@aitne/daemon 0.1.8 → 0.1.9

package/dist/safety/risk-classifier.js

@@ -142,7 +142,151 @@ const API_RISK = {
     "GET /api/config/character": RiskTier.Autonomous,
     "PATCH /api/config/character": RiskTier.Autonomous,
     "/api/config": RiskTier.Approve,
+    "GET /api/browser-history/status": RiskTier.Approve,
+    "GET /api/browser-history/research-clusters": RiskTier.Autonomous,
+    "GET /api/browser-history/research-clusters/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/yesterday-summary": RiskTier.Autonomous,
+    // BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a — pre-morning digest
+    // JSON endpoint. Read-only; serves the same Zod-validated shape the
+    // morning Stage B journal already reads from the markdown sidecar.
+    // No raw URLs / titles in the response (Layer 1 invariant), so
+    // Autonomous like the rest of the browser-history read surface.
+    "GET /api/browser-history/pre-morning-digest/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/shopping/{*}": RiskTier.Autonomous,
+    "GET /api/browser-history/reloads/today": RiskTier.Autonomous,
+    "GET /api/browser-history/reloads/weekly": RiskTier.Autonomous,
+    // BROWSER_HISTORY_INTEGRATION_PLAN P3 — engagement offers.
+    // Reads (`/offers/pending`) are autonomous; the agent surfaces open
+    // offers in the morning digest. Accept (`POST /offers/{*}/accept`)
+    // queues a process-key dispatch one step removed from external
+    // research / wiki writes — ReadSensitive so the dashboard's bearer
+    // is enforced but the agent's curl from the session workdir still
+    // works (the route enforces token presence via the same middleware
+    // as other ReadSensitive endpoints). Decline and mute are
+    // autonomous DB updates.
+    "GET /api/browser-history/offers/pending": RiskTier.Autonomous,
+    "POST /api/browser-history/offers/{*}/accept": RiskTier.ReadSensitive,
+    "POST /api/browser-history/offers/{*}/decline": RiskTier.Autonomous,
+    "POST /api/browser-history/offers/{*}/mute": RiskTier.Autonomous,
+    // Agent write-back after `routine.research_wiki_summary` successfully
+    // writes the wiki note. Stamps `wikiSummaryWrittenAt`; the only
+    // mutation is on the cluster row the agent is already permitted to
+    // read. Autonomous so the agent's curl from the session workdir works
+    // without a bearer.
+    "POST /api/browser-history/research-clusters/{*}/wiki-written": RiskTier.Autonomous,
+    // ── WEEKLY_INTERESTS_REFLECTION_PLAN.md §17 ──
+    // GET summary is read-only aggregate over cluster data; no PII / URL
+    // / title content surfaces. Same risk profile as `/research-clusters`.
+    "GET /api/browser-history/weekly-interests-summary": RiskTier.Autonomous,
+    // POST refresh / cleanup are dashboard-only — bearer-token-
+    // authenticated. Neither is listed in any skill's `allowed-tools`, so
+    // no LLM can call them; the scheduler invokes the same logic via a
+    // direct function call inside `dispatcher-scheduled-tasks.ts`'s
+    // pre-hook, bypassing the HTTP layer. Approve tier documents the
+    // bearer requirement and produces an audit row distinct from the
+    // autonomous-tier reflection runs.
+    "POST /api/browser-history/refresh-interests-reflection": RiskTier.Approve,
+    "POST /api/browser-history/cleanup-interests-reflection": RiskTier.Approve,
+    // ── Managed Chromium (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.10) ──
+    // The dashboard control surface for the managed Chromium Instance S.
+    // Reads (`status`, `setup-status`) are Autonomous so the dashboard
+    // status badge can poll without a bearer. Mutations that destroy
+    // state (`disconnect`, `enable=false`) are Approve. Mutations that
+    // spawn a UI Chromium for the user to type credentials into
+    // (`setup`, `setup-finish`, `reconnect`) are ReadSensitive: the
+    // dashboard's bearer auth is required, but the agent never reaches
+    // these routes (the skill body forbids them and the route layer's
+    // tier guard short-circuits before any DB mutation).
+    "GET /api/browser-history/managed/status": RiskTier.Autonomous,
+    "POST /api/browser-history/managed/setup": RiskTier.ReadSensitive,
+    "GET /api/browser-history/managed/setup-status": RiskTier.Autonomous,
+    "POST /api/browser-history/managed/setup-finish": RiskTier.ReadSensitive,
+    "POST /api/browser-history/managed/reconnect": RiskTier.ReadSensitive,
+    "POST /api/browser-history/managed/disconnect": RiskTier.Approve,
+    "POST /api/browser-history/managed/enable": RiskTier.Approve,
+    // Opt-in Playwright Chromium download. Approve-tier because the
+    // install touches the network and writes ~150 MiB into the user's
+    // Playwright cache — an autonomous agent must not trigger this on
+    // its own. The status sibling is autonomous-safe (read-only state).
+    "POST /api/browser-history/managed/install-chromium": RiskTier.Approve,
+    "GET /api/browser-history/managed/install-chromium/status": RiskTier.Autonomous,
+    // ── Browser Automation Sites (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.9) ──
+    // Phase B-2.5 per-site sign-in surface. Reads (`sites`,
+    // `sites/{*}/status`) are Autonomous so the dashboard's per-site
+    // card can poll without a bearer; the agent's auth-variant
+    // workflows also call `GET /sites` to discover whether the user
+    // has connected the site they need. Every mutation
+    // (`connect` / `finalize` / `reauth` / `disconnect`) is Approve —
+    // sign-in spawns a UI Chromium the user types credentials into, and
+    // the connect / reauth payloads change the persistent profile dir.
+    // The agent cannot trigger these (skill body forbids them; the
+    // route layer's tier guard short-circuits before any DB mutation).
+    "GET /api/browser-automation/sites": RiskTier.Autonomous,
+    "POST /api/browser-automation/sites/{*}/connect": RiskTier.Approve,
+    "GET /api/browser-automation/sites/{*}/status": RiskTier.Autonomous,
+    "POST /api/browser-automation/sites/{*}/finalize": RiskTier.Approve,
+    "POST /api/browser-automation/sites/{*}/reauth": RiskTier.Approve,
+    "POST /api/browser-automation/sites/{*}/disconnect": RiskTier.Approve,
+    // ── Browser Automation Purchase (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.10) ──
+    // Phase B-4 experimental purchase surface. Token issuance is
+    // daemon-internal — there is NO `POST /purchase-tokens` route. The
+    // dashboard list endpoint is `Approve` rather than `Autonomous`
+    // because a token list reveals every in-flight purchase intent
+    // (site, displayed total, originating channels), and the agent has
+    // no legitimate path to read it (the workflow already holds the
+    // jti it minted for its own awaitReply polling). The DELETE path is
+    // dashboard-only (user "Cancel pending" button); the agent cannot
+    // cancel another workflow's token.
+    "GET /api/browser-automation/purchase-tokens": RiskTier.Approve,
+    "DELETE /api/browser-automation/purchase-tokens/{*}": RiskTier.Approve,
+    // Global master toggle. Read is Autonomous so the dashboard can poll
+    // status without a bearer; flipping is Approve (bearer-required).
+    "GET /api/browser-automation/b4/enabled": RiskTier.Autonomous,
+    "POST /api/browser-automation/b4/enabled": RiskTier.Approve,
+    // Per-site config + primary-channel selection — dashboard-only.
+    "GET /api/browser-automation/b4/site-configs": RiskTier.Autonomous,
+    "PATCH /api/browser-automation/sites/{*}/b4-config": RiskTier.Approve,
+    "GET /api/browser-automation/b4/primary-channels": RiskTier.Autonomous,
+    "PATCH /api/browser-automation/channels/{*}/{*}/primary": RiskTier.Approve,
+    // ── Browser Task (BROWSER_TASK_REDESIGN_PLAN.md §3) ──
+    // Open-ended natural-language browser sub-agent surface. POST is
+    // Autonomous — the only production caller today is the DM-agent
+    // `browser-task` skill, whose curl shim carries only `x-read-token`
+    // (sufficient for ReadSensitive, never enough for Approve). The
+    // historical Approve tier here assumed a Phase 2 "DM-agent adapter
+    // holds the dashboard bearer" path that was never wired, producing
+    // a 401 on every DM-driven dispatch. Matching the sibling agent-
+    // driven write paths (clarify + cancel, both Autonomous) keeps the
+    // surface coherent. Defense-in-depth that actually matters lives
+    // downstream and is independent of the API auth tier:
+    //   1. Host-header loopback gate + sec-fetch-site / origin checks
+    //      in `evaluateLoopbackBrowserGate` — CSRF protection survives
+    //      at Autonomous (only same-origin POSTs from the dashboard's
+    //      loopback origin reach the handler).
+    //   2. `x-pa-channel-ref` attestation against `listPrimaryChannels()`
+    //      inside the POST handler — a request whose channel is out of
+    //      the primary set is silently downgraded with a
+    //      `browser_task_channel_override` audit row.
+    //   3. Per-task global cap, user-curated `browserTaskHostnameDenylist`,
+    //      hardcoded payment-path block, and the B-4 final-confirm
+    //      token gate inside the runner.
+    //   4. Every dispatched task surfaces to the user via DM — there is
+    //      no covert dispatch path. A future dashboard re-run button
+    //      that calls this endpoint will still authenticate via Bearer
+    //      because the dashboard proxy attaches one by default; the
+    //      tier change only affects what's required, not what's offered.
+    // The list / detail / events / screenshot reads stay ReadSensitive
+    // because the task description + action log can carry personal
+    // context (account ids, free-text intent).
+    "POST /api/browser-task": RiskTier.Autonomous,
+    "GET /api/browser-task": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}/events": RiskTier.ReadSensitive,
+    "GET /api/browser-task/{*}/screenshots/{*}": RiskTier.ReadSensitive,
+    "POST /api/browser-task/{*}/clarify": RiskTier.Autonomous,
+    "POST /api/browser-task/{*}/cancel": RiskTier.Autonomous,
     "/api/setup": RiskTier.Approve,
+    "POST /api/setup/redetect-browsers": RiskTier.Approve,
     // Management Mode Phase 2 — migration endpoint. Redundant with the
     // /api/setup prefix rule above (which already hits Approve) but named
     // explicitly so future refactors of the setup-tier rules don't
@@ -182,6 +326,29 @@ const API_RISK = {
     // the dashboard-issued bearer (which agents don't have). Output is
     // redacted via secret-redaction before serialization.
     "GET /api/agent/actions": RiskTier.Autonomous,
+    // ── Agent Definitions (AGENT_DEFINITIONS_DESIGN.md §9.7) ──
+    // Reads + run-now are Autonomous: the list/detail/executions surface is
+    // structural metadata about the agent's own scheduled identities (no PII
+    // beyond what /api/schedule already exposes), and run-now enqueues a single
+    // `agent_schedule` row the agent could already create via the schedule skill
+    // (system-Agent run-now additionally DMs the owner in-handler — the §9.7
+    // Notify convention, since the RiskTier enum has no Notify value). PATCH /
+    // DELETE are Approve: they change `enabled` state / config overrides / delete
+    // user Agents, and the stop-warning ack is the explicit consent surface, so
+    // the dashboard's bearer token is required. `{*}` matches the `:slug`
+    // segment; the executions + run-now patterns carry an extra trailing literal.
+    // POST /api/agents (create) is Autonomous: it is the agent-facing replacement
+    // for the now-410 `POST /api/recurring-schedules` (also Autonomous) — the
+    // `agent-create` skill teaches the DM agent to create a recurring Agent for an
+    // ongoing cadence, the same recurring-task capability it already had. The
+    // loader rejects a one_shot/event definition; planCreate validates the rest.
+    "GET /api/agents": RiskTier.Autonomous,
+    "POST /api/agents": RiskTier.Autonomous,
+    "GET /api/agents/{*}": RiskTier.Autonomous,
+    "GET /api/agents/{*}/executions": RiskTier.Autonomous,
+    "POST /api/agents/{*}/run-now": RiskTier.Autonomous,
+    "PATCH /api/agents/{*}": RiskTier.Approve,
+    "DELETE /api/agents/{*}": RiskTier.Approve,
     // ── Wiki Builder (WIKI_BUILDER_DESIGN.md Phase 1) ──
     // Dashboard workspace settings stay owner-only. Agent-callable file,
     // search, and index routes are Autonomous at middleware level but enforce
@@ -216,47 +383,47 @@ const API_RISK = {
     // ── Context File API ──
     // GET reads contain personal notes, schedule, user profile — ReadSensitive.
     // Writes remain Autonomous (agent's own memory operations).
+    //
+    // CONTEXT_VAULT_REDESIGN_PLAN.md §7.1 — after the six-class restructure
+    // the per-path entries collapse to one row per class prefix. Legacy
+    // URLs (e.g. `PUT /api/context/today.md`) are normalised by the
+    // in-process alias resolver before reaching the classifier, so only
+    // canonical paths need to be enumerated here.
     "GET /api/context": RiskTier.ReadSensitive,
     "PUT /api/context/": RiskTier.Autonomous,
     "PATCH /api/context/": RiskTier.Autonomous,
-    "PUT /api/context/today": RiskTier.Autonomous,
-    "PATCH /api/context/today": RiskTier.Autonomous,
-    "PUT /api/context/tomorrow": RiskTier.Autonomous,
-    "PATCH /api/context/tomorrow": RiskTier.Autonomous,
-    // B-007 §5.1 — user profile lives at user/profile.md, area files under user/*.md.
-    "PUT /api/context/user/": RiskTier.Autonomous,
-    "PATCH /api/context/user/": RiskTier.Autonomous,
-    // B-007 §5.1 — management rules moved from context/management-rules.md to
-    // context/rules/management.md; mcp / journal-format / journal-export /
-    // redaction rules are Autonomous (post-Notify-abolition) — agent edits its
-    // own session-shaping rules, on-demand retrospective covers awareness.
-    "PUT /api/context/rules/": RiskTier.Autonomous,
-    "PATCH /api/context/rules/": RiskTier.Autonomous,
-    "PATCH /api/context/roadmap": RiskTier.Autonomous,
-    // Pure-utility ID minter — reads existing IDs, generates a fresh one.
-    // No write side-effect; the route's own write-lock guard handles
-    // concurrent-mint protection. Without this entry the call defaulted
-    // to Approve (fail-closed) and roadmap_refresh's task-flow Step 4.1
-    // collapsed onto fabricated placeholder IDs that then failed PUT
-    // validation with `Malformed roadmap id marker`.
-    "POST /api/context/roadmap/id": RiskTier.Autonomous,
-    "PUT /api/context/projects": RiskTier.Autonomous,
-    "PATCH /api/context/projects": RiskTier.Autonomous,
-    "PUT /api/context/weekly": RiskTier.Autonomous,
-    // B-007 §5.9 — day rotation endpoint (today.md → yesterday.md; synthesized
-    // daily/YYYY-MM-DD.md is written by the morning routine, not this path).
+    // identity/ ← user profile + area files
+    "PUT /api/context/identity/": RiskTier.Autonomous,
+    "PATCH /api/context/identity/": RiskTier.Autonomous,
+    // state/ — today, yesterday, scratch, inbox, activity, profile questions
+    "PUT /api/context/state/": RiskTier.Autonomous,
+    "PATCH /api/context/state/": RiskTier.Autonomous,
+    "DELETE /api/context/state/": RiskTier.Autonomous,
+    // plans/ — roadmap + projects
+    "PUT /api/context/plans/": RiskTier.Autonomous,
+    "PATCH /api/context/plans/": RiskTier.Autonomous,
+    // Pure-utility ID minter for the new plans/roadmap path. Reads
+    // existing IDs, generates a fresh one. No write side-effect.
+    "POST /api/context/plans/roadmap/id": RiskTier.Autonomous,
+    // policies/ — management, mcp, redaction, journal-format/-export,
+    // integrations.md, management-captures, routines, skills
+    "PUT /api/context/policies/": RiskTier.Autonomous,
+    "PATCH /api/context/policies/": RiskTier.Autonomous,
+    // DELETE on policies/ is intentionally scoped to routines/custom/*
+    // only — policy captures preserve `status: removed` rather than
+    // physically deleting, so blanket policies/ DELETE would defeat the
+    // §4.6 / §5.1 audit invariant. Custom routines have their own
+    // explicit route entry below.
+    "DELETE /api/context/policies/routines/custom/": RiskTier.Autonomous,
+    // journal/ — append-only narrative.
+    "PUT /api/context/journal/": RiskTier.Autonomous,
+    "PATCH /api/context/journal/": RiskTier.Autonomous,
+    // knowledge/ — dossiers, entities, wiki, repos.
+    "PUT /api/context/knowledge/": RiskTier.Autonomous,
+    "PATCH /api/context/knowledge/": RiskTier.Autonomous,
+    // Day rotation endpoint (today.md → yesterday.md; synthesized
+    // journal/daily/YYYY-MM-DD.md is written by the morning routine).
     "POST /api/context/archive-today": RiskTier.Autonomous,
-    // B-007 §5.8 — routines/<cadence>.md and routines/custom/<slug>.md
-    // shape scheduled behavior; Autonomous (matches rules tier).
-    "PUT /api/context/routines/": RiskTier.Autonomous,
-    "PATCH /api/context/routines/": RiskTier.Autonomous,
-    "DELETE /api/context/routines/": RiskTier.Autonomous,
-    // B-007 §5.9 — synthesized daily journal path is Autonomous (agent-owned output).
-    "PUT /api/context/daily/": RiskTier.Autonomous,
-    "PATCH /api/context/daily/": RiskTier.Autonomous,
-    // B-007 §5.1 — agent/journal.md (self-reflection) is agent-only.
-    "PUT /api/context/agent/": RiskTier.Autonomous,
-    "PATCH /api/context/agent/": RiskTier.Autonomous,
     "GET /api/context/list": RiskTier.ReadSensitive,
     // B-008 P7 — Vault Health surface. `health` returns a structural drift
     // report (no user prose), so Autonomous. `repair/stub` copies a template
@@ -413,9 +580,6 @@ const API_RISK = {
     "GET /api/receipts/summary": RiskTier.ReadSensitive,
     "POST /api/receipts/": RiskTier.ReadSensitive, // binary receipt download
     "PATCH /api/receipts/": RiskTier.Approve,
-    // ── Travel Time (Phase B) ──
-    "GET /api/travel-time": RiskTier.Autonomous,
-    "GET /api/travel-time/for-event/": RiskTier.Autonomous,
     // ── Books & Reading (Phase C, F-10) ──
     "GET /api/books": RiskTier.ReadSensitive,
     "GET /api/books/": RiskTier.ReadSensitive,
@@ -481,23 +645,12 @@ const API_RISK = {
     // misuse can falsify the cached features map until the next live probe
     // overwrites it. Same trust level as the mode flip above.
     "POST /api/integrations/{*}/probe": RiskTier.Approve,
-    // RESERVED — POST /api/integrations/{*}/invoke
-    //
-    // The route handler was retired 2026-05-01 (/exec-only migration) and
-    // the stub file `routes/integrations/invoke.ts` was removed in the
-    // api-route-decomposition.md PR-5 follow-up. The dormant handler body
-    // lives in git history (`git log -- packages/daemon/src/api/routes/integrations.ts`
-    // before the split, then `git log -- packages/daemon/src/api/routes/integrations/invoke.ts`
-    // before its removal). Risk-classifier entries are keyed on the route
-    // pattern, and a request to an unmounted route never reaches this map.
-    // The classification is preserved here so a future reactivation lands
-    // back at the same tier without re-deriving it.
-    //
-    // Original rationale: Autonomous — the agent calls freely from
-    // cross-backend skill prose, and the user's `deniedTools` setting is
-    // the chokepoint enforced inside the handler. Approve is reserved
-    // for daemon-config posture changes (§4.5.2); tool-level safety
-    // stays at the deny list.
+    // RESERVED — POST /api/integrations/{*}/invoke. The route is unmounted
+    // today (superseded by /exec). The classification is preserved
+    // commented-out so a future reactivation lands back at Autonomous tier
+    // without re-deriving the rationale: the agent calls freely from
+    // cross-backend skill prose and the user's `deniedTools` is the
+    // chokepoint; Approve is reserved for daemon-config posture changes.
     // "POST /api/integrations/{*}/invoke": RiskTier.Autonomous,
     // delegated-sync opt-in surface
     // (docs/design/appendices/delegated-sync-opt-in.md). Approve tier:
@@ -529,19 +682,12 @@ const API_RISK = {
     // `/api/integrations/{*}/exec` (Autonomous), where the integration's
     // user-curated deny list is the safety floor.
     "POST /api/delegated/run": RiskTier.Approve,
-    // ── Admin / dashboard surfaces (post-audit baseline 2026-04-29) ──
-    // Until `auditRiskClassifications` landed, every entry below would
-    // fall through to the conservative Approve default. The audit then
-    // surfaced 33 such routes at boot — useful as a one-time triage but
-    // noisy as a recurring warning. Listing each surface explicitly
-    // here pins the audit's fingerprint to "0 unclassified" so a single
-    // future regression (the next `roadmap/id`-style oversight) shows
-    // up as exactly one new line, not buried in a 33-row baseline.
-    //
-    // Every entry is Approve by intent (not by default fallback). None
-    // of these routes are agent-callable: secrets / messaging-pairing /
-    // backend-config / dashboard polling are all Bearer-gated UI or
-    // admin operations.
+    // ── Admin / dashboard surfaces ──
+    // Routes below are Approve by intent, not by fallback. Pinning them
+    // explicitly keeps `auditRiskClassifications` at zero so a future
+    // regression surfaces as exactly one new line. None are agent-callable:
+    // secrets / messaging-pairing / backend-config / dashboard polling are
+    // all Bearer-gated UI or admin operations.
     // Snapshot restore — rollback via dashboard.
     "POST /api/context/restore-snapshot/": RiskTier.Approve,
     // Catch-all DELETE under /api/context. Retention sweeps for daily/
@@ -587,7 +733,7 @@ const API_RISK = {
     "GET /api/dashboard/dm-freshness": RiskTier.Approve,
     // Activity tab read-mirror (Memory → Activity). Dashboard-only — surfaces
     // the wider activity-source union used by the runner so the UI can flag
-    // recently-stopped tasks whose `_activity/<source>.md` is still on disk
+    // recently-stopped tasks whose `state/activity/<source>.md` is still on disk
     // for the 90-day window. Not agent-callable; same Approve tier as the
     // rest of the dashboard read surfaces.
     "GET /api/activity-sources": RiskTier.Approve,
@@ -826,6 +972,18 @@ function literalPrefixLength(key) {
     return idx < 0 ? key.length : idx;
 }
 /* c8 ignore stop */
+/** Strip a trailing `{*}` placeholder from `path` so callers can
+ *  substring-match user skill bodies against the literal prefix. No
+ *  ReadSensitive entry carries `{*}` today (only the Autonomous /
+ *  Approve ones do), so the truthy branch is currently unreachable;
+ *  preserved for future paths and parked out of the coverage gate. */
+/* c8 ignore start */
+function stripWildcardSuffix(path) {
+    return path.includes("{*}")
+        ? path.slice(0, path.indexOf("{*}")).replace(/\/+$/, "")
+        : path;
+}
+/* c8 ignore stop */
 /**
  * Return every `/api/*` path that `API_RISK` classifies as
  * `RiskTier.ReadSensitive` for GET requests, with `{*}` placeholders
@@ -846,20 +1004,20 @@ export function listReadSensitiveGetPathKeys() {
     for (const [key, tier] of Object.entries(API_RISK)) {
         if (tier !== RiskTier.ReadSensitive)
             continue;
+        // Every ReadSensitive entry in `API_RISK` today carries an explicit
+        // "METHOD /api/path" prefix, so the methodless / non-/api/ branches
+        // are defensive and currently unreachable.
         const hasMethod = key.includes(" ");
-        const method = hasMethod ? key.split(" ")[0] : "GET";
-        const path = hasMethod ? key.split(" ")[1] : key;
-        if (method !== "GET")
+        const method = hasMethod ? key.split(" ")[0] : /* c8 ignore next */ "GET";
+        const path = hasMethod ? key.split(" ")[1] : /* c8 ignore next */ key;
+        if (method !== "GET") /* c8 ignore next */
             continue;
-        if (!path.startsWith("/api/"))
+        if (!path.startsWith("/api/")) /* c8 ignore next */
             continue;
         // Strip `{*}` placeholders to the literal prefix so callers can
         // substring-match user skill bodies against it.
-        const literalPrefix = path.includes("{*}")
-            ? path.slice(0, path.indexOf("{*}")).replace(/\/+$/, "")
-            : path;
+        const literalPrefix = stripWildcardSuffix(path);
         out.add(literalPrefix);
     }
     return [...out].sort();
 }
-//# sourceMappingURL=risk-classifier.js.map

package/dist/safety/subprocess-block-scanner.d.ts

@@ -86,4 +86,3 @@ export declare function auditStreamObservation(candidate: {
     toolName: string;
     arg: string;
 }, deps: StreamObservationDeps): AbsoluteBlockMatch | null;
-//# sourceMappingURL=subprocess-block-scanner.d.ts.map

package/dist/safety/subprocess-block-scanner.js

@@ -174,4 +174,3 @@ export function auditStreamObservation(candidate, deps) {
     });
     return match;
 }
-//# sourceMappingURL=subprocess-block-scanner.js.map

package/dist/scheduler/hourly-check-gate.d.ts

@@ -84,4 +84,3 @@ export declare function renderGateDecisionBlock(decision: HourlyCheckGateDecisio
     forced?: boolean;
     cautiousEscalate?: boolean;
 }): string;
-//# sourceMappingURL=hourly-check-gate.d.ts.map

package/dist/scheduler/hourly-check-gate.js

@@ -130,4 +130,3 @@ function serializeHours(value) {
         return null;
     return Number(value.toFixed(2));
 }
-//# sourceMappingURL=hourly-check-gate.js.map

package/dist/secrets/backend-api-key-env.d.ts

@@ -101,4 +101,3 @@ export declare function describeBackendApiKey(broker: SecretBroker, backendId: B
     provider: ApiKeyProvider | null;
     envVarNames: readonly string[];
 }>;
-//# sourceMappingURL=backend-api-key-env.d.ts.map

package/dist/secrets/backend-api-key-env.js

@@ -195,4 +195,3 @@ export async function describeBackendApiKey(broker, backendId, env = process.env
         envVarNames: legacyEnvVarNames,
     };
 }
-//# sourceMappingURL=backend-api-key-env.js.map

package/dist/secrets/codex-home-materializer.d.ts

@@ -32,4 +32,3 @@ export declare function materializeCodexAzureConfig(dataDir: string, config: Azu
  * not thrown.
  */
 export declare function clearCodexAzureConfig(dataDir: string): void;
-//# sourceMappingURL=codex-home-materializer.d.ts.map

package/dist/secrets/codex-home-materializer.js

@@ -73,4 +73,3 @@ export function clearCodexAzureConfig(dataDir) {
         // Non-empty or already-gone — both fine.
     }
 }
-//# sourceMappingURL=codex-home-materializer.js.map

package/dist/secrets/encrypted-blob-store.d.ts

@@ -17,4 +17,3 @@ export declare class FileEncryptedBlobStore implements EncryptedBlobStore {
     private getOrCreateMasterKey;
     private getBlobPath;
 }
-//# sourceMappingURL=encrypted-blob-store.d.ts.map

package/dist/secrets/encrypted-blob-store.js

@@ -77,4 +77,3 @@ export class FileEncryptedBlobStore {
         return join(this.rootDir, `${name}.enc`);
     }
 }
-//# sourceMappingURL=encrypted-blob-store.js.map

package/dist/secrets/platform-secret-store.d.ts

@@ -14,4 +14,3 @@ export declare class PlatformSecretStore implements SecretStore {
     set(name: StoredSecretName, value: string): Promise<void>;
     delete(name: StoredSecretName): Promise<void>;
 }
-//# sourceMappingURL=platform-secret-store.d.ts.map

package/dist/secrets/platform-secret-store.js

@@ -34,4 +34,3 @@ export class PlatformSecretStore {
         await client.delete(name);
     }
 }
-//# sourceMappingURL=platform-secret-store.js.map

package/dist/secrets/redaction.d.ts

@@ -1,2 +1 @@
 export { redactSensitiveString as redactString, SENSITIVE_KEY_PATTERN, } from "@aitne/shared";
-//# sourceMappingURL=redaction.d.ts.map

package/dist/secrets/redaction.js

@@ -1,2 +1 @@
 export { redactSensitiveString as redactString, SENSITIVE_KEY_PATTERN, } from "@aitne/shared";
-//# sourceMappingURL=redaction.js.map

package/dist/secrets/secret-broker.d.ts

@@ -42,7 +42,6 @@ export declare class SecretBroker {
     getGoogleCredentialsJson(): Promise<string | null>;
     getGoogleTokenJson(): Promise<string | null>;
     saveGoogleTokenJson(json: string): Promise<void>;
-    getGoogleMapsApiKey(): Promise<string | null>;
     getAppleCalendarCredentialsJson(): Promise<string | null>;
     saveAppleCalendarCredentialsJson(json: string): Promise<void>;
     deleteAppleCalendarCredentials(): Promise<void>;
@@ -58,4 +57,3 @@ export declare class SecretBroker {
     getBackendApiKeyConfig(backendId: BackendId): Promise<BackendApiKeyConfig | null>;
     setBackendApiKeyConfig(backendId: BackendId, config: BackendApiKeyConfig): Promise<void>;
 }
-//# sourceMappingURL=secret-broker.d.ts.map

package/dist/secrets/secret-broker.js

@@ -115,9 +115,6 @@ export class SecretBroker {
     saveGoogleTokenJson(json) {
         return this.set("googleTokenJson", json);
     }
-    getGoogleMapsApiKey() {
-        return this.get("googleMapsApiKey");
-    }
     getAppleCalendarCredentialsJson() {
         return this.get("appleCalendarCredentials");
     }
@@ -157,4 +154,3 @@ export class SecretBroker {
         return this.setBackendApiKey(backendId, serializeBackendApiKeyConfig(config));
     }
 }
-//# sourceMappingURL=secret-broker.js.map

package/dist/secrets/secret-names.d.ts

@@ -1,4 +1,4 @@
-export declare const SECRET_NAMES: readonly ["apiToken", "slackBotToken", "slackAppToken", "telegramBotToken", "discordBotToken", "notionApiKey", "githubToken", "githubWebhookSecret", "googleCredentialsJson", "googleTokenJson", "googleMapsApiKey", "appleCalendarCredentials"];
+export declare const SECRET_NAMES: readonly ["apiToken", "slackBotToken", "slackAppToken", "telegramBotToken", "discordBotToken", "notionApiKey", "githubToken", "githubWebhookSecret", "googleCredentialsJson", "googleTokenJson", "appleCalendarCredentials"];
 export type SecretName = (typeof SECRET_NAMES)[number];
 export declare const INTERNAL_SECRET_NAMES: readonly ["encryptedBlobMasterKey", "skillCurationRunTokenKey"];
 export type InternalSecretName = (typeof INTERNAL_SECRET_NAMES)[number];
@@ -31,4 +31,3 @@ export declare function isScopedSecretName(value: string): value is ScopedSecret
 export declare function scopedSecretName(family: "git.account", scope: string): ScopedSecretName;
 /** Build the keychain name for a backend's stored provider API key. */
 export declare function backendApiKeySecretName(backendId: string): ScopedSecretName;
-//# sourceMappingURL=secret-names.d.ts.map

package/dist/secrets/secret-names.js

@@ -9,7 +9,6 @@ export const SECRET_NAMES = [
     "githubWebhookSecret",
     "googleCredentialsJson",
     "googleTokenJson",
-    "googleMapsApiKey",
     "appleCalendarCredentials",
 ];
 export const INTERNAL_SECRET_NAMES = [
@@ -36,4 +35,3 @@ export function scopedSecretName(family, scope) {
 export function backendApiKeySecretName(backendId) {
     return `backend.${backendId}.api_key`;
 }
-//# sourceMappingURL=secret-names.js.map

package/dist/secrets/secret-store.d.ts

@@ -5,4 +5,3 @@ export interface SecretStore {
     set(name: StoredSecretName, value: string): Promise<void>;
     delete(name: StoredSecretName): Promise<void>;
 }
-//# sourceMappingURL=secret-store.d.ts.map

package/dist/secrets/secret-store.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=secret-store.js.map

package/dist/secrets/types.d.ts

@@ -4,4 +4,3 @@ export interface SecretCacheEntry {
     value: string | null;
     expiresAt: number;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/secrets/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/services/apple-calendar/caldav-client.d.ts

@@ -45,4 +45,3 @@ export interface CalDavClient {
  * failure so callers can surface 401 via the credentials-test endpoint.
  */
 export declare function createICloudCalDavClient(credentials: AppleCalendarCredentials): Promise<CalDavClient>;
-//# sourceMappingURL=caldav-client.d.ts.map

package/dist/services/apple-calendar/caldav-client.js

@@ -83,4 +83,3 @@ export async function createICloudCalDavClient(credentials) {
         },
     };
 }
-//# sourceMappingURL=caldav-client.js.map

package/dist/services/apple-calendar/caldav-codec.d.ts

@@ -64,4 +64,3 @@ export declare function applyUpdateToIcs(originalIcs: string, params: UpdateEven
  * inspector — purely cosmetic.
  */
 export declare function generateUid(): string;
-//# sourceMappingURL=caldav-codec.d.ts.map

package/dist/services/apple-calendar/caldav-codec.js

@@ -338,4 +338,3 @@ function isoToIcalTime(value, isDate) {
 export function generateUid() {
     return `${globalThis.crypto.randomUUID()}@personal-agent`;
 }
-//# sourceMappingURL=caldav-codec.js.map

package/dist/services/apple-calendar/index.d.ts

@@ -1,3 +1,2 @@
 export { AppleCalendarService, EventNotFoundError, RecurringInstanceUnsupportedError } from "./service.js";
 export type { AppleCalendarCredentials, AppleCalendarEvent, AppleCalendarListEntry, CreateEventParams, FreeBusyResult, UpdateEventParams, } from "./types.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/services/apple-calendar/index.js

@@ -1,2 +1 @@
 export { AppleCalendarService, EventNotFoundError, RecurringInstanceUnsupportedError } from "./service.js";
-//# sourceMappingURL=index.js.map

package/dist/services/apple-calendar/service.d.ts

@@ -72,4 +72,3 @@ export declare class AppleCalendarService {
      */
     private resolveUid;
 }
-//# sourceMappingURL=service.d.ts.map

package/dist/services/apple-calendar/service.js

@@ -371,4 +371,3 @@ export class AppleCalendarService {
         return this.uidIndex.get(uid) ?? null;
     }
 }
-//# sourceMappingURL=service.js.map

package/dist/services/apple-calendar/types.d.ts

@@ -75,4 +75,3 @@ export interface FreeBusyResult {
         }>;
     }>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/services/apple-calendar/types.js

@@ -14,4 +14,3 @@
  *   hold them.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/services/attachments/hardlink.d.ts

@@ -8,4 +8,3 @@
 export declare function hardLinkOrCopy(src: string, dst: string): void;
 /** Test-only reset hook. */
 export declare function resetHardLinkLogCache(): void;
-//# sourceMappingURL=hardlink.d.ts.map