@winspan/claude-forge 8.54.4 → 9.12.0

package/dist/daemon/index.js

@@ -8,29 +8,75 @@
  * 4. Create event handlers and start socket server
  * 5. Handle graceful shutdown
  */
+import { readFileSync } from 'node:fs';
 import { SocketServer } from './server.js';
-import { writePidFile, removePidFile, cleanSocket, getSocketPath, writeAuthToken, syncMcpToken, removeAuthToken, } from './lifecycle.js';
+import { writePidFile, removePidFile, cleanSocket, getSocketPath, writeAuthToken, syncMcpToken, removeAuthToken, isAnotherDaemonListening, } from './lifecycle.js';
 import { routeEvent } from './router.js';
-import { logger } from '../core/utils/logger.js';
+import { logger, enableFileLogging } from '../core/utils/logger.js';
 import { ConfigManager } from '../core/config.js';
 import { SQLiteStorage } from '../core/storage/sqlite.js';
 import { expandPath } from '../core/utils/path.js';
-import { ClaudeProvider } from '../core/ai/provider.js';
+// D R-A (2026-05-29): ClaudeProvider import removed — daemon no longer
+// instantiates ClaudeProvider at startup. SkillRegistry is now keyword-only
+// and takes no args. Provider file itself is deleted in D R-D.
+// See master spec 0902 §2.4.4 and src/skills/registry.ts (design rationale).
 import { TaskSegmenter } from './services/task-segmenter.js';
+import { TaskBoundaryClassifier } from './services/task-boundary-classifier.js';
+import { srcDirFromRoot } from './services/codegraph-sync.js';
+import { startMaintenanceSchedulers } from './startup/maintenance-schedulers.js';
+import { CodeGraphStore } from '../core/storage/codegraph.js';
 import { SkillRegistry } from '../skills/registry.js';
 import { InvocationGuard } from '../skills/invocation-guard.js';
 import { HistoryExporter } from './handlers/history-exporter.js';
 import { ResumeManager } from '../claudemd/resume-manager.js';
+import { ViolationsManager } from '../claudemd/violations-manager.js';
 import { ConventionExtractor } from '../claudemd/convention-extractor.js';
 import { UserPromptHandler } from './handlers/user-prompt.js';
 import { PostToolUseHandler } from './handlers/post-tool-use.js';
 import { StopHandler } from './handlers/stop.js';
+import { PreToolUseHandler } from './handlers/pre-tool-use.js';
+import { SpecApproval } from './services/spec-approval.js';
+import { RuleRegistry } from './rules/registry.js';
+import { assertWhitelistInvariants } from './rules/whitelist.js';
 import { syncHooks } from './hook-sync.js';
 import { syncSkills } from './skill-sync.js';
+import { syncAgents } from './agent-sync.js';
 import { replayQueue } from '../core/queue/index.js';
-import { DEFAULTS } from '../core/constants.js';
+import { DEFAULTS, FORGE_PATHS } from '../core/constants.js';
 import { getUserPrompt } from '../core/event-fields.js';
+// D-2: BuildManager is now lazy-loaded inside the `webEnabled` branch (L460-475)
+// so the daemon has zero static edges into `src/web/`. The previous
+// `import { buildManager } from '../web/services/build-manager.js'` lived here.
+import { ConfigStore } from './config-store.js';
+import { reviveInterceptIfStale } from './services/intercept-revive.js';
+import { startHeartbeat } from './services/heartbeat-writer.js';
+import { DECISION_MAKER_COOLDOWN_CONFIG_KEY, DEFAULT_DECISION_MAKER_COOLDOWN_SECONDS, MAX_DECISION_MAKER_COOLDOWN_SECONDS, } from './services/decision-hint.js';
+// F12: the maintenance mutex shared by all scheduled maintenance handlers now
+// lives inside `startMaintenanceSchedulers` (src/daemon/startup/maintenance-
+// schedulers.ts) as factory-local closure state — see Wave 3a R3 extraction.
 export async function startDaemon(foreground = false, options = {}) {
+    // ── 0pre. Anti-recursion guard ──────────────────────────────────────────────
+    // Refuse to boot a second daemon from inside an internal subprocess marked
+    // with CLAUDE_FORGE_INTERNAL=1. Guards against a misconfigured user hook
+    // accidentally invoking `cf daemon start` from a spawned child — otherwise
+    // we'd have two daemons fighting over the same socket. Defensive: nothing in
+    // the current codebase sets this env, but the check is cheap insurance.
+    if (process.env.CLAUDE_FORGE_INTERNAL === '1') {
+        console.error('[daemon] refusing to start under CLAUDE_FORGE_INTERNAL=1');
+        process.exit(0);
+    }
+    // ── 0a. File logging wire (Stage D, 2026-05-27) ────────────────────────────
+    // MUST be the first thing in startDaemon — before any logger.* call AND
+    // before the uncaughtException/unhandledRejection handlers (which log via
+    // `logger.error`). The default stderr-only sink is swallowed in detached
+    // production mode (stdout/stderr → /dev/null) and that's why subsystem
+    // startup lines (`[ConfigStore] Seeded N keys`, `[InterceptRevive] ...`,
+    // etc.) never landed on disk. The dev-daemon.sh wrapper hides this bug by
+    // shell-redirecting `2> daemon-dev.log` but real `cf daemon start` users
+    // see nothing. Skip when FORGE_DAEMON_DISABLE_FILE_LOG=1 (tests / CI).
+    if (process.env.FORGE_DAEMON_DISABLE_FILE_LOG !== '1') {
+        enableFileLogging(FORGE_PATHS.daemonLog());
+    }
     // ── 0. Global Exception Handlers ───────────────────────────────────────────
     process.on('uncaughtException', (err) => {
         logger.error(`[Daemon] Uncaught exception: ${err.message}`);
@@ -44,7 +90,55 @@ export async function startDaemon(foreground = false, options = {}) {
     // Log level is auto-parsed from LOG_LEVEL env var at logger module load time.
     const config = new ConfigManager().get();
     logger.info('Claude Forge daemon starting...');
+    // ── 1a. Deprecated env detection (spec 1851 R-A User Decisions Q7) ─────────
+    // The Phase B `CF_SKILL_DISTILLER_AGENT=1` toggle was removed in R-A; the
+    // env is now silently ignored. Warn users so they remove it from their rc
+    // / launchd plist before R-D removes the warning altogether.
+    if (process.env.CF_SKILL_DISTILLER_AGENT) {
+        logger.warn('[daemon] env CF_SKILL_DISTILLER_AGENT detected — this flag is deprecated ' +
+            'and has no effect. Distill now uses claude CLI shell-out unconditionally. ' +
+            'Please unset it from your shell rc / launchd plist.');
+    }
+    // ── 1.5. Whitelist self-test (Phase 2c safety-net) ────────────────────────
+    // Fail-fast at boot if the enforcement whitelist regresses — better than
+    // letting the user discover that `cf bypass` itself is denied on first use.
+    try {
+        assertWhitelistInvariants();
+        logger.debug('[Whitelist] self-test passed');
+    }
+    catch (err) {
+        logger.error(`[Whitelist] self-test FAILED: ${err}`);
+        throw err;
+    }
+    // ── 1.6. Global governance protocol injection (decision 7fa0f2ab) ─────────
+    // Idempotently write the DECISION HINT protocol contract into the global
+    // ~/.claude/CLAUDE.md so Claude in *other* projects knows to spawn
+    // decision-maker. Fail-silent: a write error here must never block daemon
+    // startup. Skip when FORGE_DAEMON_SKIP_GLOBAL_INJECT=1 (tests / CI).
+    if (process.env.FORGE_DAEMON_SKIP_GLOBAL_INJECT !== '1') {
+        try {
+            const { injectGlobalGovernance } = await import('../core/governance/global-inject.js');
+            const res = injectGlobalGovernance();
+            logger.debug(`[Governance] global inject ${res.action} (${res.path})`);
+        }
+        catch (err) {
+            logger.warn(`[Governance] global inject failed (continuing): ${err}`);
+        }
+    }
     // ── 2. Lifecycle (PID, socket, auth token) ─────────────────────────────────
+    // Single-instance guard (task-link orphan fix, 2026-06-02). MUST run BEFORE
+    // cleanSocket() — if a healthy daemon is already accepting on the socket, a
+    // second instance (typically launchd re-spawn after a prior EADDRINUSE crash)
+    // would otherwise unlink + re-bind the live socket, steal it, then die on the
+    // web port. That orphaned socket breaks every hook `nc` connect → events get
+    // queued instead of delivered and tasks freeze at "0 events". We exit 0
+    // (clean) so launchd's KeepAlive.SuccessfulExit=false does NOT immediately
+    // re-spawn us, breaking the 10s crash loop.
+    if (await isAnotherDaemonListening()) {
+        logger.warn('[Daemon] Another daemon is already listening on the socket — aborting ' +
+            'startup to avoid socket theft (single-instance guard). Exiting cleanly.');
+        process.exit(0);
+    }
     cleanSocket();
     writePidFile();
     const authToken = writeAuthToken();
@@ -54,6 +148,43 @@ export async function startDaemon(foreground = false, options = {}) {
     const dbPath = expandPath(config.storage.path);
     const storage = new SQLiteStorage(dbPath);
     logger.info(`Storage initialized: ${dbPath}`);
+    // ── 3.45. Seed feature-flag defaults (v9.x Phase 0) ───────────────────────
+    // Insert any missing flags from DEFAULT_FLAGS; user-edited values via
+    // `cf config set ...` are preserved (only writes when key is absent).
+    // ConfigStore is instantiated once here and shared with handlers that need
+    // to probe flags at request time (e.g. PreToolUseHandler).
+    const configStore = new ConfigStore(storage);
+    try {
+        const seeded = configStore.seedDefaults();
+        if (seeded > 0) {
+            logger.info(`[ConfigStore] Seeded ${seeded} default feature flag(s)`);
+        }
+        else {
+            logger.debug('[ConfigStore] All default feature flags already present');
+        }
+    }
+    catch (err) {
+        logger.warn(`[ConfigStore] seedDefaults failed: ${err}`);
+    }
+    // ── 3.46. Intercept Revive (8-in-1 Phase D, 2026-05-27) ───────────────────
+    // If `InterceptRollbackGuard` auto-disabled `pre_tool_intercept.enabled`
+    // more than 24h ago and the user never manually re-enabled it, flip it back
+    // on. Without this, the rollback guard is a one-way trap — the user has
+    // to remember to run `cf config set ...` which (per spec § Problem
+    // statement) they never did. Manual disables (no `auto_disabled_at` audit
+    // key) are left alone.
+    try {
+        const outcome = reviveInterceptIfStale(configStore);
+        if (outcome.revived) {
+            logger.info(`[InterceptRevive] ${outcome.reason}`);
+        }
+        else {
+            logger.debug(`[InterceptRevive] no-op: ${outcome.reason}`);
+        }
+    }
+    catch (err) {
+        logger.warn(`[InterceptRevive] startup call failed (non-fatal): ${err}`);
+    }
     // ── 3.5. Auto-sync hooks ────────────────────────────────────────────────
     // npm upgrade 不会自动更新 ~/.claude-forge/hooks/，每次 daemon 启动
     // 用 SHA-256 比对源 dist/hooks 与本地副本，不一致则覆盖。
@@ -63,86 +194,190 @@ export async function startDaemon(foreground = false, options = {}) {
     catch (err) {
         logger.warn(`[HookSync] unexpected error: ${err}`);
     }
-    // ── 3.6. Auto-sync official skills ─────────────────────────────────────
+    // ── 3.6. Auto-sync built-in distilled skills ───────────────────────────
     // npm upgrade 不会自动更新 ~/.claude/skills/，每次 daemon 启动
-    // 用 SHA-256 比对 dist/skills/official 与本地副本，不一致则覆盖。
+    // 用 SHA-256 比对 dist/skills/distilled 与本地副本，不一致则覆盖。
     try {
         syncSkills();
     }
     catch (err) {
         logger.warn(`[SkillSync] unexpected error: ${err}`);
     }
-    // ── 4. AI Provider ─────────────────────────────────────────────────────────
-    const apiKey = config.ai.api_key || process.env.ANTHROPIC_API_KEY || '';
-    if (!apiKey) {
-        logger.warn('No API key configured — AI features disabled');
+    // ── 3.7. Auto-sync project-specific agent prompts ───────────────────────
+    // npm upgrade / fresh npm install 不会自动填充 ~/.claude/agents/。每次 daemon
+    // 启动用 SHA-256 比对 dist/daemon/templates/agents/ 与本地副本，不一致则覆盖。
+    // 用户自己加的 my-*.md 不在 source list → 始终保留。
+    try {
+        syncAgents();
     }
-    const ai = apiKey
-        ? new ClaudeProvider(apiKey, config.ai.model, config.ai.base_url)
-        : null;
-    // ── 5. Initialize services ─────────────────────────────────────────────────
-    const skillApiKey = config.skill_matching?.api_key || apiKey;
-    const skillRegistry = new SkillRegistry(skillApiKey, config.ai.model, config.ai.base_url);
-    const invocationGuard = new InvocationGuard();
-    if (skillApiKey) {
-        logger.info('[Skills] Registry loaded with semantic matching support');
+    catch (err) {
+        logger.warn(`[AgentSync] unexpected error: ${err}`);
     }
-    else {
-        logger.info('[Skills] Registry loaded (keyword matching)');
+    // ── 4. AI Provider (DELETED — D R-A → R-D, 2026-05-29) ────────────────────
+    // The daemon used to instantiate a ClaudeProvider here for two reasons:
+    //   (a) emit `[AI Stats]` on shutdown (dead log — no consumers, removed)
+    //   (b) hand model/base_url to the (now-deleted) semantic skill matcher
+    // Master spec 0902 §2.4.4 (decision f5a5b030 / Option B 彻底) eliminates
+    // both: distill / claudemd / knowledge / patch now shell out to the
+    // `claude` CLI (sub-specs A/B/C R-B already landed). SkillRegistry is
+    // keyword-only. D R-D (this commit) deleted `src/core/ai/provider.ts`
+    // outright and the `ai.*` / `skill_matching.*` config schema.
+    // Design rationale for the keyword-only switch lives in
+    // `src/skills/registry.ts` (single source of truth — decision 3baa0e7c).
+    //
+    // Migration warn: if the user still has `ai:` or `skill_matching:` in the
+    // raw yaml, or `ANTHROPIC_API_KEY` exported, tell them it's deprecated and
+    // has no effect. We re-read the raw yaml here (rather than the typed
+    // `config`) because the schema no longer holds those fields.
+    try {
+        const rawCfg = readFileSync(FORGE_PATHS.config(), 'utf-8');
+        const legacyAiKey = /^\s*ai\s*:/m.test(rawCfg);
+        const legacySkillMatchKey = /^\s*skill_matching\s*:/m.test(rawCfg);
+        const legacyApiKeyEnv = !!process.env.ANTHROPIC_API_KEY;
+        if (legacyAiKey || legacySkillMatchKey || legacyApiKeyEnv) {
+            const sources = [];
+            if (legacyAiKey)
+                sources.push('config.ai.api_key');
+            if (legacySkillMatchKey)
+                sources.push('config.skill_matching.api_key');
+            if (legacyApiKeyEnv)
+                sources.push('ANTHROPIC_API_KEY env');
+            logger.warn(`[daemon] ${sources.join(' + ')} detected — these are deprecated ` +
+                'and have no effect after spec 0902 (decision f5a5b030). Distill / ' +
+                'claudemd / knowledge build / patch now use claude CLI shell-out, ' +
+                'and SkillRegistry is keyword-only. Remove from config.yaml + ' +
+                'shell rc to silence this warning.');
+        }
+    }
+    catch {
+        // No config.yaml or read error → nothing to warn about.
+    }
+    // ── 4.7. decision 7aa0ec63 (2026-06-01) — cooldown config validation ────
+    // If forge_config.decision_maker_cooldown_seconds is present but holds an
+    // out-of-range value (≤ 0 or > MAX_DECISION_MAKER_COOLDOWN_SECONDS) or a
+    // non-number, the resolver silently falls back to the default. Warn once at
+    // boot so the user notices typos instead of wondering why their override
+    // had no effect.
+    try {
+        const raw = storage.readConfig(DECISION_MAKER_COOLDOWN_CONFIG_KEY);
+        if (raw !== undefined && raw !== null) {
+            const n = Number(raw);
+            const invalid = !Number.isFinite(n) ||
+                n <= 0 ||
+                n > MAX_DECISION_MAKER_COOLDOWN_SECONDS;
+            if (invalid) {
+                logger.warn(`[daemon] forge_config.${DECISION_MAKER_COOLDOWN_CONFIG_KEY}=${String(raw)} ` +
+                    `is out of range (0, ${MAX_DECISION_MAKER_COOLDOWN_SECONDS}]; ` +
+                    `falling back to default ${DEFAULT_DECISION_MAKER_COOLDOWN_SECONDS}s. ` +
+                    `Set a valid value via \`cf config set ${DECISION_MAKER_COOLDOWN_CONFIG_KEY} <seconds>\`.`);
+            }
+        }
     }
+    catch (err) {
+        logger.debug(`[daemon] cooldown config probe failed (non-fatal): ${err}`);
+    }
+    // ── 5. Initialize services ─────────────────────────────────────────────────
+    // D R-B (spec 0902): SkillRegistry is keyword-only — no args. The legacy
+    // `skill_matching.api_key` field is silently ignored (warned above) and
+    // will be removed from the JSON schema in D R-D.
+    const skillRegistry = new SkillRegistry();
+    const invocationGuard = new InvocationGuard();
+    logger.info('[Skills] Registry loaded (keyword matching)');
     logger.info('[Skills] InvocationGuard ready (idempotent + depth/total limits)');
     const exporter = new HistoryExporter(storage);
     const resume = new ResumeManager(storage);
+    const violationsManager = new ViolationsManager();
     const conventionExtractor = new ConventionExtractor();
     const taskSegmenter = new TaskSegmenter(storage);
-    logger.info('[Services] Initialized: ResumeManager, TaskSegmenter, SkillRegistry');
-    // ── 5.5. Schedule daily maintenance ────────────────────────────────────────
-    // Clean old fact-table data every 24 hours (events / routing / skills / tokens).
-    const MAINTENANCE_INTERVAL = 24 * 60 * 60 * 1000; // 24 hours
-    const maintenanceInterval = setInterval(() => {
-        logger.info('[Daemon] Running daily maintenance: cleaning old fact-table data');
-        try {
-            const r = storage.cleanOldData(30);
-            logger.info(`[Daemon] cleanOldData: events=${r.events}, routing=${r.routing}, skills=${r.skills}, tokens=${r.tokens}`);
-        }
-        catch (err) {
-            logger.error(`[Daemon] Maintenance failed: ${err}`);
-        }
-    }, MAINTENANCE_INTERVAL);
-    logger.info('[Daemon] Scheduled daily maintenance (clean fact-table data older than 30 days)');
-    // ── 5.5.1. Schedule weekly VACUUM (every 7 days) ───────────────────────────
-    // VACUUM 重写整库，释放页空间。频率 7 天足以应对一般负载。
-    const VACUUM_INTERVAL = 7 * 24 * 60 * 60 * 1000;
-    const vacuumInterval = setInterval(() => {
-        try {
-            // 500 MB 阈值：低于此值不 VACUUM（避免空转的 fsync 抖动）。
-            storage.runMaintenance(500);
-        }
-        catch (err) {
-            logger.error(`[Daemon] VACUUM failed: ${err}`);
-        }
-    }, VACUUM_INTERVAL);
-    logger.info('[Daemon] Scheduled weekly VACUUM (threshold: 500MB)');
-    // ── 5.6. Stale task GC (every 5 minutes) ──────────────────────────────────
-    const STALE_TASK_GC_INTERVAL = 5 * 60 * 1000; // 5 分钟
-    const STALE_TASK_IDLE_MINUTES = 10; // idle 超 10 分钟视为滞留
-    const staleTaskGcInterval = setInterval(() => {
-        try {
-            const closed = storage.completeStaleActiveTasks(STALE_TASK_IDLE_MINUTES);
-            if (closed > 0) {
-                logger.info(`[Maintenance] Auto-completed ${closed} stale active task(s)`);
-            }
-        }
-        catch (err) {
-            logger.error(`[Maintenance] Stale task GC failed: ${err}`);
+    // decision 265f59d5 (2026-06-08): async LLM boundary classifier. Fire-and-
+    // forget — NEVER awaited on the UserPromptSubmit hot path. Only spawns claude
+    // for prompts the sync segmenter flagged ambiguous (~30%).
+    const boundaryClassifier = new TaskBoundaryClassifier();
+    // Orphan-event robustness fix (2026-06-01): proactively rebuild the
+    // in-memory currentTasks map from the DB so events arriving right after a
+    // daemon restart (buffered + replayed) hit the fast currentTasks path
+    // instead of relying on per-event lazy recovery. Idempotent + fault-tolerant.
+    taskSegmenter.hydrateActiveTasks();
+    logger.info('[Services] Initialized: ResumeManager, ViolationsManager, TaskSegmenter, SkillRegistry');
+    // ── 5.45. Heartbeat writer (watchdog spec 0843) ───────────────────────────
+    // Writes ~/.claude-forge/daemon.heartbeat every 60s via atomic rename.
+    // Removed on graceful shutdown so ensure-running detects the gap.
+    let daemonVersion = 'unknown';
+    try {
+        const pkgUrl = new URL('../../package.json', import.meta.url);
+        const { createRequire } = await import('node:module');
+        const req = createRequire(import.meta.url);
+        const pkg = req(pkgUrl.pathname);
+        daemonVersion = pkg.version;
+    }
+    catch { /* version string is nice-to-have, not critical */ }
+    const heartbeatHandle = startHeartbeat({ version: daemonVersion });
+    logger.info('[Heartbeat] writer started (60s interval)');
+    // ── 5.5–5.8. Periodic maintenance schedulers (Wave 3a R3 extraction) ──────
+    // Daily fact-table clean, weekly VACUUM, event-TTL sweep, stale-task GC,
+    // codegraph incremental sync and KB auto-rebuild — all six recurring
+    // schedulers plus their four initial one-shot timeouts and the shared
+    // maintenance mutex now live in `startMaintenanceSchedulers`
+    // (src/daemon/startup/maintenance-schedulers.ts). Behavior is unchanged:
+    // same cadences, same fail-silent handling, same teardown. The codegraph
+    // store + project-root deps are declared here because `shutdown()` also
+    // closes the store; the BuildManager resolver stays here to keep the
+    // scheduler module free of any static edge into `src/web/`.
+    const codegraphStore = new CodeGraphStore(FORGE_PATHS.codegraphDb());
+    const codegraphSrcDir = srcDirFromRoot(process.cwd());
+    const codegraphMtimeCache = new Map();
+    const kbProjectRoot = process.cwd();
+    // BuildManager lives under src/web/ (lazy-loaded to keep core ← web layering).
+    // The scheduler stays web-agnostic via this callback; resolve the singleton
+    // once.
+    let kbBuildManager = null;
+    const ensureKbBuildManager = async () => {
+        if (!kbBuildManager) {
+            const { buildManager } = await import('../web/services/build-manager.js');
+            // Idempotent: setStorage may also be called by the web-server branch.
+            buildManager.setStorage(storage);
+            kbBuildManager = buildManager;
         }
-    }, STALE_TASK_GC_INTERVAL);
+        return kbBuildManager;
+    };
+    const maintenanceHandle = startMaintenanceSchedulers({
+        storage,
+        configStore,
+        taskSegmenter,
+        codegraphStore,
+        codegraphSrcDir,
+        codegraphMtimeCache,
+        kbProjectRoot,
+        ensureKbBuildManager,
+    });
     // ── 6. Create handlers ─────────────────────────────────────────────────────
-    const userPromptHandler = new UserPromptHandler(resume, conventionExtractor, storage, skillRegistry);
+    // Phase 5: shared RuleRegistry so PreToolUse sees the same rule set.
+    const ruleRegistry = new RuleRegistry();
+    // ── 6.2. v9.x Phase 2b — Spec Approval ─────────────────────────────────
+    // SpecGenerator removed (Spec 1702: 0% real-world acceptance → dead code).
+    // SpecApproval retained for the hand-written path: planner agent calls
+    // `cf spec register`, user replies "批准 <token>" → daemon short-circuits.
+    const specApproval = new SpecApproval(storage);
+    // Spec 1200 (2026-05-28): IntentEngine + WorkflowRecommender removed.
+    // Decision 3baa0e7c Batch 1 (2026-06-01): deprecated `_workflowRecommender`
+    // and `_intentEngine` ctor positions cleaned up; specApproval now arg 5.
+    const userPromptHandler = new UserPromptHandler(resume, conventionExtractor, storage, skillRegistry, specApproval);
+    // Phase 1: PreToolUseHandler runs in dry_run mode unless
+    // `pre_tool_intercept.enabled` is flipped on via `cf config set`.
+    //
+    // Constructed BEFORE StopHandler so the latter can receive it as its 8th
+    // arg for the D-1 clearSession wiring (memory-leak fix).
+    const preToolUseHandler = new PreToolUseHandler(storage, configStore, ruleRegistry);
     const handlers = {
         UserPromptSubmit: userPromptHandler,
-        PostToolUse: new PostToolUseHandler(storage),
-        Stop: new StopHandler(exporter, resume, taskSegmenter, storage, invocationGuard, userPromptHandler),
+        // Phase 6: configStore wired so agent_writeback.enabled flag is probed
+        // on every Write/Edit (default OFF; opt-in via `cf config set`).
+        PostToolUse: new PostToolUseHandler(storage, configStore),
+        Stop: new StopHandler(exporter, resume, taskSegmenter, storage, invocationGuard, userPromptHandler, violationsManager, 
+        // D-1: clearSession on PreToolUseHandler.editedFilesCache at Stop time
+        // (fixes per-session Set leak across long-running daemons).
+        preToolUseHandler),
+        PreToolUse: preToolUseHandler,
     };
     // ── 7. Event handler ───────────────────────────────────────────────────────
     const handleEvent = async (event) => {
@@ -165,15 +400,27 @@ export async function startDaemon(foreground = false, options = {}) {
             // Task segmentation: UserPromptSubmit starts/continues tasks
             const prompt = getUserPrompt(event);
             if (event.hook_type === 'UserPromptSubmit' && prompt) {
-                taskSegmenter.processPrompt(event.session_id, prompt, event.timestamp, event.event_id);
+                const decision = taskSegmenter.processPromptWithBoundary(event.session_id, prompt, event.timestamp, event.event_id);
+                // decision 265f59d5: ambiguous merge → hand off to the async LLM
+                // classifier. fire-and-forget: NOT awaited, never blocks the hook
+                // response. The classifier internally re-checks idempotency + the
+                // event's current FK before any re-attribution.
+                if (decision.ambiguous) {
+                    void boundaryClassifier.classify(decision.ambiguous, storage);
+                }
             }
             else if (event.event_id) {
-                taskSegmenter.linkEvent(event.session_id, event.event_id);
-            }
-            // PreToolUse: always allow (governance removed)
-            if (event.hook_type === 'PreToolUse') {
-                return { allow: true };
+                // Spec 1713 §10.3: forward hookType / toolName so the segmenter can
+                // detect sub-agent return (PostToolUse Task/Agent) and arm the
+                // "next prompt = new task" flag.
+                taskSegmenter.linkEvent(event.session_id, event.event_id, event.timestamp, {
+                    hookType: event.hook_type,
+                    toolName: event.tool_name,
+                });
             }
+            // PreToolUse / PostToolUse / UserPromptSubmit / Stop all routed via routeEvent.
+            // PreToolUse now goes through PreToolUseHandler (Phase 1 rule engine),
+            // which honors `pre_tool_intercept.enabled` flag (dry_run when OFF).
             const result = await routeEvent(event, handlers);
             if (result) {
                 const handlerName = event.hook_type + 'Handler';
@@ -190,14 +437,30 @@ export async function startDaemon(foreground = false, options = {}) {
                     console.error(`\x1b[36m[${handlerName}] systemMessage (${result.systemMessage.length} chars): ${preview}\x1b[0m`);
                 }
                 if (result.additionalContext) {
-                    storage.writeInjection({
-                        event_id: event.event_id,
-                        session_id: event.session_id,
-                        timestamp: event.timestamp,
-                        source_handler: handlerName,
-                        injection_type: 'additionalContext',
-                        content: result.additionalContext,
-                    });
+                    // P2 dedup (audit e888352d): the UserPromptSubmit additionalContext is
+                    // a MERGE of resume/convention + the KB block, but the KB block is
+                    // ALSO recorded as its own fine-grained `:kb` injection row by
+                    // UserPromptHandler (the canonical row ~10 metric queries read). Two
+                    // rows carrying the same KB content inflated the injection count ~15%.
+                    //
+                    // Fix: record under the generic handler name ONLY the portion not
+                    // already captured by a sibling `:kb` row for this event (i.e. the
+                    // resume/convention context). Delivery to Claude Code is unchanged —
+                    // result.additionalContext still carries the full merged text; only
+                    // the *recorded* row is de-duplicated. If nothing remains after
+                    // stripping the KB block, skip the write entirely (the `:kb` row is
+                    // the sole record of this injection).
+                    const recordContent = stripAlreadyRecordedKb(storage, event.event_id, result.additionalContext);
+                    if (recordContent) {
+                        storage.writeInjection({
+                            event_id: event.event_id,
+                            session_id: event.session_id,
+                            timestamp: event.timestamp,
+                            source_handler: handlerName,
+                            injection_type: 'additionalContext',
+                            content: recordContent,
+                        });
+                    }
                     const preview = result.additionalContext.slice(0, 200).replace(/\n/g, ' ');
                     console.error(`\x1b[36m[${handlerName}] additionalContext: ${preview}\x1b[0m`);
                 }
@@ -217,7 +480,21 @@ export async function startDaemon(foreground = false, options = {}) {
     // setImmediate ensures the event loop has had a chance to process the listen
     // callback before we touch storage (not strictly required, but defensive).
     setImmediate(() => {
-        replayQueue(storage).then(({ replayed, skipped, dead }) => {
+        replayQueue(storage, {
+            // Mirror handleEvent line 480-484: feed replayed UserPromptSubmit events
+            // into TaskSegmenter so the tasks table gets populated. We do NOT route
+            // through full handleEvent — KB inject / decision-hint / skill-match
+            // would all be stale (no live hook is waiting on the response).
+            onReplayed: (event) => {
+                const prompt = getUserPrompt(event);
+                if (event.hook_type === 'UserPromptSubmit' && prompt) {
+                    taskSegmenter.processPrompt(event.session_id, prompt, event.timestamp, event.event_id);
+                }
+                else if (event.event_id) {
+                    taskSegmenter.linkEvent(event.session_id, event.event_id, event.timestamp);
+                }
+            },
+        }).then(({ replayed, skipped, dead }) => {
             if (replayed > 0 || skipped > 0 || dead > 0) {
                 logger.info(`[Queue] Replay: ${replayed} replayed, ${skipped} skipped (dup), ${dead} dead-lettered`);
             }
@@ -230,6 +507,20 @@ export async function startDaemon(foreground = false, options = {}) {
     const webEnabled = options.web ?? (process.env.FORGE_DAEMON_NO_WEB === '1' ? false : config.web.enabled);
     let webServer = null;
     if (webEnabled) {
+        // D-2: lazy-load BuildManager + WebServer so the daemon has zero static
+        // edges into `src/web/` (matches the documented core ← {daemon, web}
+        // peer-layering). BuildManager's storage injection is safe to defer
+        // because the only consumer is `web/routes/knowledge.ts`, which runs
+        // only after `WebServer.start()` returns (post-setStorage).
+        const { buildManager } = await import('../web/services/build-manager.js');
+        buildManager.setStorage(storage);
+        // Decision 4e592120 (invariant b): inject the live SkillRegistry into the
+        // distill manager so a Web-triggered distillation can reload() it on done
+        // — the dashboard skill list refreshes with no daemon restart. Lazy import
+        // keeps the documented core ← {daemon, web} peer-layering (no static daemon
+        // edge into src/web/).
+        const { distillManager } = await import('../web/services/distill-manager.js');
+        distillManager.setRegistry(skillRegistry);
         const { WebServer } = await import('../web/server.js');
         webServer = new WebServer({
             port: config.web.port,
@@ -237,7 +528,19 @@ export async function startDaemon(foreground = false, options = {}) {
             skillRegistry,
             invocationGuard,
         });
-        await webServer.start();
+        // Defense-in-depth (task-link orphan fix, 2026-06-02): a failed web-server
+        // start (most commonly EADDRINUSE on port 3721 when another daemon already
+        // holds it) MUST NOT propagate to `process.exit(1)`. The core daemon job is
+        // the socket event pipeline, which is already listening by now; killing the
+        // process here is what previously created the launchd crash loop + socket
+        // theft. Log and continue with web disabled.
+        try {
+            await webServer.start();
+        }
+        catch (err) {
+            logger.error(`[Web] Server failed to start (continuing without web UI): ${err instanceof Error ? err.message : err}`);
+            webServer = null;
+        }
     }
     else {
         logger.info('[Web] Server disabled (--no-web or config.web.enabled=false)');
@@ -249,11 +552,14 @@ export async function startDaemon(foreground = false, options = {}) {
             return;
         shuttingDown = true;
         logger.info('Shutting down...');
-        if (ai)
-            logger.info(`[AI Stats] ${ai.formatStats()}`);
-        clearInterval(maintenanceInterval);
-        clearInterval(vacuumInterval);
-        clearInterval(staleTaskGcInterval);
+        // D R-A (2026-05-29): removed `[AI Stats]` shutdown line — there was no
+        // consumer (dead log), and the only producer (ClaudeProvider instance)
+        // was deleted with the §4 block above. Master spec 0902 §2.4.4.
+        heartbeatHandle.stop();
+        // Wave 3a R3: all six maintenance intervals + four initial one-shot
+        // timeouts are now torn down by the scheduler handle (same set as before).
+        maintenanceHandle.stop();
+        codegraphStore.close();
         if (webServer)
             await webServer.stop();
         await server.close();
@@ -271,6 +577,53 @@ export async function startDaemon(foreground = false, options = {}) {
         process.stdout.write('Press Ctrl+C to stop\n');
     }
 }
+/**
+ * P2 dedup helper (audit e888352d).
+ *
+ * The merged UserPromptSubmit `additionalContext` recorded under the generic
+ * `<hook>Handler` source_handler often re-contains the KB block, which
+ * UserPromptHandler already recorded as its own `UserPromptSubmitHandler:kb`
+ * injection row. That double-count inflated injection metrics ~15%.
+ *
+ * Given the full merged additionalContext, this removes any sibling `:kb`
+ * injection content already recorded for the same `event_id`, returning the
+ * remaining context (resume/convention) to record under the generic handler.
+ * Returns null when nothing meaningful remains (→ caller skips the write, the
+ * `:kb` row being the sole record).
+ *
+ * Storage failures degrade gracefully to "record the full merged content"
+ * (no worse than the pre-fix behaviour).
+ */
+export function stripAlreadyRecordedKb(storage, eventId, merged) {
+    if (!eventId)
+        return merged;
+    let kbRows;
+    try {
+        kbRows = storage.queryInjections({
+            event_id: eventId,
+            source_handler: 'UserPromptSubmitHandler:kb',
+            limit: 5,
+        });
+    }
+    catch {
+        return merged;
+    }
+    if (kbRows.length === 0)
+        return merged;
+    let remaining = merged;
+    for (const row of kbRows) {
+        if (!row.content)
+            continue;
+        // The handler joins context parts with '\n\n'; strip the KB block plus an
+        // adjacent separator so we don't leave a dangling blank line.
+        remaining = remaining
+            .replace(`${row.content}\n\n`, '')
+            .replace(`\n\n${row.content}`, '')
+            .replace(row.content, '');
+    }
+    remaining = remaining.trim();
+    return remaining.length > 0 ? remaining : null;
+}
 // Allow running as standalone script (spawned by `cf daemon start`)
 if (process.env.FORGE_DAEMON_FOREGROUND === '1') {
     startDaemon(true).catch((err) => {