@intutic/cli 1.10.0 → 1.10.1

package/dist/commands/connect.js

@@ -16,17 +16,27 @@ const { version: cliPkgVersion } = createRequire(import.meta.url)('../../package
 import * as node_fs from 'node:fs/promises';
 import { log } from '../lib/logger.js';
 import { ensureValkey, valkeyRemediation, isValkeyRunning } from '../lib/ensureValkey.js';
+import { createShutdownHandler, terminateChild } from '../lib/gracefulShutdown.js';
 import { loadCredentials, loadConfig, saveConfig, loadIntegrity, saveIntegrity, } from '../config/store.js';
 import { resolveControlPlaneUrl, getIntuticDir } from '../config/paths.js';
 import { createApiClient } from '../lib/api.js';
 import { getActiveAgentProcesses } from '../lib/process.js';
 import { getAdapter } from '../harness/detector.js';
 import { printOnboardingGuide } from '../lib/onboarding.js';
+import { writeEnforcementState } from '../lib/enforcementState.js';
+import { reportDeviceState } from '../lib/deviceReport.js';
+import { parseChecksums, verifyChecksum } from '../lib/binaryChecksum.js';
 import { newIso } from '@intutic/id';
 import pc from 'picocolors';
-import { SyncWsClient, startWatcher, updatePreToolUseHooks, injectMcpServer, guardSettingsFile, writeRuntimeEnv, runComplianceProbes, drainHookEvents, syncOfflineTraces, TrajectoryMonitor, } from '@intutic/sync-daemon';
+import { SyncWsClient, startWatcher, updatePreToolUseHooks, injectMcpServer, guardSettingsFile, warnIfDshCoverageGap, writeRuntimeEnv, refreshPolicySnapshot, refreshGateCaches, localHoldTokensFor, runComplianceProbes, drainHookEvents, drainReviewRequests, REVIEW_REQUESTS_LOG, syncOfflineTraces, TrajectoryMonitor, collectAgentReport, reportAgent, fetchLocalProxyInstanceId, startHarnessSession, endAllOpenSessions, } from '@intutic/sync-daemon';
 import { watch } from 'chokidar';
-import Redis from 'ioredis';
+// Named, not default: under `module: Node16` TypeScript resolves ioredis's
+// default export to the module namespace rather than the class, so `new
+// Redis(...)` is not constructable and `Redis` is not a type. That is what the
+// `new (Redis as any)(...)` below was working around, at the cost of also
+// giving up the client's type. `packages/mcp-proxy` already imports it this
+// way; both forms are the same class at run time.
+import { Redis } from 'ioredis';
 import * as net from 'node:net';
 import { spawn, execSync } from 'node:child_process';
 import { createWriteStream } from 'node:fs';
@@ -49,26 +59,54 @@ function isPortInUse(port) {
         server.listen(port, '127.0.0.1');
     });
 }
-async function downloadProxyBinary(destPath) {
-    const platform = process.platform;
-    const arch = process.arch;
-    let assetName = '';
+/**
+ * Is this a path the tamper guard should inspect?
+ *
+ * Deliberately broad: `guardSettingsFile` already branches per harness, so the only
+ * job here is to stop filtering out paths it knows how to handle.
+ */
+function isGovernedConfigPath(changedPath, filename) {
+    if (filename === 'settings.json' || filename === 'settings.local.json')
+        return true;
+    if (filename === 'hooks.json')
+        return true;
+    // Goose's immutable governance plugin.
+    if (changedPath.includes('intutic-governance'))
+        return true;
+    return false;
+}
+/**
+ * Asset names MUST match publish.yml's build-rust-proxy matrix
+ * artifact_name — mirrors packages/proxy/bin/proxy.js's `resolveAssetName`
+ * exactly (same five names, same live-release verification: `gh release
+ * view` on v1.6.0 through the current release confirmed every one of
+ * these). `platform`/`arch` are parameters, not read from `process`
+ * directly, so connect.test.ts can exercise every combination without
+ * stubbing global process state.
+ */
+export function resolveProxyAssetName(platform = process.platform, arch = process.arch) {
     if (platform === 'darwin') {
         if (arch === 'arm64')
-            assetName = 'intutic-proxy-darwin-arm64';
-        else if (arch === 'x64')
-            assetName = 'intutic-proxy-darwin-x64';
+            return 'intutic-proxy-darwin-arm64';
+        if (arch === 'x64')
+            return 'intutic-proxy-darwin-x64';
     }
     else if (platform === 'linux') {
         if (arch === 'x64')
-            assetName = 'intutic-proxy-linux-x64';
-        else if (arch === 'arm64')
-            assetName = 'intutic-proxy-linux-arm64';
+            return 'intutic-proxy-linux-x64';
+        if (arch === 'arm64')
+            return 'intutic-proxy-linux-arm64';
     }
     else if (platform === 'win32') {
         if (arch === 'x64')
-            assetName = 'intutic-proxy-win32-x64.exe';
+            return 'intutic-proxy-win32-x64.exe';
     }
+    return null;
+}
+async function downloadProxyBinary(destPath) {
+    const platform = process.platform;
+    const arch = process.arch;
+    const assetName = resolveProxyAssetName(platform, arch);
     if (!assetName) {
         throw new Error(`Unsupported platform/architecture: ${platform}-${arch}`);
     }
@@ -89,6 +127,16 @@ async function downloadProxyBinary(destPath) {
     }
     const arrayBuffer = await response.arrayBuffer();
     const buffer = Buffer.from(arrayBuffer);
+    log.info('Verifying checksum...');
+    const checksumsUrl = `https://github.com/intutic/intutic/releases/download/v${cliPkgVersion}/checksums.json`;
+    const checksumsResponse = await fetch(checksumsUrl);
+    if (!checksumsResponse.ok) {
+        throw new Error(`Failed to download checksums.json (HTTP ${checksumsResponse.status} ${checksumsResponse.statusText}).\n` +
+            `  URL: ${checksumsUrl}\n` +
+            `Refusing to install an unverified binary.`);
+    }
+    const checksums = parseChecksums(await checksumsResponse.text());
+    verifyChecksum(buffer, checksums, assetName);
     const destDir = node_path.dirname(destPath);
     await node_fs.mkdir(destDir, { recursive: true });
     await node_fs.writeFile(destPath, buffer);
@@ -136,11 +184,23 @@ export async function runConnect(opts) {
     }
     let config = loadConfig();
     if (!config && opts.workspaceId && opts.apiKey) {
+        // `IntuticConfig`, not `as any`. This literal used to carry a
+        // `workspaceId` too, which the type does not declare and nothing reads —
+        // `init.ts`, the only other writer of ~/.intutic/config.json, has never
+        // written one, and every consumer takes the workspace id from the
+        // credentials instead. The cast was there to admit it, so it went with the
+        // cast. The workspace id from --workspace-id still reaches everything that
+        // needs it, via `creds` above.
         config = {
-            workspaceId: opts.workspaceId,
             harnesses: [],
             configVersion: 0,
             devMode: opts.dev || false,
+            // workspaceRoot must be set here: step 2.5 path.join()s it, and
+            // path.join(undefined) throws a TypeError that nothing catches. That
+            // crash is what made `intutic daemon install` produce a crash-looping
+            // service on any machine without ~/.intutic/config.json (the launchd
+            // plist runs `connect --workspace-id --api-key` with KeepAlive=true).
+            workspaceRoot: process.cwd(),
         };
     }
     if (!config) {
@@ -195,16 +255,21 @@ export async function runConnect(opts) {
     // 2. AbortController for clean shutdown
     let proxyProc = null;
     const ac = new AbortController();
-    const shutdown = () => {
-        log.info('Shutting down sync daemon...');
-        if (proxyProc) {
-            log.info('Stopping managed proxy gateway...');
-            proxyProc.kill('SIGTERM');
-        }
-        trajectoryMonitor?.stop();
-        trajectorySubscriber?.disconnect();
-        ac.abort();
-    };
+    // TD-484: this handler used to abort the loop and hope. The process stayed
+    // alive for hours. `createShutdownHandler` adds the exit deadline and the
+    // second-signal exit; `terminateChild` escalates to SIGKILL.
+    const shutdown = createShutdownHandler({
+        onShutdown: () => {
+            log.info('Shutting down sync daemon...');
+            ac.abort();
+            if (proxyProc) {
+                log.info('Stopping managed proxy gateway...');
+                terminateChild(proxyProc);
+            }
+            trajectoryMonitor?.stop();
+            trajectorySubscriber?.disconnect();
+        },
+    });
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
     // 2.4. Pre-flight Valkey Validation
@@ -229,8 +294,16 @@ export async function runConnect(opts) {
     }
     // 2.5. Manage LiteLLM-Rust Proxy Gateway Process
     const proxyPort = parseInt(process.env.PORT || '4000', 10);
+    // The daemon-side probes (`fetchEgressStatus`, `fetchGuardProbes`,
+    // `fetchLocalProxyInstanceId`) read the proxy at `INTUTIC_PROXY_URL`,
+    // defaulting to port 4000; connect knows the port it will spawn on, so an
+    // operator running on another `PORT` still gets probed at the right one.
+    process.env.INTUTIC_PROXY_URL ??= `http://127.0.0.1:${proxyPort}`;
     let exeCmd = 'cargo';
     let exeArgs = ['run', '--manifest-path', node_path.join(safeConfig.workspaceRoot, 'packages', 'proxy', 'Cargo.toml')];
+    // Populated only on the branch that actually spawns the proxy; the DR
+    // re-spawn below reuses it and is guarded by `proxyProc`, which is null
+    // whenever this is still empty.
     let proxyEnv = {};
     try {
         const inUse = await isPortInUse(proxyPort);
@@ -278,7 +351,7 @@ export async function runConnect(opts) {
                                 exeArgs = [];
                             }
                             catch (downloadErr) {
-                                log.warn(`Auto-download failed: ${downloadErr.message}`);
+                                log.warn(`Auto-download failed: ${downloadErr instanceof Error ? downloadErr.message : String(downloadErr)}`);
                                 log.dim('Falling back to cargo run...');
                             }
                         }
@@ -294,6 +367,13 @@ export async function runConnect(opts) {
                 INTUTIC_WORKSPACE_ID: safeCreds.workspaceId,
                 INTUTIC_API_KEY: safeCreds.apiKey,
                 CONFIG_PATH: node_path.join(safeConfig.workspaceRoot, 'config.yaml'),
+                // Workspace policy: admins can disallow local Obsidian/Logseq/Foam
+                // vaults from feeding /fix. Applied at spawn; a policy change takes
+                // effect on the next connect. Vault content never leaves the machine
+                // under either setting — this only governs whether the search runs.
+                ...(safeConfig.settings?.allowLocalMemoryVaults === false
+                    ? { INTUTIC_LOCAL_VAULTS: 'off' }
+                    : {}),
             };
             proxyProc = spawn(exeCmd, exeArgs, {
                 cwd: safeConfig.workspaceRoot,
@@ -341,12 +421,12 @@ export async function runConnect(opts) {
                             log.success('Successfully trusted SSL CA certificate.');
                         }
                         catch (err) {
-                            log.warn(`Failed to auto-trust SSL certificate on Windows: ${err.message}`);
+                            log.warn(`Failed to auto-trust SSL certificate on Windows: ${err instanceof Error ? err.message : String(err)}`);
                         }
                     }
                 }
                 catch (err) {
-                    log.warn(`Could not verify or auto-trust CA certificate: ${err.message}`);
+                    log.warn(`Could not verify or auto-trust CA certificate: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
         }
@@ -356,10 +436,29 @@ export async function runConnect(opts) {
     }
     let localConfigVersion = safeConfig.configVersion;
     let lastCachedConfig = null;
+    // The three gate-side caches every hook reads — the policy snapshot, the
+    // approved review-hold bypasses and the central egress policy. Refreshed on
+    // EVERY applySyncConfig (each poll and each pushed config_update), not only
+    // when the config version moved: policy changes without the config version
+    // changing, and a guardrail promoted, a hold approved or an egress mode
+    // flipped mid-session used to reach a connected machine only on restart —
+    // this function was called once, at startup (TD-488). Parity with the
+    // daemon's own loop (`syncLoop.ts`'s Steps 0b–0d). None of these throw.
+    //
+    // The snapshot also carries this workspace's `review_before:` tokens as hold
+    // rules (synced SOPs, settings and local `.intutic/sops`), so every gate —
+    // not only the Claude Code hook — holds on them (TD-474 item 4).
+    async function refreshGateCachesForConnect() {
+        const localHoldTokens = await localHoldTokensFor(safeConfig.workspaceRoot, lastCachedConfig?.sops ?? [], lastCachedConfig?.settings, safeConfig.harnesses);
+        const landed = await refreshGateCaches({ controlPlaneUrl, apiKey: safeCreds.apiKey, workspaceId: safeCreds.workspaceId, localHoldTokens });
+        if (!landed.snapshot)
+            log.dim('Policy snapshot refresh failed (will retry next sync); built-in protections are unaffected.');
+    }
     // 3. Define configuration applier function
     async function applySyncConfig(syncConfig, force = false) {
         let sopsWritten = 0;
         lastCachedConfig = syncConfig;
+        await refreshGateCachesForConnect();
         if (syncConfig.configVersion > localConfigVersion || force) {
             log.info(`Applying configuration v${syncConfig.configVersion}...`);
             // Load and compile local SOP entries
@@ -399,7 +498,19 @@ export async function runConnect(opts) {
                 }
             }
             catch (err) {
-                // ignore directory read errors
+                // Only a missing `.intutic/sops` is unremarkable — most workspaces have
+                // none, and `readdir` ENOENTs on the first line of the block.
+                //
+                // Everything else was being swallowed with it, and the block goes on to
+                // read every SOP file: an unreadable file or a permissions error dropped
+                // that SOP from `localSopEntries`, and the harness configs written a few
+                // lines below were then generated *without* it, silently. Governance
+                // content going missing is the failure this whole function exists to
+                // prevent, so it does not get to be quiet.
+                const code = err instanceof Error ? err.code : undefined;
+                if (code !== 'ENOENT') {
+                    log.warn(`Failed to load local SOPs from .intutic/sops — harness configs will be written without them: ${err instanceof Error ? err.message : String(err)}`);
+                }
             }
             const combinedSops = [...syncConfig.sops, ...localSopEntries];
             // a. Write configs for all active harnesses
@@ -432,7 +543,10 @@ export async function runConnect(opts) {
                 log.warn(`Failed to inject MCP server configs: ${err instanceof Error ? err.message : String(err)}`);
             }
             localConfigVersion = syncConfig.configVersion;
-            saveConfig({ ...safeConfig, configVersion: localConfigVersion });
+            // Mirror workspace settings locally so spawn-time policies (like
+            // allowLocalMemoryVaults) apply on the next connect without a fetch.
+            safeConfig.settings = syncConfig.settings;
+            saveConfig({ ...safeConfig, configVersion: localConfigVersion, settings: syncConfig.settings });
         }
         // c. Compute file hashes + update integrity store
         const fileHashes = [];
@@ -497,14 +611,20 @@ export async function runConnect(opts) {
                     execSync('docker info', { stdio: 'ignore' });
                     dockerActive = true;
                 }
-                catch { }
+                catch {
+                    // Deliberate swallow: `docker info` exiting non-zero IS the answer we
+                    // asked for — Docker is not installed or its daemon is down. That is a
+                    // normal state on machines running Valkey natively, not an error to
+                    // report. dockerActive stays false and we fall through to the native
+                    // binary / downloaded-static healing paths below.
+                }
                 if (dockerActive) {
                     try {
                         execSync('docker start intutic-valkey', { stdio: 'ignore' });
                         log.info('[DR] Successfully sent container start command to intutic-valkey.');
                     }
                     catch (err) {
-                        log.warn(`[DR] Docker container start failed: ${err.message}`);
+                        log.warn(`[DR] Docker container start failed: ${err instanceof Error ? err.message : String(err)}`);
                     }
                 }
                 else {
@@ -520,7 +640,13 @@ export async function runConnect(opts) {
                             nativeCmd = 'redis-server';
                             hasNativeBinary = true;
                         }
-                        catch { }
+                        catch {
+                            // Deliberate swallow: this is the last of three probes (docker,
+                            // valkey-server, redis-server). `which` failing just means the
+                            // binary is not on PATH, which is the question we asked.
+                            // hasNativeBinary stays false and healing falls through to the
+                            // downloaded static binary under ~/.intutic/bin.
+                        }
                     }
                     if (hasNativeBinary) {
                         try {
@@ -529,7 +655,7 @@ export async function runConnect(opts) {
                             log.info(`[DR] Successfully spawned native ${nativeCmd} in background.`);
                         }
                         catch (err) {
-                            log.warn(`[DR] Native daemon spawn failed: ${err.message}`);
+                            log.warn(`[DR] Native daemon spawn failed: ${err instanceof Error ? err.message : String(err)}`);
                         }
                     }
                     else {
@@ -542,7 +668,7 @@ export async function runConnect(opts) {
                             log.info('[DR] Successfully spawned downloaded static Valkey server in background.');
                         }
                         catch (err) {
-                            log.warn(`[DR] Static binary spawn failed: ${err.message}`);
+                            log.warn(`[DR] Static binary spawn failed: ${err instanceof Error ? err.message : String(err)}`);
                         }
                     }
                 }
@@ -556,7 +682,12 @@ export async function runConnect(opts) {
             const proxyActive = await isPortInUse(proxyPort);
             if (!proxyActive) {
                 proxyStatus = 'unhealthy';
-                if (proxyProc) {
+                if (ac.signal.aborted) {
+                    // Shutting down: the proxy is gone because we stopped it. Re-spawning
+                    // it here would leave an orphan holding the port (TD-484).
+                    proxyStatus = 'stopped';
+                }
+                else if (proxyProc) {
                     log.warn('[DR] Managed proxy gateway process has terminated. Auto-healing re-spawn...');
                     const logDir = node_path.join(safeConfig.workspaceRoot, '.intutic', 'logs');
                     const logStream = createWriteStream(node_path.join(logDir, 'proxy-gateway.log'), { flags: 'a' });
@@ -620,6 +751,30 @@ export async function runConnect(opts) {
         catch (err) {
             log.warn(`Failed to send daemon heartbeat: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // g. Enforcement device visibility (post-strip gap #2, LLD #63
+        // hardening) — the "interval" half of "continuous compliance": this
+        // loop already runs unprivileged, as the real user, on a timer, and
+        // already just computed sslTrustStatus above for its own DR-healing
+        // purposes. Recording it as a user-scope CA-trust leg means every
+        // `intutic connect` session reports SOMETHING even on a machine that
+        // never ran `enforce apply` or `enterprise install` — best-effort,
+        // never fails the sync loop over it.
+        try {
+            await writeEnforcementState({
+                caTrust: {
+                    installed: sslTrustStatus === 'trusted',
+                    scope: 'user',
+                    reportedAt: newIso(),
+                },
+            }, cliPkgVersion);
+            const deviceReport = await reportDeviceState({ dev: devMode });
+            if (!deviceReport.reported) {
+                log.dim(`[sync] Device report not sent: ${deviceReport.reason}`);
+            }
+        }
+        catch (err) {
+            log.warn(`Failed to record/report device enforcement state: ${err instanceof Error ? err.message : String(err)}`);
+        }
         const driftLabel = driftCount > 0 ? pc.yellow(` — ${driftCount} drift(s) detected`) : '';
         log.dim(`[sync] Config v${localConfigVersion} — ${sopsWritten} SOPs synced${driftLabel}`);
         // Refresh runtime env with resolved settings
@@ -631,6 +786,8 @@ export async function runConnect(opts) {
                 mcpProxyFailBehavior: syncConfig.settings?.mcpProxyFailBehavior,
                 mcpProxyMode: syncConfig.settings?.mcpProxyMode,
                 bypassEnforcementTier: syncConfig.settings?.bypassEnforcementTier,
+                // Shared by the MCP proxies for their session window (Wave 5.3, TD-437) — only when it is running.
+                valkeyUrl: valkeyResult.running ? valkeyUrl : undefined,
             });
         }
         catch (err) {
@@ -660,8 +817,15 @@ export async function runConnect(opts) {
             log.warn(`Compliance probes failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
         }
     };
-    // Helper to drain hook events (WS-A)
-    const runDrain = async () => {
+    // Drains BOTH logs, matching `services/sync-daemon/src/syncLoop.ts`.
+    //
+    // This drained hook events only. `intutic connect` runs the daemon in-process,
+    // so under the CLI runtime a `review_before` hold still blocked the tool
+    // locally and then sat in `.intutic/events/review-requests.jsonl` forever: the
+    // developer was stopped, and the decision that was supposed to become a
+    // learned rule never reached the control plane. The block working is what made
+    // it invisible.
+    const drainOnce = async () => {
         try {
             const drained = await drainHookEvents(safeConfig.workspaceRoot, controlPlaneUrl, safeCreds.apiKey);
             if (drained > 0) {
@@ -671,6 +835,52 @@ export async function runConnect(opts) {
         catch (err) {
             log.warn(`[sync-daemon] Hook event drain error (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
         }
+        // Separate try: the two go to different endpoints, and one being down says
+        // nothing about the other.
+        try {
+            const held = await drainReviewRequests(safeConfig.workspaceRoot, controlPlaneUrl, safeCreds.apiKey);
+            if (held > 0) {
+                log.info(`[sync-daemon] Drained ${held} review hold(s) to control plane`);
+            }
+        }
+        catch (err) {
+            log.warn(`[sync-daemon] Review hold drain error (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
+    /**
+     * Serialises drains, and coalesces the ones that arrive during one.
+     *
+     * `runDrain` is bound to `change` and `add` on **two** watched files and to a
+     * 60-second timer, and each drain reads a log and then truncates it. Those are
+     * separate awaits, so two overlapping runs both read the same lines before
+     * either truncates and the same governance events are POSTed twice — a hook
+     * incident counted once by the agent and twice by the control plane. A hook
+     * writing to both `.intutic/events/` files in the same tick is enough on its
+     * own, and that is the ordinary case: a held tool call writes the review
+     * request and the event log together.
+     *
+     * The latch matters as much as the flag. Dropping an overlapping request
+     * outright would lose the write that triggered it whenever it landed after
+     * this pass had already read the file, so the drain would wait for the next
+     * event or the 60s poll — the exact delay the watcher exists to remove.
+     */
+    let draining = false;
+    let drainRequestedAgain = false;
+    const runDrain = async () => {
+        if (draining) {
+            drainRequestedAgain = true;
+            return;
+        }
+        draining = true;
+        try {
+            do {
+                drainRequestedAgain = false;
+                await drainOnce();
+            } while (drainRequestedAgain);
+        }
+        finally {
+            draining = false;
+        }
     };
     // Step 0: Write runtime env file (hook scripts source this for credentials)
     try {
@@ -678,11 +888,30 @@ export async function runConnect(opts) {
             controlPlaneUrl,
             apiKey: safeCreds.apiKey,
             workspaceId: safeCreds.workspaceId,
+            // Shared by the MCP proxies for their session window (Wave 5.3, TD-437) — only when it is running.
+            valkeyUrl: valkeyResult.running ? valkeyUrl : undefined,
         });
     }
     catch (err) {
         log.warn(`Could not write runtime env file (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
     }
+    // Seed the policy snapshot before the first sync cycle rather than after it.
+    //
+    // Without this, every fresh install runs its first poll interval with no
+    // snapshot — the gates enforce the static floor and nothing else. Seeding here
+    // narrows that window to "the fetch failed, and we said so" instead of "always,
+    // briefly". `refreshPolicySnapshot` never throws. Every later refresh rides
+    // `applySyncConfig` (see `refreshGateCaches`).
+    const seeded = await refreshPolicySnapshot({
+        controlPlaneUrl,
+        apiKey: safeCreds.apiKey,
+        workspaceId: safeCreds.workspaceId,
+    });
+    if (!seeded) {
+        log.warn('Could not seed the policy snapshot — governance rules from the control plane ' +
+            'will not apply until the next successful sync. Built-in protections are unaffected.');
+    }
+    await refreshGateCachesForConnect();
     // Sync offline traces back to PostgreSQL on startup
     try {
         await syncOfflineTraces(controlPlaneUrl, safeCreds.apiKey);
@@ -743,25 +972,52 @@ export async function runConnect(opts) {
         }).catch(() => { });
     }
     catch (err) {
-        // ignore
+        // Nothing in the block above is expected to throw — the `readFile` has its
+        // own catch and `scanLocalSops` resolves to [] on failure — so this is the
+        // outer guard for the one thing that can: `node_path.join` on an undefined
+        // workspaceRoot, the TypeError that used to crash-loop the launchd service.
+        // Reported rather than swallowed, because reaching it means the startup
+        // context report never happened and the dashboard is missing this daemon.
+        log.warn(`Failed to send initial context report: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // FSEvents-driven hook event drain
+    // FSEvents-driven drain, watching BOTH logs.
+    //
+    // Watching only hook events meant a review hold waited for the 60s safety
+    // timer at best — and, before `runDrain` learned to drain holds at all, never.
     const hookEventsLog = node_path.join(safeConfig.workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    const reviewHoldsLog = node_path.join(safeConfig.workspaceRoot, REVIEW_REQUESTS_LOG);
     let fsWatcher = null;
-    let drainSafetyTimer = null;
     try {
         await node_fs.mkdir(node_path.dirname(hookEventsLog), { recursive: true });
-        fsWatcher = watch(hookEventsLog, { ignoreInitial: true, persistent: false });
+        fsWatcher = watch([hookEventsLog, reviewHoldsLog], { ignoreInitial: true, persistent: false });
         fsWatcher.on('change', runDrain);
         fsWatcher.on('add', runDrain);
     }
     catch (err) {
-        // chokidar unavailable - rely on fallback
+        // A real fallback, not a swallow: `drainSafetyTimer` below drains every 60 s
+        // regardless. But losing the FSEvents watcher turns a near-immediate drain
+        // into a up-to-60-second one, which is the difference between a hook
+        // incident showing up while the agent is still running and after it exited.
+        // Say so, at dim, so the degradation is diagnosable.
+        log.dim(`Hook-event watcher unavailable, falling back to the 60s drain poll: ${err instanceof Error ? err.message : String(err)}`);
     }
     // 60-second safety-net drain poll
-    drainSafetyTimer = setInterval(runDrain, 60_000);
+    const drainSafetyTimer = setInterval(runDrain, 60_000);
     // Run initial compliance check on startup
     await runProbes();
+    // dsh coverage-gap visibility (TD-370): once at startup, not every poll
+    // tick — the gap only changes state on the user's first `dsh --profile
+    // <name>` run, which the filesystem watcher below reacts to immediately
+    // via settingsGuard.ts's isDshProfilesRoot `addDir` handling. Only worth
+    // checking when dsh is actually a configured harness for this workspace.
+    if (safeConfig.harnesses.includes('dsh')) {
+        try {
+            await warnIfDshCoverageGap();
+        }
+        catch (err) {
+            log.dim(`dsh coverage-gap check failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // 5. Start Filesystem Watcher
     const watcher = startWatcher(safeConfig.workspaceRoot, safeConfig.harnesses, async (changedPath) => {
         const filename = node_path.basename(changedPath);
@@ -793,8 +1049,19 @@ export async function runConnect(opts) {
             }
             return;
         }
-        // B. Handle Claude Code settings.json tamper detection (privilege escalation guard)
-        if (filename === 'settings.json' || filename === 'settings.local.json') {
+        // B. Tamper detection for every governed config, not just Claude Code's.
+        //
+        // This used to filter on `filename === 'settings.json'`, which silently disabled
+        // five of the six branches inside guardSettingsFile: the Cursor, Windsurf, Cline
+        // and OpenHands restores all key off `hooks.json`, and the Goose
+        // governance-plugin override incident keys off a path containing
+        // `intutic-governance`. None of those basenames could ever reach the guard, so a
+        // tampered hooks file on any harness but Claude Code was a no-op — and a tampered
+        // Windsurf/VS Code/Gemini settings file passed the basename test only to fall
+        // through and log `settings_intact`.
+        //
+        // Route anything on the governed list to the guard and let it decide.
+        if (isGovernedConfigPath(changedPath, filename)) {
             try {
                 const sops = lastCachedConfig?.sops ?? [];
                 const tampered = await guardSettingsFile(changedPath, safeConfig.workspaceRoot, sops);
@@ -868,7 +1135,50 @@ export async function runConnect(opts) {
             try {
                 await syncOfflineTraces(controlPlaneUrl, safeCreds.apiKey);
             }
-            catch { }
+            catch (err) {
+                // Non-fatal by design: a backlog of offline traces must never stop the
+                // sync iteration — the next tick retries the same backlog. But it is not
+                // a no-op either, so report it the way the identical startup call above
+                // does, at dim level because this runs every poll interval.
+                log.dim(`Offline trace sync failed (will retry next poll): ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // Register agents + report one session per harness (the reporter
+            // dedupes per run and per proxy process). connect's inline loop bypassed
+            // both, leaving the dashboard graph empty for the primary user path.
+            // The local proxy's instance id is read once per iteration: with it the
+            // harness's git/task context lands on the proxy's own session row, the
+            // one its traces are filed under (TD-231, Wave 5.6).
+            const proxyInstanceId = safeConfig.harnesses.length > 0 ? await fetchLocalProxyInstanceId() : null;
+            for (const harnessType of safeConfig.harnesses) {
+                try {
+                    const report = await collectAgentReport({
+                        workspaceRoot: process.cwd(),
+                        harnessType,
+                        configSynced: true,
+                        dlpEnabled: true,
+                        policyEnforced: true,
+                        allowLocalVaults: syncConfig.settings?.allowLocalMemoryVaults,
+                    });
+                    await reportAgent(controlPlaneUrl, safeCreds.apiKey, safeCreds.workspaceId, report);
+                    await startHarnessSession({
+                        controlPlaneUrl,
+                        apiKey: safeCreds.apiKey,
+                        workspaceId: safeCreds.workspaceId,
+                        harnessType,
+                        workspaceRoot: process.cwd(),
+                        ...(proxyInstanceId ? { proxyInstanceId } : {}),
+                    });
+                }
+                catch (err) {
+                    // Per-harness isolation is deliberate: one harness failing to register
+                    // must not stop the others or abort the poll iteration. Silence was
+                    // not deliberate — fetchConfig already succeeded above, so a failure
+                    // here means the control plane accepted the config read and rejected
+                    // the agent report, which is exactly the "dashboard graph is empty"
+                    // symptom this loop was added to fix. Report it so it is diagnosable.
+                    log.dim(`Agent report/session for harness '${harnessType}' failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
             // Run compliance probes on each iteration
             await runProbes();
         }
@@ -888,9 +1198,9 @@ export async function runConnect(opts) {
     // Cleanup watcher, intervals, and WS connection on exit
     watcher.stop();
     fsWatcher?.close();
-    if (drainSafetyTimer)
-        clearInterval(drainSafetyTimer);
+    clearInterval(drainSafetyTimer);
     wsClient.close();
+    await endAllOpenSessions(controlPlaneUrl, safeCreds.apiKey);
     log.success('Sync daemon stopped.');
 }
 async function scanLocalSops(workspaceRoot) {