@intutic/cli 0.1.1 → 1.0.4

package/dist/commands/enterprise-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise-install.d.ts","sourceRoot":"","sources":["../../src/commands/enterprise-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA+OH;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhB"}

package/dist/commands/enterprise-install.js

@@ -0,0 +1,289 @@
+/**
+ * enterprise-install.ts — `intutic enterprise-install` CLI command.
+ *
+ * Requires elevated privileges (sudo on macOS/Linux, admin on Windows).
+ * Writes system-level governance hooks that survive user-level tampering:
+ *
+ *   macOS:
+ *     - /etc/cursor/hooks.json (system Cursor hooks)
+ *     - System keychain CA trust entry for Intutic proxy CA cert
+ *     - MDM configuration profile generator
+ *
+ *   Linux:
+ *     - /etc/cursor/hooks.json
+ *     - /usr/local/share/ca-certificates/intutic-ca.crt + update-ca-certificates
+ *
+ *   Windows:
+ *     - certutil -addstore Root intutic-ca.crt
+ *     - HKLM registry-based Cursor hooks (via PowerShell)
+ *
+ * Usage: sudo intutic enterprise-install
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * @module
+ */
+import { writeFile, mkdir, readFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { newIso } from '@intutic/id';
+import { createLogger } from '@intutic/logger';
+import { writeCursorHooks } from '@intutic/sync-daemon/harness/cursorHooks';
+const log = createLogger('enterprise-install');
+const execFileAsync = promisify(execFile);
+/** Check if running with root/admin privileges. */
+function isElevated() {
+    if (process.platform === 'win32') {
+        // On Windows, check if we have admin rights (heuristic)
+        return process.env.USERNAME === 'Administrator' || process.env.IS_ADMIN === '1';
+    }
+    return process.getuid?.() === 0;
+}
+/** Platform-specific system Cursor hooks path. */
+function systemCursorHooksPath() {
+    if (process.platform === 'darwin') {
+        return '/Library/Application Support/Cursor/hooks.json';
+    }
+    return '/etc/cursor/hooks.json';
+}
+/** Platform-specific CA injection command. */
+async function injectCaCert(caCertPath) {
+    switch (process.platform) {
+        case 'darwin':
+            await execFileAsync('security', [
+                'add-trusted-cert', '-d', '-r', 'trustRoot',
+                '-k', '/Library/Keychains/System.keychain',
+                caCertPath,
+            ]);
+            log.info({ action: 'ca_injected', platform: 'darwin' }, 'CA cert added to macOS System Keychain');
+            break;
+        case 'linux': {
+            const destCert = '/usr/local/share/ca-certificates/intutic-ca.crt';
+            const content = await readFile(caCertPath, 'utf-8');
+            await writeFile(destCert, content, 'utf-8');
+            await execFileAsync('update-ca-certificates');
+            log.info({ action: 'ca_injected', platform: 'linux' }, 'CA cert added via update-ca-certificates');
+            break;
+        }
+        case 'win32':
+            await execFileAsync('certutil', ['-addstore', 'Root', caCertPath]);
+            log.info({ action: 'ca_injected', platform: 'win32' }, 'CA cert added to Windows Root store');
+            break;
+        default:
+            log.warn({ action: 'ca_inject_skipped', platform: process.platform }, 'CA injection not supported on this platform');
+    }
+}
+/** Write system-level Cursor hooks.json (requires root). */
+async function writeSystemCursorHooks(proxyUrl, workspaceRoot) {
+    const systemPath = systemCursorHooksPath();
+    await mkdir(systemPath.substring(0, systemPath.lastIndexOf('/')), { recursive: true });
+    // Delegate to cursorHooks.ts with writeSystemLevel=true
+    await writeCursorHooks(workspaceRoot, proxyUrl, '', true);
+    log.info({ action: 'system_cursor_hooks_written', path: systemPath }, 'System-level Cursor hooks written');
+}
+/** Generate MDM deployment manifest for Cursor. */
+async function generateMdmManifest(proxyUrl, outputDir) {
+    await mkdir(outputDir, { recursive: true });
+    // Cursor hooks MDM manifest (JSON — deployable via Jamf, Intune, Chef)
+    const cursorManifest = {
+        _comment: 'Intutic Governance — Cursor system-level hooks.json for MDM deployment',
+        _generated: newIso(),
+        target_path: systemCursorHooksPath(),
+        content: {
+            failClosed: true,
+            hooks: {
+                beforeShellExecution: {
+                    command: 'node /opt/intutic/hooks/pre-tool-check.js',
+                    failClosed: true,
+                },
+                beforeMCPExecution: {
+                    command: 'node /opt/intutic/hooks/pre-tool-check.js',
+                    failClosed: true,
+                },
+                beforeFileEdit: {
+                    command: 'node /opt/intutic/hooks/pre-tool-check.js',
+                    failClosed: true,
+                },
+            },
+        },
+        deployment: {
+            jamf: 'Deploy as Extension Attribute with file target_path',
+            intune: 'Custom Configuration Profile > Files > target_path',
+            chef: 'cookbook: intutic-governance, recipe: cursor_hooks',
+        },
+    };
+    await writeFile(join(outputDir, 'cursor-hooks-manifest.json'), JSON.stringify(cursorManifest, null, 2), 'utf-8');
+    // Windsurf proxy settings MDM manifest
+    const windsurfManifest = {
+        _comment: 'Intutic Governance — Windsurf proxy settings for MDM deployment',
+        _generated: newIso(),
+        target_path: `${homedir()}/.codeium/windsurf/settings.json`,
+        note: 'User-level path — deploy per user via login script or MDM user config',
+        content: {
+            'http.proxy': 'http://127.0.0.1:8877',
+            'http.proxyStrictSSL': false,
+            'codeium.proxy': 'http://127.0.0.1:8877',
+        },
+    };
+    await writeFile(join(outputDir, 'windsurf-proxy-manifest.json'), JSON.stringify(windsurfManifest, null, 2), 'utf-8');
+    // macOS MDM configuration profile for CA trust + proxy
+    const mobileconfig = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Intutic Governance Proxy MDM Configuration Profile -->
+<!-- Deploy via Jamf, Apple Business Manager, or profiles install -->
+<!-- Generated: ${newIso()} -->
+<plist version="1.0">
+<dict>
+  <key>PayloadContent</key>
+  <array>
+    <dict>
+      <!-- CA Trust payload -->
+      <key>PayloadType</key>
+      <string>com.apple.security.root</string>
+      <key>PayloadIdentifier</key>
+      <string>ai.intutic.governance.ca</string>
+      <key>PayloadDisplayName</key>
+      <string>Intutic Governance Proxy CA</string>
+      <key>PayloadDescription</key>
+      <string>Trusts the Intutic local CA for AI traffic governance</string>
+      <key>PayloadVersion</key>
+      <integer>1</integer>
+      <key>PayloadUUID</key>
+      <string>4E89D13A-B6C2-4F1D-9E2A-7F3C5A8B2E6D</string>
+    </dict>
+    <dict>
+      <!-- System-wide HTTP proxy for Windsurf Cascade AI traffic -->
+      <key>PayloadType</key>
+      <string>com.apple.proxy.http</string>
+      <key>PayloadIdentifier</key>
+      <string>ai.intutic.governance.proxy</string>
+      <key>PayloadDisplayName</key>
+      <string>Intutic AI Governance Proxy</string>
+      <key>Enabled</key>
+      <true/>
+      <key>Server</key>
+      <string>127.0.0.1</string>
+      <key>Port</key>
+      <integer>8877</integer>
+      <key>ProxyType</key>
+      <string>HTTP</string>
+    </dict>
+  </array>
+  <key>PayloadDisplayName</key>
+  <string>Intutic AI Governance Proxy Configuration</string>
+  <key>PayloadIdentifier</key>
+  <string>ai.intutic.governance</string>
+  <key>PayloadType</key>
+  <string>Configuration</string>
+  <key>PayloadVersion</key>
+  <integer>1</integer>
+  <key>PayloadUUID</key>
+  <string>8A1C3F5E-D2B4-4A6C-8E0F-1D3B5A7C9E2F</string>
+</dict>
+</plist>`;
+    await writeFile(join(outputDir, 'intutic-governance.mobileconfig'), mobileconfig, 'utf-8');
+    log.info({ action: 'mdm_manifests_generated', outputDir }, 'MDM deployment manifests generated');
+}
+/** Generate pf (macOS) and iptables (Linux) firewall rules templates. */
+async function generateFirewallTemplates(outputDir) {
+    await mkdir(outputDir, { recursive: true });
+    // pf.conf template (macOS)
+    const pfConf = `# Intutic PF Firewall redirection rules for macOS
+# Redirects direct outbound traffic to AI providers to the local Intutic proxy (port 4000).
+# To load: sudo pfctl -f ${join(outputDir, 'pf.conf')}
+
+# AI Provider hostnames
+ai_hosts = "{ api.anthropic.com, api.openai.com, api2.cursor.sh, openrouter.ai, api.mistral.ai, api.cohere.com, api.together.xyz, generativelanguage.googleapis.com }"
+
+# Redirection rule: redirect outbound HTTPS traffic to these hosts to localhost:4000
+# To avoid loop, do not redirect traffic originating from the local proxy process itself (exclude user running the proxy)
+# Update 'intutic' to the user/UID running the proxy if needed.
+# rdr pass on lo0 proto tcp from any to $ai_hosts port 443 -> 127.0.0.1 port 4000 user intutic
+rdr pass on lo0 proto tcp from any to $ai_hosts port 443 -> 127.0.0.1 port 4000
+rdr pass on en0 proto tcp from any to $ai_hosts port 443 -> 127.0.0.1 port 4000
+rdr pass on en1 proto tcp from any to $ai_hosts port 443 -> 127.0.0.1 port 4000
+`;
+    await writeFile(join(outputDir, 'pf.conf'), pfConf, 'utf-8');
+    // iptables.rules template (Linux)
+    const iptablesRules = `# Intutic iptables redirection rules for Linux
+# Redirects direct outbound HTTPS traffic to AI providers to the local Intutic proxy (port 4000).
+# Load with: sudo iptables-restore < ${join(outputDir, 'iptables.rules')}
+
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+
+# Create INTUTIC chain
+-N INTUTIC
+
+# Redirect to local proxy port 4000
+-A INTUTIC -p tcp --dport 443 -j REDIRECT --to-ports 4000
+
+# Intercept AI providers in OUTPUT chain (for local client processes)
+# Skip traffic originating from the proxy itself to prevent routing loop.
+# Assuming the proxy runs under a group 'intutic' or user 'intutic'.
+# Replace 'intutic' with the username/group running the proxy.
+-A OUTPUT -p tcp -m owner --uid-owner intutic -j ACCEPT
+-A OUTPUT -d api.anthropic.com -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d api.openai.com -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d api2.cursor.sh -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d openrouter.ai -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d api.mistral.ai -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d api.cohere.com -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d api.together.xyz -p tcp --dport 443 -j INTUTIC
+-A OUTPUT -d generativelanguage.googleapis.com -p tcp --dport 443 -j INTUTIC
+
+COMMIT
+`;
+    await writeFile(join(outputDir, 'iptables.rules'), iptablesRules, 'utf-8');
+    log.info({ action: 'firewall_templates_generated', outputDir }, 'Firewall redirection templates generated');
+}
+/**
+ * Main enterprise-install entry point.
+ * Called by the `intutic enterprise-install` CLI command.
+ */
+export async function enterpriseInstall(options) {
+    const { proxyUrl, workspaceRoot = process.cwd(), mdmOutputDir = join(process.cwd(), 'tools', 'cli', 'resources', 'mdm'), firewallOutputDir = join(process.cwd(), 'tools', 'cli', 'resources', 'firewall'), generateMdmOnly = false, } = options;
+    // Always generate MDM and firewall manifests (no privileges needed)
+    await generateMdmManifest(proxyUrl, mdmOutputDir);
+    await generateFirewallTemplates(firewallOutputDir);
+    if (generateMdmOnly) {
+        log.info('MDM and firewall templates generated. Use --generate-mdm-only to skip privilege-requiring steps.');
+        return;
+    }
+    if (!isElevated()) {
+        log.error('enterprise-install requires root/admin privileges. Run with sudo.');
+        console.error('\n❌ Error: intutic enterprise-install requires root privileges.\n   Run: sudo intutic enterprise-install\n');
+        process.exit(1);
+    }
+    // Write system-level Cursor hooks
+    await writeSystemCursorHooks(proxyUrl, workspaceRoot);
+    // Inject CA cert into system trust store
+    const caCertPath = join(homedir(), '.intutic', 'ca.crt');
+    try {
+        await readFile(caCertPath);
+        await injectCaCert(caCertPath);
+    }
+    catch {
+        log.warn({ action: 'ca_cert_missing', path: caCertPath }, 'CA cert not found — run `intutic init` first to generate it, then re-run enterprise-install');
+    }
+    log.info({ action: 'enterprise_install_complete', proxyUrl }, 'Enterprise install complete. Deploy MDM manifests and firewall rules from the generated output directories.');
+    console.log(`
+✅ Intutic Enterprise Install Complete
+
+System-level Cursor hooks: ${systemCursorHooksPath()}
+CA cert injected into system trust store
+MDM manifests written to: ${mdmOutputDir}
+Firewall rules written to: ${firewallOutputDir}
+
+Next steps:
+  1. Deploy intutic-governance.mobileconfig via Jamf/Apple Business Manager
+  2. Deploy cursor-hooks-manifest.json via your MDM solution
+  3. Load firewall redirection rules (e.g. pfctl or iptables) from: ${firewallOutputDir}
+  4. Start the Intutic proxy: intutic proxy start
+`);
+}
+//# sourceMappingURL=enterprise-install.js.map

package/dist/commands/enterprise-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise-install.js","sourceRoot":"","sources":["../../src/commands/enterprise-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAA;AAE3E,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC9C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC,mDAAmD;AACnD,SAAS,UAAU;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,wDAAwD;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAA;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,kDAAkD;AAClD,SAAS,qBAAqB;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,gDAAgD,CAAA;IACzD,CAAC;IACD,OAAO,wBAAwB,CAAA;AACjC,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,YAAY,CAAC,UAAkB;IAC5C,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,MAAM,aAAa,CAAC,UAAU,EAAE;gBAC9B,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW;gBAC3C,IAAI,EAAE,oCAAoC;gBAC1C,UAAU;aACX,CAAC,CAAA;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,wCAAwC,CAAC,CAAA;YACjG,MAAK;QAEP,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,iDAAiD,CAAA;YAClE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YAC3C,MAAM,aAAa,CAAC,wBAAwB,CAAC,CAAA;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,0CAA0C,CAAC,CAAA;YAClG,MAAK;QACP,CAAC;QAED,KAAK,OAAO;YACV,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;YAClE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAA;YAC7F,MAAK;QAEP;YACE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,6CAA6C,CAAC,CAAA;IACxH,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,aAAqB;IAC3E,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAA;IAC1C,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,wDAAwD;IACxD,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IACzD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,mCAAmC,CAAC,CAAA;AAC5G,CAAC;AAED,mDAAmD;AACnD,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IACpE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE3C,uEAAuE;IACvE,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,wEAAwE;QAClF,UAAU,EAAE,MAAM,EAAE;QACpB,WAAW,EAAE,qBAAqB,EAAE;QACpC,OAAO,EAAE;YACP,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE;gBACL,oBAAoB,EAAE;oBACpB,OAAO,EAAE,2CAA2C;oBACpD,UAAU,EAAE,IAAI;iBACjB;gBACD,kBAAkB,EAAE;oBAClB,OAAO,EAAE,2CAA2C;oBACpD,UAAU,EAAE,IAAI;iBACjB;gBACD,cAAc,EAAE;oBACd,OAAO,EAAE,2CAA2C;oBACpD,UAAU,EAAE,IAAI;iBACjB;aACF;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,qDAAqD;YAC3D,MAAM,EAAE,oDAAoD;YAC5D,IAAI,EAAE,oDAAoD;SAC3D;KACF,CAAA;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAEhH,uCAAuC;IACvC,MAAM,gBAAgB,GAAG;QACvB,QAAQ,EAAE,iEAAiE;QAC3E,UAAU,EAAE,MAAM,EAAE;QACpB,WAAW,EAAE,GAAG,OAAO,EAAE,kCAAkC;QAC3D,IAAI,EAAE,uEAAuE;QAC7E,OAAO,EAAE;YACP,YAAY,EAAE,uBAAuB;YACrC,qBAAqB,EAAE,KAAK;YAC5B,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAA;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAEpH,uDAAuD;IACvD,MAAM,YAAY,GAAG;;;;kBAIL,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiDjB,CAAA;IACP,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAA;IAE1F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,oCAAoC,CAAC,CAAA;AAClG,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IACxD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE3C,2BAA2B;IAC3B,MAAM,MAAM,GAAG;;2BAEU,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC;;;;;;;;;;;;CAYpD,CAAA;IACC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAE5D,kCAAkC;IAClC,MAAM,aAAa,GAAG;;uCAEe,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BvE,CAAA;IACC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAE1E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAA;AAC7G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,MAAM,EACJ,QAAQ,EACR,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,EAC7B,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,EACtE,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,EAChF,eAAe,GAAG,KAAK,GACxB,GAAG,OAAO,CAAA;IAEX,oEAAoE;IACpE,MAAM,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IACjD,MAAM,yBAAyB,CAAC,iBAAiB,CAAC,CAAA;IAElD,IAAI,eAAe,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAA;QAC5G,OAAM;IACR,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAA;QAC9E,OAAO,CAAC,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC3H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,kCAAkC;IAClC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAErD,yCAAyC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC1B,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,EAC/C,6FAA6F,CAC9F,CAAA;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,6BAA6B,EAAE,QAAQ,EAAE,EACnD,6GAA6G,CAC9G,CAAA;IACD,OAAO,CAAC,GAAG,CAAC;;;6BAGe,qBAAqB,EAAE;;4BAExB,YAAY;6BACX,iBAAiB;;;;;sEAKwB,iBAAiB;;CAEtF,CAAC,CAAA;AACF,CAAC"}

package/dist/commands/eval.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `intutic eval` — Run evaluator sandbox evaluations from CLI.
+ *
+ * Calls POST /api/v1/evaluator/runs to trigger and poll results.
+ *
+ * E6 — Evaluator Sandbox / CLI
+ * @module
+ */
+export declare function runEval(opts: {
+    dataset: string;
+    dev?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=eval.d.ts.map

package/dist/commands/eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../src/commands/eval.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DrF"}

package/dist/commands/eval.js

@@ -0,0 +1,67 @@
+/**
+ * `intutic eval` — Run evaluator sandbox evaluations from CLI.
+ *
+ * Calls POST /api/v1/evaluator/runs to trigger and poll results.
+ *
+ * E6 — Evaluator Sandbox / CLI
+ * @module
+ */
+import { log } from '../lib/logger.js';
+import { loadCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { createApiClient } from '../lib/api.js';
+export async function runEval(opts) {
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error('Not authenticated. Run `intutic login` first.');
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    try {
+        log.info(`Triggering evaluation run for dataset: ${opts.dataset}...`);
+        const { runId } = await client.post('/api/v1/evaluator/runs', {
+            datasetId: opts.dataset,
+            triggeredBy: 'manual',
+        });
+        log.success(`Run created: ${runId}. Polling status...`);
+        // Poll until complete
+        let attempts = 0;
+        const maxAttempts = 150; // ~5 minutes max
+        while (attempts < maxAttempts) {
+            const { run } = await client.get(`/api/v1/evaluator/runs/${runId}`);
+            if (run.status === 'completed') {
+                log.header('Evaluation Run Complete');
+                log.field('Run ID', run.runId);
+                log.field('Dataset ID', run.datasetId);
+                log.field('Status', run.status);
+                log.field('Pass Rate', run.passRate ? `${(parseFloat(run.passRate) * 100).toFixed(1)}%` : 'N/A');
+                log.field('Average Similarity', run.avgScore ? parseFloat(run.avgScore).toFixed(4) : 'N/A');
+                log.field('Weakening Detected', run.weakeningDetected ? 'YES' : 'NO');
+                log.field('Deploy Guard', run.deployApproved ? 'APPROVED' : 'BLOCKED');
+                if (!run.deployApproved) {
+                    log.error('Evaluation failed deploy guard check.');
+                    process.exit(1);
+                }
+                else {
+                    log.success('Evaluation passed all checks.');
+                    process.exit(0);
+                }
+            }
+            else if (run.status === 'failed') {
+                log.error(`Evaluation run failed: ${run.errorMessage || 'Unknown error'}`);
+                process.exit(1);
+            }
+            // Still running or pending
+            attempts++;
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+        }
+        log.error('Evaluation timed out waiting for completion.');
+        process.exit(1);
+    }
+    catch (err) {
+        log.error(`Failed to execute evaluation: ${err.message || String(err)}`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=eval.js.map

package/dist/commands/eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../src/commands/eval.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAG/C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwC;IACpE,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAE7D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,OAAO,KAAK,CAAC,CAAA;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoB,wBAAwB,EAAE;YAC/E,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAA;QAEF,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,CAAA;QAEvD,sBAAsB;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,MAAM,WAAW,GAAG,GAAG,CAAA,CAAC,iBAAiB;QACzC,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwB,0BAA0B,KAAK,EAAE,CAAC,CAAA;YAE1F,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;gBACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC/B,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBAChG,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBAC3F,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBACrE,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAEtE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;oBACxB,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAA;oBAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACjB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;oBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACjB,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,GAAG,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC,CAAA;gBAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YAED,2BAA2B;YAC3B,QAAQ,EAAE,CAAA;YACV,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/exec.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `intutic exec` — Subprocess wrapper with proxy env var injection.
+ *
+ * Spawns a child process with all Intutic proxy environment variables
+ * pre-injected, routing LLM traffic through the local governance proxy.
+ *
+ * Covers competing SDK env var conventions:
+ * - OPENAI_API_BASE    (LiteLLM, LangChain, CrewAI, ADK, Aider)
+ * - OPENAI_BASE_URL    (OpenAI Python SDK v1+, Pydantic-AI, Agent SDK)
+ * - OPENAI_API_BASE_URL (OpenWebUI)
+ * - OPENAI_HOST         (Goose)
+ * - ANTHROPIC_BASE_URL  (Claude Code, Anthropic SDK — host only)
+ * - ANTHROPIC_API_KEY   (Claude Code)
+ * - OPENAI_API_KEY      (all OpenAI-compatible tools)
+ * - INTUTIC_API_KEY     (Intutic-native tools)
+ *
+ * LLD #8 — Sync Daemon / CLI
+ * @module
+ */
+/**
+ * Build the proxy environment variables for a child process.
+ *
+ * @param apiKey   - Intutic API key (intk_...)
+ * @param devMode  - If true, use localhost:4000; otherwise use remote proxy
+ * @returns Record of env vars to inject
+ */
+export declare function buildProxyEnv(apiKey: string, devMode: boolean): Record<string, string>;
+/**
+ * Execute a command with Intutic proxy environment variables injected.
+ *
+ * @param commandAndArgs - Array of command + arguments (e.g. ['claude'] or ['python', 'main.py'])
+ */
+export declare function runExec(commandAndArgs: string[]): Promise<void>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/commands/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BtF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDrE"}

package/dist/commands/exec.js

@@ -0,0 +1,114 @@
+/**
+ * `intutic exec` — Subprocess wrapper with proxy env var injection.
+ *
+ * Spawns a child process with all Intutic proxy environment variables
+ * pre-injected, routing LLM traffic through the local governance proxy.
+ *
+ * Covers competing SDK env var conventions:
+ * - OPENAI_API_BASE    (LiteLLM, LangChain, CrewAI, ADK, Aider)
+ * - OPENAI_BASE_URL    (OpenAI Python SDK v1+, Pydantic-AI, Agent SDK)
+ * - OPENAI_API_BASE_URL (OpenWebUI)
+ * - OPENAI_HOST         (Goose)
+ * - ANTHROPIC_BASE_URL  (Claude Code, Anthropic SDK — host only)
+ * - ANTHROPIC_API_KEY   (Claude Code)
+ * - OPENAI_API_KEY      (all OpenAI-compatible tools)
+ * - INTUTIC_API_KEY     (Intutic-native tools)
+ *
+ * LLD #8 — Sync Daemon / CLI
+ * @module
+ */
+import { spawn } from 'node:child_process';
+import { loadCredentials, loadConfig } from '../config/store.js';
+import { log } from '../lib/logger.js';
+import pc from 'picocolors';
+/**
+ * Build the proxy environment variables for a child process.
+ *
+ * @param apiKey   - Intutic API key (intk_...)
+ * @param devMode  - If true, use localhost:4000; otherwise use remote proxy
+ * @returns Record of env vars to inject
+ */
+export function buildProxyEnv(apiKey, devMode) {
+    const proxyUrl = devMode
+        ? 'http://localhost:4000/v1'
+        : 'https://proxy.intutic.ai/v1';
+    // Host-only URL (no /v1) — used by Claude Code and Goose
+    const proxyHost = devMode
+        ? 'http://localhost:4000'
+        : 'https://proxy.intutic.ai';
+    return {
+        // OpenAI-compatible (covers LiteLLM, LangChain, CrewAI, ADK, Aider)
+        OPENAI_API_BASE: proxyUrl,
+        // OpenAI SDK v1+ (covers Python SDK, Pydantic-AI, Agent SDK)
+        OPENAI_BASE_URL: proxyUrl,
+        // OpenWebUI (uses its own unique env var name)
+        OPENAI_API_BASE_URL: proxyUrl,
+        // Goose (uses OPENAI_HOST, not OPENAI_API_BASE)
+        OPENAI_HOST: proxyHost,
+        // All OpenAI-compatible API keys
+        OPENAI_API_KEY: apiKey,
+        // Anthropic SDK / Claude Code (host only — appends /v1/messages itself)
+        ANTHROPIC_BASE_URL: proxyHost,
+        ANTHROPIC_API_KEY: apiKey,
+        // Intutic-native
+        INTUTIC_API_KEY: apiKey,
+    };
+}
+/**
+ * Execute a command with Intutic proxy environment variables injected.
+ *
+ * @param commandAndArgs - Array of command + arguments (e.g. ['claude'] or ['python', 'main.py'])
+ */
+export async function runExec(commandAndArgs) {
+    if (commandAndArgs.length === 0) {
+        log.error('No command specified.');
+        log.dim('Usage: intutic exec -- <command> [args...]');
+        log.dim('Example: intutic exec -- claude');
+        log.dim('Example: intutic exec -- aider --model openai/gpt-4o');
+        log.dim('Example: intutic exec -- python my_agent.py');
+        process.exit(1);
+    }
+    // Load credentials
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error('Not authenticated. Run `intutic login` first.');
+        process.exit(1);
+    }
+    // Load config for dev mode
+    const config = loadConfig();
+    const devMode = config?.devMode ?? process.env.INTUTIC_DEV === '1';
+    // Build env
+    const proxyEnv = buildProxyEnv(creds.apiKey, devMode);
+    const childEnv = { ...process.env, ...proxyEnv };
+    const [exe, ...args] = commandAndArgs;
+    // Print info
+    log.info(`Launching: ${pc.bold(exe)} ${args.join(' ')}`);
+    log.dim(`Proxy: ${proxyEnv.OPENAI_API_BASE}`);
+    log.dim(`API Key: ${creds.apiKey.slice(0, 8)}...${creds.apiKey.slice(-4)}`);
+    console.log('');
+    // Spawn the child process with inherited stdio (full interactivity)
+    const child = spawn(exe, args, {
+        stdio: 'inherit',
+        env: childEnv,
+        shell: process.platform === 'win32', // Use shell on Windows for PATH resolution
+    });
+    child.on('error', (err) => {
+        if (err.code === 'ENOENT') {
+            log.error(`Command not found: ${exe}`);
+            log.dim('Make sure the command is installed and in your PATH.');
+        }
+        else {
+            log.error(`Failed to start: ${err.message}`);
+        }
+        process.exit(127);
+    });
+    child.on('exit', (code, signal) => {
+        if (signal) {
+            process.kill(process.pid, signal);
+        }
+        else {
+            process.exit(code ?? 0);
+        }
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/commands/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAgB;IAC5D,MAAM,QAAQ,GAAG,OAAO;QACtB,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,6BAA6B,CAAA;IAEjC,yDAAyD;IACzD,MAAM,SAAS,GAAG,OAAO;QACvB,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,0BAA0B,CAAA;IAE9B,OAAO;QACL,oEAAoE;QACpE,eAAe,EAAE,QAAQ;QACzB,6DAA6D;QAC7D,eAAe,EAAE,QAAQ;QACzB,+CAA+C;QAC/C,mBAAmB,EAAE,QAAQ;QAC7B,gDAAgD;QAChD,WAAW,EAAE,SAAS;QACtB,iCAAiC;QACjC,cAAc,EAAE,MAAM;QACtB,wEAAwE;QACxE,kBAAkB,EAAE,SAAS;QAC7B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB;QACjB,eAAe,EAAE,MAAM;KACxB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,cAAwB;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QAC/D,GAAG,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAA;IAElE,YAAY;IACZ,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;IAEhD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAA;IAErC,aAAa;IACb,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,oEAAoE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,2CAA2C;KACjF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACtC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/commands/exec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=exec.test.d.ts.map

package/dist/commands/exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.test.d.ts","sourceRoot":"","sources":["../../src/commands/exec.test.ts"],"names":[],"mappings":""}

package/dist/commands/exec.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { buildProxyEnv } from './exec.js';
+describe('Subprocess Exec Env Builder', () => {
+    it('correctly maps proxy URLs in dev mode', () => {
+        const apiKey = 'intk_test12345';
+        const env = buildProxyEnv(apiKey, true);
+        expect(env.OPENAI_API_BASE).toBe('http://localhost:4000/v1');
+        expect(env.OPENAI_BASE_URL).toBe('http://localhost:4000/v1');
+        expect(env.OPENAI_API_BASE_URL).toBe('http://localhost:4000/v1');
+        expect(env.OPENAI_HOST).toBe('http://localhost:4000');
+        expect(env.ANTHROPIC_BASE_URL).toBe('http://localhost:4000');
+        expect(env.OPENAI_API_KEY).toBe(apiKey);
+        expect(env.ANTHROPIC_API_KEY).toBe(apiKey);
+        expect(env.INTUTIC_API_KEY).toBe(apiKey);
+    });
+    it('correctly maps proxy URLs in production mode', () => {
+        const apiKey = 'intk_prod98765';
+        const env = buildProxyEnv(apiKey, false);
+        expect(env.OPENAI_API_BASE).toBe('https://proxy.intutic.ai/v1');
+        expect(env.OPENAI_BASE_URL).toBe('https://proxy.intutic.ai/v1');
+        expect(env.OPENAI_API_BASE_URL).toBe('https://proxy.intutic.ai/v1');
+        expect(env.OPENAI_HOST).toBe('https://proxy.intutic.ai');
+        expect(env.ANTHROPIC_BASE_URL).toBe('https://proxy.intutic.ai');
+        expect(env.OPENAI_API_KEY).toBe(apiKey);
+        expect(env.ANTHROPIC_API_KEY).toBe(apiKey);
+        expect(env.INTUTIC_API_KEY).toBe(apiKey);
+    });
+});
+//# sourceMappingURL=exec.test.js.map

package/dist/commands/exec.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.test.js","sourceRoot":"","sources":["../../src/commands/exec.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAA;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAEvC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC5D,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAChE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACrD,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAE5D,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAAA;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAExC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACnE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAE/D,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/commands/export.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `intutic export` — Manage warehouse exports from the CLI.
+ *
+ * E4 — Data Warehouse Export / CLI
+ * @module
+ */
+export declare function runExportConfig(opts: {
+    provider?: 'gcs' | 's3';
+    bucket?: string;
+    prefix?: string;
+    credentials?: string;
+    region?: string;
+    format?: 'csv' | 'parquet' | 'ndjson';
+    dev?: boolean;
+}): Promise<void>;
+export declare function runExportStatus(opts: {
+    triggerTarget?: string;
+    format?: 'csv' | 'parquet' | 'ndjson';
+    dev?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=export.d.ts.map

package/dist/commands/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAA;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDhB;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAA;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhB"}