@aitne/daemon 0.1.9 → 0.1.11

package/dist/core/signal-detector.d.ts

@@ -1,3 +1,4 @@
+import type Database from "better-sqlite3";
 import type { AgentConfig } from "../config.js";
 /**
  * Raw signal entry that gets appended to user/profile.md ## Raw Signals section.
@@ -31,6 +32,7 @@ interface RawSignal {
  */
 export declare class SignalDetector {
     private readonly config;
+    private readonly deps;
     /** Track pending notifications for ignore detection */
     private readonly pendingNotifications;
     /** Rolling dedup cache: signal key → expiry timestamp */
@@ -41,7 +43,9 @@ export declare class SignalDetector {
     private ignoreCheckInterval;
     /** API base URL for Context File API (self-referencing) */
     private readonly apiBaseUrl;
-    constructor(config: AgentConfig);
+    constructor(config: AgentConfig, deps?: {
+        db?: Database.Database;
+    });
     /** Start the signal detector (periodic ignore check) */
     start(): void;
     /** Stop the signal detector */
@@ -67,9 +71,33 @@ export declare class SignalDetector {
      */
     onUserMessage(params: {
         platform: string;
+        channel?: string;
         content: string;
         responseToNotificationId?: string;
     }): void;
+    /**
+     * Record a positive action correlated with a notification. This is the
+     * narrow "acted" path: callers must have an actual task/action observation,
+     * never silence, before invoking it.
+     *
+     * NOTE — intentional Phase-1.5 seam, no production caller yet (by design).
+     * Firing `acted` deterministically needs the notification's subject
+     * `(source, ref)` in `pendingNotifications` to match a later observation,
+     * but that subject never reaches `trackNotification`: entity-related
+     * proactive DMs are re-authored by an agent turn and delivered via
+     * `POST /api/agent/notify`, which carries only message/platform/priority
+     * (no subject), and the direct `NotificationManager.send()` paths carry
+     * `data:{}`. So this stays correct + silence-safe but dormant — do NOT
+     * wire it from a silence- or substring-heuristic source (that re-opens the
+     * sign-inversion the promotion gate exists to kill). The loop is complete
+     * without it (`explicit` + `replied` drive promotion). See
+     * FEEDBACK_LEARNING_LOOP_DESIGN.md §11 v1.9#2 + v1.11.
+     */
+    onNotificationActed(params: {
+        notificationId: string;
+        actionRef?: string;
+        detail?: string;
+    }): void;
     /** Check for messages that have been ignored (no response within threshold) */
     private checkIgnoredMessages;
     /**
@@ -92,5 +120,27 @@ export declare class SignalDetector {
     static normalizeDedupKey(signal: RawSignal): string;
     /** Remove expired entries from the dedup cache */
     private pruneExpiredDedup;
+    /**
+     * Precision matters more than recall here: a match marks the reply
+     * `corrected` (valence `correction`), and the promotion gate treats any
+     * correction as an authoritative directive that promotes a lesson on
+     * FIRST occurrence — one false positive writes a bogus standing
+     * directive into `policies/agent-lessons.md`. So the stop/don't pattern
+     * requires imperative shape (sentence-initial, modulo a couple of
+     * politeness tokens) paired with an agent-action verb, instead of the
+     * old `\b(stop|no)\b.*\b(do|that|…)\b` / bare `don't` catch-alls that
+     * matched benign replies like "No worries, that sounds great" or
+     * "I don't have anything else today".
+     */
+    private static isCorrectionContent;
+    private findPendingNotificationForReply;
+    private resolvePendingNotificationId;
+    private lookupNotificationMetadata;
+    private resolveAgentIdForNotification;
+    private recordNotificationOutcome;
+    private updateNotificationReaction;
+    private buildOutcomeSummary;
+    private sanitizeEvidence;
+    private static parseTrackedNotificationId;
 }
 export {};

package/dist/core/signal-detector.js

@@ -1,5 +1,7 @@
-import { formatSqliteDatetime } from "@aitne/shared";
+import { formatSqliteDatetime, redactSensitiveString } from "@aitne/shared";
+import { hasFeedbackSignalForAction, recordFeedbackSignal, } from "../db/feedback-signals-store.js";
 import { createLogger } from "../logging.js";
+import { resolveAgentId } from "./agents/agent-id-resolver.js";
 const logger = createLogger("signal-detector");
 /**
  * Maximum number of Raw Signal entries kept in user/profile.md. Prevents
@@ -13,6 +15,26 @@ const MAX_RAW_SIGNALS = 20;
  * this window are suppressed.
  */
 const DEDUP_TTL_MS = 10 * 60 * 1000;
+/**
+ * Reaction emoji that signal disapproval. A 👎 must not be recorded as a
+ * positive behavioral signal — the consolidation LLM only sees the row's
+ * summary, so a mis-valenced reaction would count as positive corroboration
+ * for the very notification the owner disliked. Conservative set: ambiguous
+ * emoji (😢, 😕, …) stay positive-by-default rather than guessing.
+ */
+const NEGATIVE_REACTION_EMOJI = new Set([
+    "👎",
+    "❌",
+    "🚫",
+    "🛑",
+    "😠",
+    "😡",
+    "💢",
+]);
+/** Strip skin-tone modifiers + variation selectors so 👎🏽 matches 👎. */
+function normalizeReactionEmoji(emoji) {
+    return emoji.replace(/[\u{1F3FB}-\u{1F3FF}\u{FE0E}\u{FE0F}]/gu, "").trim();
+}
 /**
  * SignalDetector — collects implicit user feedback signals (no LLM required).
  *
@@ -37,6 +59,7 @@ const DEDUP_TTL_MS = 10 * 60 * 1000;
  */
 export class SignalDetector {
     config;
+    deps;
     /** Track pending notifications for ignore detection */
     pendingNotifications = new Map();
     /** Rolling dedup cache: signal key → expiry timestamp */
@@ -47,8 +70,9 @@ export class SignalDetector {
     ignoreCheckInterval = null;
     /** API base URL for Context File API (self-referencing) */
     apiBaseUrl;
-    constructor(config) {
+    constructor(config, deps = {}) {
         this.config = config;
+        this.deps = deps;
         this.ignoreThresholdMs = 30 * 60 * 1000; // 30 minutes
         this.apiBaseUrl = `http://localhost:${config.apiPort}`;
     }
@@ -71,10 +95,17 @@ export class SignalDetector {
      * Called by NotificationManager after successful delivery.
      */
     trackNotification(notificationId, platform, content) {
+        const metadata = this.lookupNotificationMetadata(notificationId);
         this.pendingNotifications.set(notificationId, {
             sentAt: Date.now(),
-            platform,
-            content: content.slice(0, 100), // Truncate for signal log
+            // Single fallback to the delivered platform here, not redundantly inside
+            // the lookup — the tracked id's suffix is the delivery platform anyway.
+            platform: metadata.platform ?? platform,
+            channel: metadata.channel,
+            content: (metadata.contentSummary ?? content).slice(0, 100), // Truncate for signal log
+            dispatchId: metadata.dispatchId,
+            notificationType: metadata.notificationType,
+            agentId: metadata.agentId,
         });
     }
     /**
@@ -85,12 +116,26 @@ export class SignalDetector {
         const { platform, emoji, responseTimeMs } = params;
         // Remove from pending (user responded)
         if (params.notificationId) {
-            this.pendingNotifications.delete(params.notificationId);
+            const pendingId = this.resolvePendingNotificationId(params.notificationId);
+            this.pendingNotifications.delete(pendingId);
+            const negative = NEGATIVE_REACTION_EMOJI.has(normalizeReactionEmoji(emoji));
+            this.recordNotificationOutcome({
+                notificationId: pendingId,
+                reaction: "replied",
+                valence: negative ? "negative" : "positive",
+                emoji,
+                evidence: {
+                    emoji,
+                    responseTimeMs,
+                    weight: 0.5,
+                },
+            });
         }
         const signal = {
             timestamp: formatSqliteDatetime(new Date()),
             type: "reaction",
-            detail: `${emoji} on ${platform}${responseTimeMs ? ` (${Math.round(responseTimeMs / 1000)}s)` : ""}`,
+            detail: `${emoji} on ${platform}`
+                + `${responseTimeMs ? ` (${Math.round(responseTimeMs / 1000)}s)` : ""}`,
         };
         void this.appendSignal(signal);
     }
@@ -100,29 +145,68 @@ export class SignalDetector {
      */
     onUserMessage(params) {
         const { content, responseToNotificationId } = params;
+        const pendingNotificationId = responseToNotificationId
+            ? this.resolvePendingNotificationId(responseToNotificationId)
+            : this.findPendingNotificationForReply(params.platform, params.channel);
         // Remove from pending (user responded)
-        if (responseToNotificationId) {
-            this.pendingNotifications.delete(responseToNotificationId);
+        if (pendingNotificationId) {
+            this.pendingNotifications.delete(pendingNotificationId);
         }
         // Detect correction instructions
-        const correctionPatterns = [
-            /shorter|brief|concise/i,
-            /more detail|elaborate|expand/i,
-            /\bin (english|spanish|french|german|portuguese|italian|chinese|japanese|korean|arabic|hindi|russian)\b/i,
-            /bullet points|bulleted list/i,
-        ];
-        for (const pattern of correctionPatterns) {
-            if (pattern.test(content)) {
-                const signal = {
-                    timestamp: formatSqliteDatetime(new Date()),
-                    type: "correction",
-                    detail: `"${content.slice(0, 60)}"`,
-                };
-                void this.appendSignal(signal);
-                return; // Only log the first matching correction
-            }
+        const isCorrection = SignalDetector.isCorrectionContent(content);
+        if (pendingNotificationId) {
+            this.recordNotificationOutcome({
+                notificationId: pendingNotificationId,
+                reaction: isCorrection ? "corrected" : "replied",
+                valence: isCorrection ? "correction" : "positive",
+                evidence: {
+                    excerpt: content.slice(0, 160),
+                    weight: isCorrection ? 1.0 : 0.5,
+                },
+            });
+        }
+        if (isCorrection) {
+            const signal = {
+                timestamp: formatSqliteDatetime(new Date()),
+                type: "correction",
+                detail: `"${content.slice(0, 60)}"`,
+            };
+            void this.appendSignal(signal);
+            return; // Only log the first matching correction
         }
     }
+    /**
+     * Record a positive action correlated with a notification. This is the
+     * narrow "acted" path: callers must have an actual task/action observation,
+     * never silence, before invoking it.
+     *
+     * NOTE — intentional Phase-1.5 seam, no production caller yet (by design).
+     * Firing `acted` deterministically needs the notification's subject
+     * `(source, ref)` in `pendingNotifications` to match a later observation,
+     * but that subject never reaches `trackNotification`: entity-related
+     * proactive DMs are re-authored by an agent turn and delivered via
+     * `POST /api/agent/notify`, which carries only message/platform/priority
+     * (no subject), and the direct `NotificationManager.send()` paths carry
+     * `data:{}`. So this stays correct + silence-safe but dormant — do NOT
+     * wire it from a silence- or substring-heuristic source (that re-opens the
+     * sign-inversion the promotion gate exists to kill). The loop is complete
+     * without it (`explicit` + `replied` drive promotion). See
+     * FEEDBACK_LEARNING_LOOP_DESIGN.md §11 v1.9#2 + v1.11.
+     */
+    onNotificationActed(params) {
+        const pendingId = this.resolvePendingNotificationId(params.notificationId);
+        this.pendingNotifications.delete(pendingId);
+        this.recordNotificationOutcome({
+            notificationId: pendingId,
+            reaction: "acted",
+            valence: "positive",
+            evidence: {
+                actionRef: params.actionRef,
+                detail: params.detail,
+                weight: 0.5,
+            },
+        });
+    }
     /** Check for messages that have been ignored (no response within threshold) */
     checkIgnoredMessages() {
         const now = Date.now();
@@ -136,6 +220,16 @@ export class SignalDetector {
                     detail: `${info.platform}: "${info.content}" unread for ${Math.round(elapsed / 60000)}min`,
                 };
                 void this.appendSignal(signal);
+                this.recordNotificationOutcome({
+                    notificationId: id,
+                    reaction: "ignored",
+                    valence: "neutral",
+                    evidence: {
+                        elapsedMs: elapsed,
+                        weight: 0.25,
+                        initiatesLesson: false,
+                    },
+                });
                 toRemove.push(id);
             }
         }
@@ -211,4 +305,207 @@ export class SignalDetector {
             }
         }
     }
+    /**
+     * Precision matters more than recall here: a match marks the reply
+     * `corrected` (valence `correction`), and the promotion gate treats any
+     * correction as an authoritative directive that promotes a lesson on
+     * FIRST occurrence — one false positive writes a bogus standing
+     * directive into `policies/agent-lessons.md`. So the stop/don't pattern
+     * requires imperative shape (sentence-initial, modulo a couple of
+     * politeness tokens) paired with an agent-action verb, instead of the
+     * old `\b(stop|no)\b.*\b(do|that|…)\b` / bare `don't` catch-alls that
+     * matched benign replies like "No worries, that sounds great" or
+     * "I don't have anything else today".
+     */
+    static isCorrectionContent(content) {
+        const correctionPatterns = [
+            /\b(shorter|brief|briefly|concise|concisely|less verbose|too long|too verbose)\b/i,
+            /\b(more detail|elaborate|expand)\b/i,
+            /\bin (english|spanish|french|german|portuguese|italian|chinese|japanese|korean|arabic|hindi|russian)\b/i,
+            /\b(bullet points|bulleted list)\b/i,
+            // Imperative "stop/don't/no more <agent action>" at the start of the
+            // reply: optional politeness tokens, a negation/stop verb, then an
+            // agent-action word within the same clause.
+            /^\W*(?:(?:please|pls|just|hey|ok|okay|can you|could you|you can|maybe)\s+){0,2}(?:stop|quit|don['’]t|do not|never|no more)\b[^.!?\n]{0,40}?\b(?:notify(?:ing)?|notifications?|messag(?:e|es|ing)|remind(?:er|ers|ing)?|send(?:ing)?|ping(?:ing)?|dm(?:s|ing)?|post(?:ing)?|repeat(?:ing)?|do(?:ing)?\s+(?:that|this))\b/i,
+        ];
+        return correctionPatterns.some((pattern) => pattern.test(content));
+    }
+    findPendingNotificationForReply(platform, channel) {
+        const now = Date.now();
+        let candidate = null;
+        for (const [id, info] of this.pendingNotifications) {
+            if (info.platform !== platform)
+                continue;
+            if (channel && info.channel && info.channel !== channel)
+                continue;
+            if (now - info.sentAt > this.ignoreThresholdMs)
+                continue;
+            if (candidate === null || info.sentAt > candidate.sentAt) {
+                candidate = { id, sentAt: info.sentAt };
+            }
+        }
+        return candidate?.id ?? null;
+    }
+    resolvePendingNotificationId(notificationId) {
+        if (this.pendingNotifications.has(notificationId))
+            return notificationId;
+        for (const id of this.pendingNotifications.keys()) {
+            if (id.startsWith(`${notificationId}:`))
+                return id;
+        }
+        return notificationId;
+    }
+    lookupNotificationMetadata(notificationId) {
+        const parsed = SignalDetector.parseTrackedNotificationId(notificationId);
+        if (!this.deps.db || !parsed.dispatchId) {
+            return {
+                dispatchId: parsed.dispatchId,
+                platform: parsed.platform,
+                channel: null,
+                notificationType: null,
+                contentSummary: null,
+                agentId: null,
+                rowId: null,
+            };
+        }
+        const platformValue = parsed.platform;
+        const platformPredicate = platformValue ? "AND platform = ?" : "";
+        const values = platformValue
+            ? [parsed.dispatchId, platformValue]
+            : [parsed.dispatchId];
+        const row = this.deps.db
+            .prepare(`SELECT id, dispatch_id, platform, delivery_channel, notification_type, content_summary
+         FROM notification_log
+         WHERE dispatch_id = ? ${platformPredicate}
+         ORDER BY id DESC
+         LIMIT 1`)
+            .get(...values);
+        const notificationType = row?.notification_type ?? null;
+        return {
+            dispatchId: row?.dispatch_id ?? parsed.dispatchId,
+            platform: row?.platform ?? parsed.platform,
+            channel: row?.delivery_channel ?? null,
+            notificationType,
+            contentSummary: row?.content_summary ?? null,
+            agentId: this.resolveAgentIdForNotification(notificationType),
+            rowId: row?.id ?? null,
+        };
+    }
+    resolveAgentIdForNotification(notificationType) {
+        if (!this.deps.db || !notificationType?.startsWith("routine."))
+            return null;
+        // Runs only after a successful notification_log read on the same db, so a
+        // connection failure would already have surfaced upstream; the registry
+        // lookup + agents existence check are deterministic over a valid handle.
+        return resolveAgentId(this.deps.db, {
+            routine: notificationType.slice("routine.".length),
+        });
+    }
+    recordNotificationOutcome(params) {
+        const db = this.deps.db;
+        if (this.config.feedbackLearningEnabled === false || !db)
+            return;
+        // One guard for the whole behavioral-capture path: the reaction backfill,
+        // dedup probe, and signal insert all touch the same connection, so a single
+        // catch keeps a DB hiccup from crashing the background detector loop
+        // without leaving the reaction column write unguarded.
+        try {
+            const metadata = this.lookupNotificationMetadata(params.notificationId);
+            const dispatchId = metadata.dispatchId;
+            if (!dispatchId)
+                return;
+            this.updateNotificationReaction(db, dispatchId, metadata.platform, params.reaction);
+            if (hasFeedbackSignalForAction(db, {
+                source: "behavioral",
+                actionKind: "notification",
+                actionRef: dispatchId,
+                valence: params.valence,
+                userReaction: params.reaction,
+            })) {
+                return;
+            }
+            const scopeType = metadata.agentId ? "agent_slug" : "agent";
+            const summary = this.buildOutcomeSummary(params.reaction, metadata, {
+                valence: params.valence,
+                emoji: params.emoji,
+            });
+            const evidence = this.sanitizeEvidence({
+                ...params.evidence,
+                userReaction: params.reaction,
+                notificationLogId: metadata.rowId,
+                notificationType: metadata.notificationType,
+                platform: metadata.platform,
+                contentSummary: metadata.contentSummary,
+            });
+            recordFeedbackSignal(db, {
+                source: "behavioral",
+                valence: params.valence,
+                scopeType,
+                scopeRef: metadata.agentId,
+                actionKind: "notification",
+                actionRef: dispatchId,
+                agentId: metadata.agentId,
+                summary,
+                evidence,
+            });
+        }
+        catch (err) {
+            logger.warn({ err, notificationId: params.notificationId, reaction: params.reaction }, "Failed to record notification outcome");
+        }
+    }
+    updateNotificationReaction(db, dispatchId, platform, reaction) {
+        if (platform) {
+            db.prepare(`UPDATE notification_log
+           SET user_reaction = ?, reacted_at = CURRENT_TIMESTAMP
+           WHERE dispatch_id = ? AND platform = ?`).run(reaction, dispatchId, platform);
+            return;
+        }
+        db.prepare(`UPDATE notification_log
+         SET user_reaction = ?, reacted_at = CURRENT_TIMESTAMP
+         WHERE dispatch_id = ?`).run(reaction, dispatchId);
+    }
+    buildOutcomeSummary(reaction, metadata, opts = {}) {
+        const content = metadata.contentSummary
+            ? ` "${metadata.contentSummary}"`
+            : "";
+        const notificationType = metadata.notificationType
+            ? ` (${metadata.notificationType})`
+            : "";
+        const emojiNote = opts.emoji ? ` (${opts.emoji})` : "";
+        const raw = reaction === "ignored"
+            ? `Owner did not respond to notification${content}${notificationType}`
+            : reaction === "corrected"
+                ? `Owner corrected notification${content}${notificationType}`
+                : reaction === "acted"
+                    ? `Owner acted on notification${content}${notificationType}`
+                    : opts.valence === "negative"
+                        ? `Owner reacted negatively${emojiNote} to notification${content}${notificationType}`
+                        : opts.emoji
+                            ? `Owner reacted${emojiNote} to notification${content}${notificationType}`
+                            : `Owner responded to notification${content}${notificationType}`;
+        return redactSensitiveString(raw.replace(/\s+/g, " ").trim()).slice(0, 280);
+    }
+    sanitizeEvidence(value) {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (entry === undefined)
+                continue;
+            if (typeof entry === "string") {
+                out[key] = redactSensitiveString(entry.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 500));
+            }
+            else {
+                out[key] = entry;
+            }
+        }
+        return out;
+    }
+    static parseTrackedNotificationId(notificationId) {
+        const idx = notificationId.indexOf(":");
+        if (idx <= 0)
+            return { dispatchId: notificationId || null, platform: null };
+        return {
+            dispatchId: notificationId.slice(0, idx),
+            platform: notificationId.slice(idx + 1) || null,
+        };
+    }
 }

package/dist/core/skills-compiler-denied-tools.js

@@ -124,7 +124,7 @@ export function buildSameBackendDenyBlock(integrations, sessionBackend) {
         "## Denied tools (per-integration)",
         "",
         "The user has restricted the following connector tools for this session.",
-        "Do NOT invoke them in any flow — including hourly check, morning routine,",
+        "Do NOT invoke them in any flow — including activity scan, morning routine,",
         "or DM responses. If a workflow appears to require one, stop and tell the",
         "user the tool is denied.",
     ];
@@ -157,7 +157,7 @@ function appendCliDenyBlock(content, namespacedDenied) {
         "## Denied tools (do not invoke)",
         "",
         "The user has restricted these connector tools for this integration. Do",
-        "NOT invoke them in any flow — including hourly check, morning routine,",
+        "NOT invoke them in any flow — including activity scan, morning routine,",
         "or DM responses. If a workflow appears to require one, stop and tell",
         "the user the tool is denied.",
         "",

package/dist/core/skills-compiler-skill-index.d.ts

@@ -75,8 +75,8 @@ export declare function refreshSkillIndexBlock(sessionDir: string, backendId: Ba
  * @deprecated DELEGATED-PROXY-API-DESIGN.md §11 — after Phase D no in-tree
  * skill uses `{{> base }}`: mail / external-services unified their bodies
  * during Phase D, and the lone surviving `notion/SKILL.base.md` was
- * removed in Phase 9 (its hourly-check read-only constraint moved to
- * `routine.hourly_check.md` task-flow where the rule applies in every
+ * removed in Phase 9 (its activity-scan read-only constraint moved to
+ * `routine.activity_scan.md` task-flow where the rule applies in every
  * integration mode, including same-backend delegated where the skill
  * body is dropped). The helper is retained for future composition needs;
  * remove the call sites in `materializeClaudeSession` /

package/dist/core/skills-compiler-skill-index.js

@@ -203,8 +203,8 @@ export function refreshSkillIndexBlock(sessionDir, backendId) {
  * @deprecated DELEGATED-PROXY-API-DESIGN.md §11 — after Phase D no in-tree
  * skill uses `{{> base }}`: mail / external-services unified their bodies
  * during Phase D, and the lone surviving `notion/SKILL.base.md` was
- * removed in Phase 9 (its hourly-check read-only constraint moved to
- * `routine.hourly_check.md` task-flow where the rule applies in every
+ * removed in Phase 9 (its activity-scan read-only constraint moved to
+ * `routine.activity_scan.md` task-flow where the rule applies in every
  * integration mode, including same-backend delegated where the skill
  * body is dropped). The helper is retained for future composition needs;
  * remove the call sites in `materializeClaudeSession` /

package/dist/core/skills-compiler-variants.d.ts

@@ -113,5 +113,5 @@ export declare const SKILL_DESCRIPTION_MAX_LENGTH = 280;
  * MUST use {@link skillBodyTouchesReadSensitive} to keep the
  * "literal prefix" decision encapsulated.
  */
-export declare const READ_SENSITIVE_API_PREFIXES: readonly ["/api/apple-calendar", "/api/books", "/api/browser-task", "/api/calendar", "/api/context", "/api/entities", "/api/mail", "/api/mcp/servers", "/api/notion", "/api/observations", "/api/obsidian", "/api/receipts", "/api/travel-bookings"];
+export declare const READ_SENSITIVE_API_PREFIXES: readonly ["/api/apple-calendar", "/api/background-task", "/api/books", "/api/browser-task", "/api/calendar", "/api/context", "/api/entities", "/api/mail", "/api/mcp/servers", "/api/notion", "/api/observations", "/api/obsidian", "/api/receipts", "/api/travel-bookings"];
 export declare function skillBodyTouchesReadSensitive(skillBody: string): boolean;

package/dist/core/skills-compiler-variants.js

@@ -311,6 +311,14 @@ export const SKILL_DESCRIPTION_MAX_LENGTH = 280;
  */
 export const READ_SENSITIVE_API_PREFIXES = [
     "/api/apple-calendar",
+    // BACKGROUND_TASK_RUNNER_DESIGN.md §7 — list / detail reads on the
+    // generic detached-task surface. The artifact JSON (`report` / `brief`
+    // / `draft` / `significance`) carries the user's research / audit
+    // content, so the GETs are ReadSensitive (the POST spawn + clarify +
+    // cancel are Autonomous). A Codex DM session referencing the
+    // `background-task` skill body gets the read-token banner so its
+    // follow-up `GET /:id` read doesn't 401 silently.
+    "/api/background-task",
     "/api/books",
     // BROWSER_TASK_REDESIGN_PLAN.md §3 — list / detail / events / screenshot
     // reads on the open-ended browser sub-agent surface. The screenshot

package/dist/core/skills-compiler.d.ts

@@ -2,6 +2,7 @@ import type DatabaseNs from "better-sqlite3";
 import { type BackendId, type IntegrationKey, type IntegrationState, type ProcessKey } from "@aitne/shared";
 import type { MailAccount } from "../services/mail/provider.js";
 import { type SkillCompilerFile } from "./skills-compiler-tree.js";
+export declare const SLIM_CLI_SKILL_SETS: Partial<Record<ProcessKey, readonly string[]>>;
 interface SessionPromptBundleParams {
     backendId: BackendId;
     sessionDir: string;
@@ -334,39 +335,41 @@ export declare class SkillsCompiler {
     private spliceCurationAnchorsInSkill;
     /**
      * docs/design/appendices/skills-unification.md Phase 1 item 15 — the slim path does NOT
-     * emit a `<skill-index>` block or the skill-discovery preamble. The
-     * fetch_window system prompt is a self-contained operational contract
-     * (one-window-one-curl, no sub-tasks, exactly-one JSON-on-stdout) and
-     * the only skill copied (`observations`) is referenced inline by the
-     * runner-emitted user prompt. Adding the index would mis-signal the
-     * fetcher to scan for skills before executing the acquisition plan.
+     * emit a `<skill-index>` block or the skill-discovery preamble. The slim
+     * system prompt is a self-contained operational contract and its copied
+     * skills are referenced inline by the dispatched user prompt / task-flow.
+     * Adding the index would mis-signal the agent to scan for skills before
+     * executing its mechanical task.
      *
-     * docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — slim instruction-file
-     * materializer for `routine.fetch_window` on Codex / Gemini CLI.
+     * fetch-window-cost-reduction.md Phase 1.5 / RESEARCH_CLUSTER_COST_FIX_PLAN.md
+     * F4 — slim instruction-file materializer for a `SLIM_CLI_SKILL_SETS` process
+     * key on Codex / Gemini CLI.
      *
-     * Mirrors the Claude SDK's Phase 1 systemPrompt swap (the same
-     * `agent-assets/system-prompts/routine-fetch-window.md` template is the
-     * single source of truth): write the slim body verbatim as AGENTS.md /
-     * GEMINI.md and copy only the `observations` skill — the
-     * `/api/observations/batch` POST contract is the fetcher's sole
-     * structural assertion. The integration partial inlined by the runner
-     * (`routine-fetch-window-runner.ts:reassemblePrompt`) covers the
-     * per-attempt call shape, so `mail` / `notion` / `external-services` /
-     * `attach` skill bodies are deliberately omitted.
+     * Mirrors the Claude SDK's slim-systemPrompt swap (the same
+     * `agent-assets/system-prompts/<key>.md` template is the single source of
+     * truth, read through the shared `loadSlimSystemPrompt` registry): write the
+     * slim body verbatim as AGENTS.md / GEMINI.md and copy only the key's
+     * `SLIM_CLI_SKILL_SETS` bundle — the wide manifest's other slugs are restated
+     * by the dispatched user prompt / task-flow, so their bodies are omitted.
      *
-     * No safety preamble / character / behavioral-rules / daemon-API
-     * sections — the slim template restates the only rules the fetcher
-     * needs (localhost-only curl, no sub-tasks, no context writes, no
-     * notify, JSON-on-stdout-and-exit). The destructive-action policy layer
-     * (absolute-block list, Codex sandbox, Gemini admin TOML) still applies
-     * unchanged at runtime.
+     * No safety preamble / character / behavioral-rules / daemon-API sections —
+     * the slim template restates the only rules the session needs. The
+     * destructive-action policy layer (absolute-block list, Codex sandbox,
+     * Gemini admin TOML) still applies unchanged at runtime.
      *
      * The `<mcp-servers>` section is appended downstream by
      * `services/mcp/session-materializer.ts:appendMcpSection` exactly as on
-     * the wide path — Phase 3's allowlist filter, when it lands, will scope
-     * that section without further changes here.
+     * the wide path.
      */
-    private materializeFetchWindowCliSession;
+    private materializeSlimCliSession;
+    /**
+     * Copy one built-in skill dir into a slim CLI session, applying the same
+     * adaptation pipeline the wide CLI path runs (brand tokens, partial /
+     * reference includes, integration-mode filter, tool-deny prose, curation
+     * anchors). Frontmatter stays intact (skills-unification.md §R6). A
+     * no-op when the source SKILL.md is absent.
+     */
+    private copySlimSkillDir;
     private materializeCliSession;
 }
 export {};