garbage-collected between SELECT and UPDATE). Mirrors the
+                    // identical defensive fall-through in `logAction`.
+                    logger.warn({ err, event: event.type, inProgressId }, "in_progress row UPDATE in logError failed — falling back to INSERT");
+                }
+            }
             const placeholders = columns
                 .map((column) => {
                 if (column === "started_at")
@@ -510,4 +633,3 @@ export function bangStatusToResult(status) {
             return "skipped";
     }
 }
-//# sourceMappingURL=audit.js.map

package/dist/safety/integration-write-tracker.d.ts

@@ -55,4 +55,3 @@ export interface MarkIntegrationWriteOptions {
  * strictly preferable to surfacing a 500 to the user.
  */
 export declare function markIntegrationWrite(db: Database.Database, integration: IntegrationKey, itemId: string, opts?: MarkIntegrationWriteOptions): void;
-//# sourceMappingURL=integration-write-tracker.d.ts.map

package/dist/safety/integration-write-tracker.js

@@ -38,4 +38,3 @@ export function markIntegrationWrite(db, integration, itemId, opts = {}) {
         logger.warn({ err, integration, itemId }, "failed to mark integration write — next reconcile may attribute as user");
     }
 }
-//# sourceMappingURL=integration-write-tracker.js.map

package/dist/safety/outbound-purchase-guard.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Outbound-purchase-template guard — the daemon-internal chokepoint
+ * that refuses any agent-tool-originated outbound message carrying the
+ * §17.7 reserved structural markers.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7 / §13 step 54.
+ *
+ * The classifier (`automation/purchase-tokens.ts:classifyPurchaseConfirmationTemplate`)
+ * detects the markers. This module is the wiring layer that asserts /
+ * audits / refuses. Daemon-side outbound (the
+ * `purchase-system-message-sender` module) bypasses this guard because
+ * its `sendSystemMessage` requires the unforgeable handler capability.
+ *
+ * Wired in two places:
+ *   - POST /api/notify (the LLM's primary "send DM" route)
+ *   - The bang-command `notify()` wrapper (LLM-driven `!`-command
+ *     replies — defence-in-depth in case a future bang handler echoes
+ *     attacker-controlled content)
+ *
+ * The wrapper writes an `agent_actions` audit row on a match so an
+ * operator can see exactly which agent path tried to spoof.
+ */
+import type Database from "better-sqlite3";
+import { type PurchaseConfirmationTemplateMatch } from "../services/browser-history/automation/purchase-tokens.js";
+export declare class OutboundPurchaseTemplateError extends Error {
+    readonly match: PurchaseConfirmationTemplateMatch;
+    readonly origin: string;
+    constructor(match: PurchaseConfirmationTemplateMatch, origin: string);
+}
+export interface AuditOutboundRefusalInput {
+    db: Database.Database;
+    origin: string;
+    marker: string;
+    /** Truncated preview of the offending body — first 80 chars. NEVER
+     *  log the full message; an attacker-controlled body that smuggles a
+     *  legitimate-looking marker should not bloat the audit. */
+    preview: string;
+}
+/** Persist a structured `agent_actions` row so the dashboard's
+ *  "Recent agent activity" view surfaces the refusal. Best-effort —
+ *  a DB write failure is logged but never re-thrown (the caller's
+ *  refusal path is the load-bearing signal).
+ *
+ *  Implementation note: `result` is `'failed'` (not `'blocked'`) because
+ *  the `agent_actions.result` CHECK constraint only permits the canonical
+ *  settle states (success / failed / partial / skipped / in_progress).
+ *  A literal `'blocked'` would silently violate the constraint and the
+ *  try/catch would swallow the audit — losing every refusal row. The
+ *  `action_type='purchase_template_refused'` is the discriminator that
+ *  lets dashboards / queries distinguish this from a real agent failure.
+ *  Mirrors the `blocked_absolute` precedent in `absolute-block-audit.ts`. */
+export declare function auditOutboundRefusal(input: AuditOutboundRefusalInput): void;
+/**
+ * Throw `OutboundPurchaseTemplateError` if the message body carries a
+ * reserved marker. Pure-ish — when given a DB handle, also audits the
+ * refusal. The `origin` argument identifies which agent path is the
+ * caller (e.g., `"api.notify"`, `"bang.commands"`) so the audit row
+ * can pinpoint the surface that mis-routed.
+ */
+export declare function assertOutboundAllowedForAgent(body: string, origin: string, db?: Database.Database): void;

package/dist/safety/outbound-purchase-guard.js

@@ -0,0 +1,82 @@
+/**
+ * Outbound-purchase-template guard — the daemon-internal chokepoint
+ * that refuses any agent-tool-originated outbound message carrying the
+ * §17.7 reserved structural markers.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7 / §13 step 54.
+ *
+ * The classifier (`automation/purchase-tokens.ts:classifyPurchaseConfirmationTemplate`)
+ * detects the markers. This module is the wiring layer that asserts /
+ * audits / refuses. Daemon-side outbound (the
+ * `purchase-system-message-sender` module) bypasses this guard because
+ * its `sendSystemMessage` requires the unforgeable handler capability.
+ *
+ * Wired in two places:
+ *   - POST /api/notify (the LLM's primary "send DM" route)
+ *   - The bang-command `notify()` wrapper (LLM-driven `!`-command
+ *     replies — defence-in-depth in case a future bang handler echoes
+ *     attacker-controlled content)
+ *
+ * The wrapper writes an `agent_actions` audit row on a match so an
+ * operator can see exactly which agent path tried to spoof.
+ */
+import { createLogger } from "../logging.js";
+import { classifyPurchaseConfirmationTemplate, } from "../services/browser-history/automation/purchase-tokens.js";
+const logger = createLogger("outbound-purchase-guard");
+export class OutboundPurchaseTemplateError extends Error {
+    match;
+    origin;
+    constructor(match, origin) {
+        super(`outbound message refused — reserved purchase-template marker "${match.marker}" detected (origin=${origin})`);
+        this.match = match;
+        this.origin = origin;
+        this.name = "OutboundPurchaseTemplateError";
+    }
+}
+/** Persist a structured `agent_actions` row so the dashboard's
+ *  "Recent agent activity" view surfaces the refusal. Best-effort —
+ *  a DB write failure is logged but never re-thrown (the caller's
+ *  refusal path is the load-bearing signal).
+ *
+ *  Implementation note: `result` is `'failed'` (not `'blocked'`) because
+ *  the `agent_actions.result` CHECK constraint only permits the canonical
+ *  settle states (success / failed / partial / skipped / in_progress).
+ *  A literal `'blocked'` would silently violate the constraint and the
+ *  try/catch would swallow the audit — losing every refusal row. The
+ *  `action_type='purchase_template_refused'` is the discriminator that
+ *  lets dashboards / queries distinguish this from a real agent failure.
+ *  Mirrors the `blocked_absolute` precedent in `absolute-block-audit.ts`. */
+export function auditOutboundRefusal(input) {
+    try {
+        input.db
+            .prepare(`INSERT INTO agent_actions
+           (action_type, trigger, result, detail, completed_at, source_kind)
+         VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, ?)`)
+            .run("purchase_template_refused", input.origin, "failed", JSON.stringify({ marker: input.marker, preview: input.preview }), "agent");
+    }
+    catch (err) {
+        logger.warn({ err, origin: input.origin }, "failed to write purchase_template_refused audit row");
+    }
+}
+/**
+ * Throw `OutboundPurchaseTemplateError` if the message body carries a
+ * reserved marker. Pure-ish — when given a DB handle, also audits the
+ * refusal. The `origin` argument identifies which agent path is the
+ * caller (e.g., `"api.notify"`, `"bang.commands"`) so the audit row
+ * can pinpoint the surface that mis-routed.
+ */
+export function assertOutboundAllowedForAgent(body, origin, db) {
+    const match = classifyPurchaseConfirmationTemplate(body);
+    if (!match)
+        return;
+    if (db) {
+        auditOutboundRefusal({
+            db,
+            origin,
+            marker: match.marker,
+            preview: body.slice(0, 80),
+        });
+    }
+    logger.warn({ origin, marker: match.marker, preview: body.slice(0, 80) }, "outbound message refused — reserved purchase-template marker");
+    throw new OutboundPurchaseTemplateError(match, origin);
+}

package/dist/safety/risk-classifier.d.ts

@@ -47,10 +47,10 @@ export declare function classifyRisk(method: string, path: string): RiskTier;
  *
  * Why this exists: `API_RISK` is hand-maintained. When a developer adds
  * a new route in `routes/*.ts` but forgets to update the classifier
- * table, the request hits the runtime warning at line ~480 only after
- * the first call — and then 401s because Approve-tier requires a Bearer
- * the agent can't supply. We saw this with `POST /api/context/roadmap/id`
- * (7×401 + 4×400 retry spiral inside roadmap_refresh, 2026-04-28).
+ * table, the request hits the runtime warning only after the first call
+ * — and then 401s because Approve-tier requires a Bearer the agent can't
+ * supply, producing a user-visible retry spiral. The boot audit catches
+ * the omission before any traffic flows.
  *
  * Hono parameterized segments (`/integrations/:key/exec`) are
  * normalized to a representative literal so `{*}`-pattern entries in
@@ -78,4 +78,3 @@ export declare function auditRiskClassifications(routes: ReadonlyArray<Auditable
  * exact paths.
  */
 export declare function listReadSensitiveGetPathKeys(): readonly string[];
-//# sourceMappingURL=risk-classifier.d.ts.map