@intentius/chant-lexicon-fountain 0.52.0 → 0.52.2

package/dist/import/local-agents.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Re-express a machine's local agent configuration as fountain resources.
+ *
+ * `chant audit --agents` answers "what is configured on this machine". This is
+ * the other half: taking that inventory and turning it into chant code, so a
+ * configuration that accumulated by hand over months becomes a reviewable,
+ * version-controlled, reproducible declaration.
+ *
+ * The mapping is close to 1:1 because fountain's `Agent` models the same four
+ * ideas the harnesses do:
+ *
+ *   | local agent config            | fountain              |
+ *   |-------------------------------|-----------------------|
+ *   | CLAUDE.md / AGENTS.md         | `Agent.system`        |
+ *   | `mcpServers` / `mcp_servers`  | `Agent.mcp_servers`   |
+ *   | `skills/*​/SKILL.md`           | `Agent.skills`        |
+ *   | settings `env`                | `Environment.env_vars`|
+ *
+ * Three places where it is deliberately *not* a transcription:
+ *
+ *  1. **Egress is derived, not copied.** A local agent runs with the machine's
+ *     full network access; a fountain sandbox must declare intent (FTN010). The
+ *     hosts the config's own remote MCP servers use are exactly the egress it
+ *     demonstrably needs, so those become the `allowed_hosts` allowlist and
+ *     everything else is denied. Copying "unrestricted" would launder an
+ *     implicit local permission into an explicit remote one.
+ *  2. **Secrets are not carried over.** A literal credential found in local
+ *     config (AGT002) is rewritten to a `${VAR}` reference in the emitted code.
+ *     Generated chant code gets committed; transcribing a live secret into it
+ *     would turn a local mistake into a repository one.
+ *  3. **Skills are inlined by content where possible.** A local skill is text
+ *     on this machine with no upstream, so `{name, content}` is the only form
+ *     that reproduces it elsewhere. Remote skills keep `{source, ref}`.
+ *
+ * Cursor is discovered by the scanner but has no fountain `runtime` value, so
+ * its sites are reported as skipped rather than silently mapped onto a
+ * different agent runtime.
+ */
+import type { AgentConfigSite, McpServerDecl, SkillDecl } from "@intentius/chant/agents";
+import type { AgentImportOutcome } from "@intentius/chant/agents/importer";
+/** Runtimes fountain's `Agent.runtime` accepts. `cursor` is absent by design. */
+export declare const MAPPABLE_RUNTIMES: readonly ["claude", "codex", "gemini", "opencode"];
+export type MappableRuntime = (typeof MAPPABLE_RUNTIMES)[number];
+/**
+ * Default model per runtime, used when the local config pins none.
+ *
+ * `Agent.model` is required by fountain, and most local configs leave the model
+ * to the harness's own default — a value that isn't written down anywhere this
+ * scanner can read. Emitting a documented default that the user edits is more
+ * honest than inventing a pin and calling it discovered; `unmappedModel` in the
+ * result reports every site this applied to.
+ */
+export declare const DEFAULT_MODEL: Record<MappableRuntime, string>;
+/**
+ * Build the `system` prompt from the site's instruction files.
+ *
+ * Provenance is kept as a comment header per file. A user reading the generated
+ * code needs to know which of their three CLAUDE.md files a paragraph came
+ * from, and a single concatenated blob without headers makes that unrecoverable.
+ */
+export declare function buildSystem(site: AgentConfigSite): string | undefined;
+/** Project the normalized MCP declarations back into fountain's `mcp_servers` map. */
+export declare function toMcpServers(servers: McpServerDecl[], onRedact: () => void): Record<string, unknown> | undefined;
+/**
+ * Project skills into fountain's two accepted forms.
+ *
+ * fountain requires exactly one of `content` or `source` per entry. A local
+ * skill has no upstream to install from, so its text is inlined — that is what
+ * makes the emitted code reproduce the configuration on a machine that has
+ * never seen this one.
+ */
+export declare function toSkills(skills: SkillDecl[]): Record<string, unknown>[] | undefined;
+/**
+ * Hosts the config's own remote MCP servers reach.
+ *
+ * This is the evidence-based egress allowlist: every host here is one the
+ * configuration already talks to, so the sandbox stays functional while
+ * everything else stays denied.
+ */
+export declare function derivedAllowedHosts(servers: McpServerDecl[]): string[];
+/** Canonicalize a local model name into fountain's `provider/model_id` form. */
+export declare function canonicalModel(local: string | undefined, runtime: MappableRuntime): {
+    model: string;
+    defaulted: boolean;
+};
+/**
+ * Convert discovered agent config sites into fountain import IR.
+ *
+ * Each mappable site yields an `Agent`, plus an `Environment` when it has
+ * anything environmental to declare (env vars, or remote MCP hosts to
+ * allowlist). Feed the result to `FountainGenerator` to get chant TypeScript.
+ */
+export declare function sitesToTemplateIR(sites: AgentConfigSite[]): AgentImportOutcome;
+//# sourceMappingURL=local-agents.d.ts.map

package/dist/import/local-agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-agents.d.ts","sourceRoot":"","sources":["../../src/import/local-agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAe,MAAM,kCAAkC,CAAC;AAExF,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,oDAAqD,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAKzD,CAAC;AA0BF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAIrE;AAuGD,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsBhH;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAanF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAYtE;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAKzH;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,kBAAkB,CA8E9E"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "23b006cbf650b74f712e3aab7820cf68cedd67632790ddb795d11694637c596f",
+    "manifest.json": "bace62b6de51e843f06dbc2de56ec34020ca13898a12102e2629971b91c599a8",
     "meta.json": "6666b7a77db9210a329219c6a5e107e5ae8794a34542f7310ce16d9bf95c64f5",
     "types/index.d.ts": "1dfdcba184fffcf464dac7d1d71ef7abed2ae02a8d638c0de50e0b0317b7eb01",
     "rules/ftn001-no-secret-literals.ts": "897a4ce1ec790b3c1540d32892603bd33ff4bf30eb6ba4cd2565dee356d4962e",
@@ -17,5 +17,5 @@
     "skills/chant-fountain-secrets.md": "27e349a91589510a92e518c7d7824a4a322cab5ef242cf5799373a55cbfcd1cd",
     "skills/chant-fountain-locked-sandboxes.md": "de82f06cb3a08ba6bf3ae45fb9869e21d6da18b9ebe0fc769da8aebaceea7dd1"
   },
-  "composite": "7d43b99109b6b29a2e9394893336f33bb7e92eb4089f341afb308ac3636594d0"
+  "composite": "4ab7aac826621cd338e16b85a2d8be23007185e49d3e71aef7ad3e533e9560ec"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fountain",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "chantVersion": ">=0.1.0",
   "namespace": "Fountain",
   "specVersion": "v0.3.0"

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAuB7F;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,aA0J5B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAwB7F;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,aA8J5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fountain",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "type": "module",
   "description": "Fountain lexicon for chant — sandboxed agent environments, vaults, and agents as typed estate",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "bundle": "tsx src/package-cli.ts"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.52.0",
+    "@intentius/chant": "^0.52.2",
     "typescript": "^5.9.3"
   },
   "devDependencies": {

package/src/import/generator.ts

@@ -82,11 +82,27 @@ function formatNested(value: unknown, indent: number, spec: Nested, imports: Set
   return `[\n${items.join("\n")}\n${closePad}]`;
 }
 
+/**
+ * A cross-resource reference in the IR: `{__ref: "<logicalId>"}` renders as the
+ * bare variable name that resource was declared under, so `agent.environment`
+ * comes out as a typed ref (`environment: userClaudeEnv`) rather than a copy of
+ * the environment's properties. Mirrors the `__intrinsic` sentinel the
+ * CloudFormation importer uses for `Ref`.
+ */
+function asRef(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const ref = (value as Record<string, unknown>).__ref;
+  return typeof ref === "string" ? ref : undefined;
+}
+
 function formatValue(value: unknown, indent: number): string {
   if (value === null || value === undefined) return "undefined";
   if (typeof value === "string") return JSON.stringify(value);
   if (typeof value === "number" || typeof value === "boolean") return String(value);
 
+  const ref = asRef(value);
+  if (ref !== undefined) return camelCase(ref);
+
   if (Array.isArray(value)) {
     if (value.length === 0) return "[]";
     const pad = "  ".repeat(indent + 1);

package/src/import/local-agents.test.ts

@@ -0,0 +1,216 @@
+/**
+ * The mapper's contract is that generated code is safe to commit and faithful
+ * to the config it came from — in that order.
+ *
+ * The redaction tests are the load-bearing ones. Running the importer against a
+ * real machine produced `Authorization: "Bearer rnd_…"` in the output: a live
+ * token written into a file whose whole point is to be checked into version
+ * control. Every path that can carry a credential is covered here.
+ */
+
+import { describe, test, expect } from "vitest";
+import { sitesToTemplateIR, derivedAllowedHosts, canonicalModel, buildSystem, toSkills, DEFAULT_MODEL } from "./local-agents";
+import { FountainGenerator } from "./generator";
+import type { AgentConfigSite } from "@intentius/chant/agents";
+
+function site(overrides: Partial<AgentConfigSite> = {}): AgentConfigSite {
+  return {
+    id: "user-claude",
+    scope: "user",
+    runtime: "claude",
+    root: "/home/u",
+    sources: ["/home/u/.claude/settings.json"],
+    instructions: [],
+    mcpServers: [],
+    skills: [],
+    subagents: [],
+    commands: [],
+    plugins: [],
+    env: {},
+    settings: {},
+    ...overrides,
+  };
+}
+
+/** The generated `Agent` resource for a single-site conversion. */
+function agentOf(s: AgentConfigSite) {
+  const { ir } = sitesToTemplateIR([s]);
+  const agent = ir.resources.find((r) => r.type === "Fountain::V1::Agent");
+  if (!agent) throw new Error("no Agent resource generated");
+  return agent;
+}
+
+describe("runtime mapping", () => {
+  test("maps the four runtimes fountain accepts", () => {
+    for (const runtime of ["claude", "codex", "gemini", "opencode"] as const) {
+      const { ir, skipped } = sitesToTemplateIR([site({ id: `user-${runtime}`, runtime })]);
+      expect(skipped).toEqual([]);
+      expect(ir.resources[0].properties.runtime).toBe(runtime);
+    }
+  });
+
+  test("skips cursor with a stated reason rather than mapping it onto another runtime", () => {
+    const { ir, skipped } = sitesToTemplateIR([site({ id: "user-cursor", runtime: "cursor" })]);
+    expect(ir.resources).toEqual([]);
+    expect(skipped[0].siteId).toBe("user-cursor");
+    expect(skipped[0].reason).toContain("cursor");
+  });
+});
+
+describe("model canonicalization", () => {
+  test("expands a harness alias to fountain's provider/model_id form", () => {
+    expect(canonicalModel("opus", "claude")).toEqual({ model: "anthropic/claude-opus-4-6", defaulted: false });
+  });
+
+  test("passes an already-qualified model through untouched", () => {
+    expect(canonicalModel("anthropic/claude-sonnet-4-6", "claude").model).toBe("anthropic/claude-sonnet-4-6");
+  });
+
+  test("defaults when the local config pins no model, and reports having done so", () => {
+    const { unmappedModel } = sitesToTemplateIR([site()]);
+    expect(unmappedModel).toEqual(["user-claude"]);
+    expect(agentOf(site()).properties.model).toBe(DEFAULT_MODEL.claude);
+  });
+});
+
+describe("secret redaction", () => {
+  test("replaces a literal token in env with an env reference", () => {
+    const s = site({ mcpServers: [{ name: "api", transport: "stdio", source: "/c", command: "x", env: { API_KEY: "sk-ant-abcdefghijklmnopqrstuvwxyz01" } }] });
+    const servers = agentOf(s).properties.mcp_servers as Record<string, { env: Record<string, string> }>;
+    expect(servers.api.env.API_KEY).toBe("${API_KEY}");
+    expect(sitesToTemplateIR([s]).redactedSecrets).toEqual(["user-claude"]);
+  });
+
+  test("replaces a bearer token in headers, which arrive via `extra`", () => {
+    // The regression that motivated this file: `extra` was copied verbatim, so
+    // a live token landed in code destined for version control.
+    const s = site({
+      mcpServers: [{ name: "nebula", transport: "http", source: "/c", url: "https://n/mcp", extra: { headers: { Authorization: "Bearer nbla_xbIEER2743B8Csrs" } } }],
+    });
+    const servers = agentOf(s).properties.mcp_servers as Record<string, { headers: Record<string, string> }>;
+    expect(servers.nebula.headers.Authorization).toBe("${NEBULA_AUTH_TOKEN}");
+  });
+
+  test("namespaces a redacted header by server, so two servers don't collide", () => {
+    const s = site({
+      mcpServers: [
+        { name: "render", transport: "http", source: "/c", url: "https://r/mcp", extra: { headers: { Authorization: "Bearer rnd_aaaaaaaaaaaaaaaaa" } } },
+        { name: "xhawk", transport: "http", source: "/c", url: "https://x/mcp", extra: { headers: { Authorization: "Bearer xhk_bbbbbbbbbbbbbbbbb" } } },
+      ],
+    });
+    const servers = agentOf(s).properties.mcp_servers as Record<string, { headers: Record<string, string> }>;
+    expect(servers.render.headers.Authorization).toBe("${RENDER_AUTH_TOKEN}");
+    expect(servers.xhawk.headers.Authorization).toBe("${XHAWK_AUTH_TOKEN}");
+  });
+
+  test("does not double-prefix a key that already names its server", () => {
+    const s = site({
+      mcpServers: [{ name: "cleanjobdata", transport: "stdio", source: "/c", command: "x", env: { CLEANJOBDATA_API_KEY: "0123456789abcdefghijklmnopqrstuvwxyz" } }],
+    });
+    const servers = agentOf(s).properties.mcp_servers as Record<string, { env: Record<string, string> }>;
+    expect(servers.cleanjobdata.env.CLEANJOBDATA_API_KEY).toBe("${CLEANJOBDATA_API_KEY}");
+  });
+
+  test("leaves non-secret configuration alone", () => {
+    const s = site({ mcpServers: [{ name: "api", transport: "stdio", source: "/c", command: "x", env: { LOG_LEVEL: "debug" } }] });
+    const servers = agentOf(s).properties.mcp_servers as Record<string, { env: Record<string, string> }>;
+    expect(servers.api.env.LOG_LEVEL).toBe("debug");
+    expect(sitesToTemplateIR([s]).redactedSecrets).toEqual([]);
+  });
+
+  test("no generated output contains a value that looked like a credential", () => {
+    const s = site({
+      env: { GLOBAL_TOKEN: "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" },
+      mcpServers: [{ name: "a", transport: "http", source: "/c", url: "https://a/mcp", extra: { headers: { Authorization: "Bearer secret-value-here-000" } } }],
+    });
+    const [file] = new FountainGenerator().generate(sitesToTemplateIR([s]).ir);
+    expect(file.content).not.toContain("ghp_");
+    expect(file.content).not.toContain("secret-value-here");
+  });
+});
+
+describe("environment derivation", () => {
+  test("derives the egress allowlist from the config's own remote MCP hosts", () => {
+    expect(
+      derivedAllowedHosts([
+        { name: "a", transport: "http", source: "/c", url: "https://mcp.posthog.com/mcp" },
+        { name: "b", transport: "http", source: "/c", url: "https://mcp.render.com/mcp" },
+        { name: "c", transport: "stdio", source: "/c", command: "local" },
+      ]),
+    ).toEqual(["mcp.posthog.com", "mcp.render.com"]);
+  });
+
+  test("emits an Environment with explicit limited networking (FTN010)", () => {
+    const s = site({ mcpServers: [{ name: "a", transport: "http", source: "/c", url: "https://x.dev/mcp" }] });
+    const { ir } = sitesToTemplateIR([s]);
+    const env = ir.resources.find((r) => r.type === "Fountain::V1::Environment");
+    expect(env?.properties.networking_type).toBe("limited");
+    expect(env?.properties.networking_config).toEqual({ allowed_hosts: ["x.dev"] });
+  });
+
+  test("omits the Environment when there is nothing environmental to declare", () => {
+    const { ir } = sitesToTemplateIR([site()]);
+    expect(ir.resources.filter((r) => r.type === "Fountain::V1::Environment")).toEqual([]);
+    expect(ir.resources[0].properties.environment).toBeUndefined();
+  });
+
+  test("links the Agent to its Environment by reference, not by copy", () => {
+    const s = site({ env: { A: "1" } });
+    const [file] = new FountainGenerator().generate(sitesToTemplateIR([s]).ir);
+    // A typed ref renders as the variable name the Environment was declared under.
+    expect(file.content).toContain("environment: userClaudeEnv");
+  });
+});
+
+describe("system prompt", () => {
+  test("uses the single instruction file verbatim", () => {
+    expect(buildSystem(site({ instructions: [{ path: "/a", content: "be brief\n", bytes: 9 }] }))).toBe("be brief");
+  });
+
+  test("keeps per-file provenance when several files merge", () => {
+    const system = buildSystem(
+      site({ instructions: [{ path: "/a", content: "one", bytes: 3 }, { path: "/b", content: "two", bytes: 3 }] }),
+    );
+    expect(system).toContain("# /a");
+    expect(system).toContain("# /b");
+  });
+
+  test("is undefined when there are no instructions", () => {
+    expect(buildSystem(site())).toBeUndefined();
+  });
+});
+
+describe("skills", () => {
+  test("inlines a local skill's content, the only form that reproduces it elsewhere", () => {
+    expect(toSkills([{ name: "s", origin: "local", path: "/p", content: "do the thing" }])).toEqual([
+      { name: "s", content: "do the thing" },
+    ]);
+  });
+
+  test("keeps a remote skill as a source, with its ref when pinned", () => {
+    expect(toSkills([{ name: "s", origin: "marketplace", source: "o/r", ref: "v1" }])).toEqual([
+      { source: "o/r", name: "s", ref: "v1" },
+    ]);
+  });
+
+  test("drops a skill with neither content nor source rather than emitting one fountain would reject", () => {
+    expect(toSkills([{ name: "s", origin: "local" }])).toBeUndefined();
+  });
+});
+
+describe("end-to-end", () => {
+  test("generates compilable-shaped chant code with the ownership marker", () => {
+    const s = site({
+      model: "opus",
+      instructions: [{ path: "/home/u/CLAUDE.md", content: "be brief", bytes: 8 }],
+      mcpServers: [{ name: "posthog", transport: "http", source: "/c", url: "https://mcp.posthog.com/mcp" }],
+      skills: [{ name: "deploy", origin: "local", path: "/p", content: "steps" }],
+    });
+    const [file] = new FountainGenerator().generate(sitesToTemplateIR([s]).ir);
+    expect(file.path).toBe("main.ts");
+    expect(file.content).toContain('import { Agent, Environment } from "@intentius/chant-lexicon-fountain";');
+    expect(file.content).toContain("export const userClaude = new Agent({");
+    expect(file.content).toContain('"managed-by": "chant"');
+    expect(file.content).toContain('runtime: "claude"');
+  });
+});

package/src/import/local-agents.ts

@@ -0,0 +1,364 @@
+/**
+ * Re-express a machine's local agent configuration as fountain resources.
+ *
+ * `chant audit --agents` answers "what is configured on this machine". This is
+ * the other half: taking that inventory and turning it into chant code, so a
+ * configuration that accumulated by hand over months becomes a reviewable,
+ * version-controlled, reproducible declaration.
+ *
+ * The mapping is close to 1:1 because fountain's `Agent` models the same four
+ * ideas the harnesses do:
+ *
+ *   | local agent config            | fountain              |
+ *   |-------------------------------|-----------------------|
+ *   | CLAUDE.md / AGENTS.md         | `Agent.system`        |
+ *   | `mcpServers` / `mcp_servers`  | `Agent.mcp_servers`   |
+ *   | `skills/*​/SKILL.md`           | `Agent.skills`        |
+ *   | settings `env`                | `Environment.env_vars`|
+ *
+ * Three places where it is deliberately *not* a transcription:
+ *
+ *  1. **Egress is derived, not copied.** A local agent runs with the machine's
+ *     full network access; a fountain sandbox must declare intent (FTN010). The
+ *     hosts the config's own remote MCP servers use are exactly the egress it
+ *     demonstrably needs, so those become the `allowed_hosts` allowlist and
+ *     everything else is denied. Copying "unrestricted" would launder an
+ *     implicit local permission into an explicit remote one.
+ *  2. **Secrets are not carried over.** A literal credential found in local
+ *     config (AGT002) is rewritten to a `${VAR}` reference in the emitted code.
+ *     Generated chant code gets committed; transcribing a live secret into it
+ *     would turn a local mistake into a repository one.
+ *  3. **Skills are inlined by content where possible.** A local skill is text
+ *     on this machine with no upstream, so `{name, content}` is the only form
+ *     that reproduces it elsewhere. Remote skills keep `{source, ref}`.
+ *
+ * Cursor is discovered by the scanner but has no fountain `runtime` value, so
+ * its sites are reported as skipped rather than silently mapped onto a
+ * different agent runtime.
+ */
+
+import type { ResourceIR } from "@intentius/chant/import/parser";
+import type { AgentConfigSite, McpServerDecl, SkillDecl } from "@intentius/chant/agents";
+import type { AgentImportOutcome, SkippedSite } from "@intentius/chant/agents/importer";
+
+/** Runtimes fountain's `Agent.runtime` accepts. `cursor` is absent by design. */
+export const MAPPABLE_RUNTIMES = ["claude", "codex", "gemini", "opencode"] as const;
+export type MappableRuntime = (typeof MAPPABLE_RUNTIMES)[number];
+
+/**
+ * Default model per runtime, used when the local config pins none.
+ *
+ * `Agent.model` is required by fountain, and most local configs leave the model
+ * to the harness's own default — a value that isn't written down anywhere this
+ * scanner can read. Emitting a documented default that the user edits is more
+ * honest than inventing a pin and calling it discovered; `unmappedModel` in the
+ * result reports every site this applied to.
+ */
+export const DEFAULT_MODEL: Record<MappableRuntime, string> = {
+  claude: "anthropic/claude-sonnet-4-6",
+  codex: "openai/gpt-5.1-codex",
+  gemini: "google/gemini-2.5-pro",
+  opencode: "anthropic/claude-sonnet-4-6",
+};
+
+/**
+ * Local model aliases → fountain's `provider/model_id` form.
+ *
+ * Harnesses accept short names (`opus`, `sonnet`); fountain wants the canonical
+ * id. An alias not listed here passes through untouched — a user who pinned an
+ * exact provider-qualified model already has the right shape.
+ */
+const MODEL_ALIASES: Record<string, string> = {
+  opus: "anthropic/claude-opus-4-6",
+  sonnet: "anthropic/claude-sonnet-4-6",
+  haiku: "anthropic/claude-haiku-4-5",
+  "gpt-5.5": "openai/gpt-5.5",
+  "gpt-5.1-codex": "openai/gpt-5.1-codex",
+};
+
+function isMappable(runtime: string): runtime is MappableRuntime {
+  return (MAPPABLE_RUNTIMES as readonly string[]).includes(runtime);
+}
+
+/** A cross-resource reference the fountain generator renders as a bare variable. */
+function ref(logicalId: string): { __ref: string } {
+  return { __ref: logicalId };
+}
+
+/**
+ * Build the `system` prompt from the site's instruction files.
+ *
+ * Provenance is kept as a comment header per file. A user reading the generated
+ * code needs to know which of their three CLAUDE.md files a paragraph came
+ * from, and a single concatenated blob without headers makes that unrecoverable.
+ */
+export function buildSystem(site: AgentConfigSite): string | undefined {
+  if (site.instructions.length === 0) return undefined;
+  if (site.instructions.length === 1) return site.instructions[0].content.trim();
+  return site.instructions.map((f) => `# ${f.path}\n\n${f.content.trim()}`).join("\n\n---\n\n");
+}
+
+/** Env-var reference form for a value that must not be inlined. */
+function envRef(key: string): string {
+  return `\${${key}}`;
+}
+
+/** Value shapes that are already indirection rather than a literal. */
+const INDIRECT = /^\s*(?:\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*|\$\(.+\))\s*$/;
+const SECRET_KEY = /(?:^|_)(?:token|secret|password|passwd|api_?key|access_?key|credential|private_?key)s?(?:$|_)/i;
+const DIGEST_KEY = /(?:sha\d*|checksum|digest|fingerprint|thumbprint|hash|etag)/i;
+
+/**
+ * Header and field names that carry a credential without ever saying "token".
+ *
+ * `Authorization` is the important one: it is where remote MCP servers put
+ * their bearer tokens, it matches none of the "looks like a secret" key
+ * heuristics, and it is the single most likely thing in an agent config to be a
+ * live credential.
+ */
+const AUTH_KEY = /^(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api-key|apikey|x-auth-token|auth)$/i;
+
+/** An HTTP authorization value: a scheme followed by the credential itself. */
+const AUTH_SCHEME_VALUE = /^\s*(?:Bearer|Basic|Token|ApiKey)\s+\S+/i;
+
+/**
+ * The env-var name a redacted value is replaced with. Namespaced by the thing
+ * it belongs to, so two servers' `Authorization` headers don't collapse onto
+ * one variable that can only hold one of them.
+ */
+function secretVarName(context: string, key: string): string {
+  const norm = (s: string) => s.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const scope = norm(context);
+  const name = norm(key);
+  // A header like `Authorization` says nothing on its own, so it takes the
+  // server's name. A key that already carries it (`CLEANJOBDATA_API_KEY` on the
+  // `cleanjobdata` server) is left alone rather than doubled.
+  if (AUTH_KEY.test(key)) return `${scope}_AUTH_TOKEN`;
+  return name.includes(scope) || scope.includes(name) ? name : `${scope}_${name}`;
+}
+
+/**
+ * Decide whether a value is a literal credential that must not be written to
+ * disk, and if so, what to replace it with.
+ *
+ * Deliberately more eager than the audit check: this decides what gets written
+ * into a file destined for version control, so a false positive costs the user
+ * one edit while a false negative commits a live secret.
+ */
+function redactedValue(key: string, value: string, context: string): string | undefined {
+  if (INDIRECT.test(value)) return undefined;
+  if (DIGEST_KEY.test(key)) return undefined;
+  if (AUTH_KEY.test(key) || AUTH_SCHEME_VALUE.test(value)) return envRef(secretVarName(context, key));
+  if (SECRET_KEY.test(key) || value.length >= 32) return envRef(secretVarName(context, key));
+  return undefined;
+}
+
+/** Replace literal credential values in a flat string map with `${VAR}` references. */
+function redactEnv(
+  env: Record<string, string> | undefined,
+  context: string,
+  onRedact: () => void,
+): Record<string, string> | undefined {
+  if (!env) return undefined;
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env)) {
+    const replacement = redactedValue(key, value, context);
+    if (replacement !== undefined) {
+      out[key] = replacement;
+      onRedact();
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * Redact credentials anywhere in a nested structure.
+ *
+ * The passthrough fields a harness accepts (`headers`, auth blocks, whatever a
+ * future version adds) are exactly the ones this model does not name, so
+ * redaction cannot be a fixed list of keys — it has to walk whatever is there.
+ * Everything non-credential is preserved verbatim.
+ */
+function redactDeep(value: unknown, key: string, context: string, onRedact: () => void): unknown {
+  if (typeof value === "string") {
+    const replacement = redactedValue(key, value, context);
+    if (replacement === undefined) return value;
+    onRedact();
+    return replacement;
+  }
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, key, context, onRedact));
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      out[k] = redactDeep(v, k, context, onRedact);
+    }
+    return out;
+  }
+  return value;
+}
+
+/** Project the normalized MCP declarations back into fountain's `mcp_servers` map. */
+export function toMcpServers(servers: McpServerDecl[], onRedact: () => void): Record<string, unknown> | undefined {
+  if (servers.length === 0) return undefined;
+  const out: Record<string, unknown> = {};
+  for (const server of servers) {
+    const entry: Record<string, unknown> = {};
+    if (server.command) entry.command = server.command;
+    if (server.args?.length) entry.args = server.args;
+    if (server.url) entry.url = server.url;
+    if (server.transport === "sse" || server.transport === "http") entry.type = server.transport;
+    const env = redactEnv(server.env, server.name, onRedact);
+    if (env && Object.keys(env).length > 0) entry.env = env;
+    // `extra` is where `headers` (and anything else the harness accepted that
+    // this model doesn't name) lands — so it gets the same redaction as `env`,
+    // not a verbatim copy.
+    if (server.extra) {
+      for (const [key, value] of Object.entries(server.extra)) {
+        entry[key] = redactDeep(value, key, server.name, onRedact);
+      }
+    }
+    out[server.name] = entry;
+  }
+  return out;
+}
+
+/**
+ * Project skills into fountain's two accepted forms.
+ *
+ * fountain requires exactly one of `content` or `source` per entry. A local
+ * skill has no upstream to install from, so its text is inlined — that is what
+ * makes the emitted code reproduce the configuration on a machine that has
+ * never seen this one.
+ */
+export function toSkills(skills: SkillDecl[]): Record<string, unknown>[] | undefined {
+  if (skills.length === 0) return undefined;
+  const out: Record<string, unknown>[] = [];
+  for (const skill of skills) {
+    if (skill.source) {
+      out.push({ source: skill.source, name: skill.name, ...(skill.ref ? { ref: skill.ref } : {}) });
+    } else if (skill.content) {
+      out.push({ name: skill.name, content: skill.content });
+    }
+    // A skill with neither is unreproducible; it is left out rather than
+    // emitted as an entry fountain would reject at apply time.
+  }
+  return out.length > 0 ? out : undefined;
+}
+
+/**
+ * Hosts the config's own remote MCP servers reach.
+ *
+ * This is the evidence-based egress allowlist: every host here is one the
+ * configuration already talks to, so the sandbox stays functional while
+ * everything else stays denied.
+ */
+export function derivedAllowedHosts(servers: McpServerDecl[]): string[] {
+  const hosts = new Set<string>();
+  for (const server of servers) {
+    if (!server.url) continue;
+    try {
+      hosts.add(new URL(server.url).hostname);
+    } catch {
+      // A malformed URL contributes no host — the server simply isn't reachable
+      // from the sandbox until someone adds the right one by hand.
+    }
+  }
+  return [...hosts].sort();
+}
+
+/** Canonicalize a local model name into fountain's `provider/model_id` form. */
+export function canonicalModel(local: string | undefined, runtime: MappableRuntime): { model: string; defaulted: boolean } {
+  if (!local) return { model: DEFAULT_MODEL[runtime], defaulted: true };
+  const alias = MODEL_ALIASES[local.toLowerCase()];
+  if (alias) return { model: alias, defaulted: false };
+  return { model: local, defaulted: false };
+}
+
+/**
+ * Convert discovered agent config sites into fountain import IR.
+ *
+ * Each mappable site yields an `Agent`, plus an `Environment` when it has
+ * anything environmental to declare (env vars, or remote MCP hosts to
+ * allowlist). Feed the result to `FountainGenerator` to get chant TypeScript.
+ */
+export function sitesToTemplateIR(sites: AgentConfigSite[]): AgentImportOutcome {
+  const resources: ResourceIR[] = [];
+  const skipped: SkippedSite[] = [];
+  const unmappedModel: string[] = [];
+  const redactedSecrets: string[] = [];
+
+  for (const site of sites) {
+    if (!isMappable(site.runtime)) {
+      skipped.push({
+        siteId: site.id,
+        reason: `fountain has no "${site.runtime}" runtime — its Agent.runtime accepts ${MAPPABLE_RUNTIMES.join(", ")}. The config was audited but not re-expressed.`,
+      });
+      continue;
+    }
+
+    let redacted = false;
+    const onRedact = () => {
+      redacted = true;
+    };
+
+    const { model, defaulted } = canonicalModel(site.model, site.runtime);
+    if (defaulted) unmappedModel.push(site.id);
+
+    const allowedHosts = derivedAllowedHosts(site.mcpServers);
+    const envVars = redactEnv(site.env, site.id, onRedact) ?? {};
+    const hasEnvironment = Object.keys(envVars).length > 0 || allowedHosts.length > 0;
+
+    const metadata: Record<string, unknown> = {
+      "managed-by": "chant",
+      "chant.io/imported-from": "local-agent-config",
+      "chant.io/scope": site.scope,
+      "chant.io/runtime": site.runtime,
+      "chant.io/root": site.root,
+    };
+
+    let environmentId: string | undefined;
+    if (hasEnvironment) {
+      environmentId = `${site.id}-env`;
+      resources.push({
+        logicalId: environmentId,
+        type: "Fountain::V1::Environment",
+        properties: {
+          name: environmentId,
+          // FTN010: intent must be explicit. `limited` with a derived
+          // allowlist — an empty list is deny-all, which is the right default
+          // for a config whose network needs we could not observe.
+          networking_type: "limited",
+          networking_config: { allowed_hosts: allowedHosts },
+          ...(Object.keys(envVars).length > 0 ? { env_vars: envVars } : {}),
+          metadata,
+        },
+      });
+    }
+
+    const mcpServers = toMcpServers(site.mcpServers, onRedact);
+    const skills = toSkills(site.skills);
+    const system = buildSystem(site);
+
+    resources.push({
+      logicalId: site.id,
+      type: "Fountain::V1::Agent",
+      properties: {
+        name: site.id,
+        model,
+        runtime: site.runtime,
+        ...(environmentId ? { environment: ref(environmentId) } : {}),
+        ...(system !== undefined ? { system } : {}),
+        ...(mcpServers ? { mcp_servers: mcpServers } : {}),
+        ...(skills ? { skills } : {}),
+        description: `Imported from ${site.scope}-scope ${site.runtime} configuration at ${site.root}`,
+        metadata,
+      },
+    });
+
+    if (redacted) redactedSecrets.push(site.id);
+  }
+
+  return { ir: { resources, parameters: [] }, skipped, unmappedModel, redactedSecrets };
+}

package/src/plugin.ts

@@ -18,6 +18,7 @@ import { detectFountainTemplate } from "./detect";
 import { fountainInitTemplates } from "./init-templates";
 import { FountainParser } from "./import/parser";
 import { FountainGenerator } from "./import/generator";
+import { sitesToTemplateIR } from "./import/local-agents";
 import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
 
@@ -156,6 +157,10 @@ export const fountainPlugin: LexiconPlugin = {
     return new FountainGenerator();
   },
 
+  agentConfigImporter() {
+    return { toTemplateIR: sitesToTemplateIR };
+  },
+
   async exportResources(options) {
     const { exportResources } = await import("./export-resources");
     return exportResources(options);