@intutic/cli 2.0.0 → 2.2.0

package/dist/lib/envInjector.js

@@ -1,15 +1,15 @@
 /**
- * Environment Variable Injector (TD-041 graduation)
+ * Environment Variable Injector
  *
  * Injects ANTHROPIC_BASE_URL and OPENAI_BASE_URL as persistent
- * system-level environment variables that survive terminal restarts.
+ * environment variables that new terminals and applications pick up, and
+ * removes them again.
  *
  * Platform support:
- *   macOS:   launchctl setenv <KEY> <VALUE>
- *   Linux:   ~/.bashrc append (user-level; system /etc/environment requires sudo)
+ *   macOS:   launchctl setenv <KEY> <VALUE> (until logout)
+ *   Linux:   /etc/environment when writable (root), else ~/.bashrc
  *   Windows: setx <KEY> <VALUE> (user-level, no /M)
  *
- * LLD #30: Multi-Region Preparation, WS-5MR (TD-041)
  * @module
  */
 import { execSync } from 'node:child_process';
@@ -19,80 +19,87 @@ import os from 'node:os';
 import { createLogger } from '@intutic/logger';
 const logger = createLogger('envInjector');
 const ENV_VARS = ['ANTHROPIC_BASE_URL', 'OPENAI_BASE_URL'];
+function resolveTarget(t = {}) {
+    return {
+        platform: t.platform ?? os.platform(),
+        bashrc: t.bashrc ?? path.join(os.homedir(), '.bashrc'),
+        etcEnvironment: t.etcEnvironment ?? '/etc/environment',
+        exec: t.exec ?? ((command) => { execSync(command, { stdio: 'pipe' }); }),
+    };
+}
 export class PlatformNotSupportedError extends Error {
     constructor(platform) {
         super(`Platform not supported for env injection: ${platform}`);
         this.name = 'PlatformNotSupportedError';
     }
 }
-export class ElevationRequiredError extends Error {
-    constructor(path) {
-        super(`System-level write requires root access to ${path}. Falling back to user-level.`);
-        this.name = 'ElevationRequiredError';
-    }
-}
 function sanitizeShellValue(val) {
     return val.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/`/g, '\\`').replace(/\$/g, '\\$');
 }
-function macosInject(key, value) {
-    execSync(`launchctl setenv ${key} "${sanitizeShellValue(value)}"`, { stdio: 'pipe' });
+function bashrcMarker(key) {
+    return `# intutic-env-${key}`;
+}
+/** `text` without the lines `drop` matches, and otherwise byte for byte. */
+function withoutLines(text, drop) {
+    return text.split('\n').filter((l) => !drop(l)).join('\n');
 }
-function macosRemove(key) {
+function isWritable(file) {
     try {
-        execSync(`launchctl unsetenv ${key}`, { stdio: 'pipe' });
+        fs.accessSync(file, fs.constants.W_OK);
+        return true;
     }
     catch {
-        // Removal is idempotent by contract: `launchctl unsetenv` exits non-zero when
-        // the key was never set (or the user session has no launchd domain, e.g. over
-        // ssh). Both mean "already absent", which is the state the caller asked for.
+        return false;
     }
 }
-function linuxInjectUser(key, value) {
-    const rcFile = path.join(os.homedir(), '.bashrc');
-    const marker = `# intutic-env-${key}`;
-    const line = `export ${key}="${sanitizeShellValue(value)}" ${marker}`;
+function linuxInjectUser(bashrc, value) {
     let content = '';
     try {
-        content = fs.readFileSync(rcFile, 'utf8');
-    }
-    catch {
-        // A missing ~/.bashrc is the normal first-run case: `content` stays '' and the
-        // write below creates the file.
-        // CAUTION: this also swallows non-ENOENT read failures (EACCES, EISDIR, a
-        // symlink loop), and the write below then replaces the user's .bashrc with the
-        // single export line. Narrowing this to ENOENT would be a behaviour change, so
-        // it is deliberately left alone here rather than fixed as lint cleanup.
-    }
-    // Remove existing entry for this key
-    const lines = content.split('\n').filter(l => !l.includes(marker));
-    lines.push(line);
-    fs.writeFileSync(rcFile, lines.join('\n') + '\n', { mode: 0o644 });
+        content = fs.readFileSync(bashrc, 'utf8');
+    }
+    catch (err) {
+        // A missing ~/.bashrc is the normal first-run case; the write below
+        // creates it. Any other read failure must not end in the file being
+        // replaced by our two lines.
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    let next = withoutLines(content, (l) => ENV_VARS.some((key) => l.includes(bashrcMarker(key))));
+    if (next !== '' && !next.endsWith('\n'))
+        next += '\n';
+    for (const key of ENV_VARS)
+        next += `export ${key}="${sanitizeShellValue(value)}" ${bashrcMarker(key)}\n`;
+    fs.writeFileSync(bashrc, next, { mode: 0o644 });
 }
-function linuxRemoveUser(key) {
-    const rcFile = path.join(os.homedir(), '.bashrc');
-    const marker = `# intutic-env-${key}`;
+/** Removes exactly the marked lines `linuxInjectUser` added. */
+function linuxRemoveUser(bashrc) {
+    let content;
     try {
-        const content = fs.readFileSync(rcFile, 'utf8');
-        const filtered = content.split('\n').filter(l => !l.includes(marker)).join('\n');
-        fs.writeFileSync(rcFile, filtered + '\n', { mode: 0o644 });
+        content = fs.readFileSync(bashrc, 'utf8');
     }
     catch {
-        // Nothing to remove if ~/.bashrc does not exist, and an unwritable rc file must
-        // not fail an uninstall: the marker line is inert shell state, so leaving it in
-        // place is strictly better than aborting the rest of the removal sequence.
+        return; // Nothing to remove.
     }
+    const next = withoutLines(content, (l) => ENV_VARS.some((key) => l.includes(bashrcMarker(key))));
+    if (next !== content)
+        fs.writeFileSync(bashrc, next);
 }
-function windowsInject(key, value) {
-    execSync(`setx ${key} "${sanitizeShellValue(value)}"`, { stdio: 'pipe' });
-}
-function windowsRemove(key) {
-    try {
-        execSync(`reg delete HKCU\\Environment /v ${key} /f`, { stdio: 'pipe' });
-    }
-    catch {
-        // `reg delete` exits 1 with "unable to find the specified registry key or value"
-        // when the value is already gone. Removal is idempotent, so absence is success.
+/**
+ * pam_env reads /etc/environment and has no trailing comments, so these
+ * lines carry no marker: `KEY=` lines for the two variables are ours to
+ * replace and to remove, the same as on the way in.
+ */
+function linuxSetSystem(etcEnvironment, value) {
+    const content = fs.readFileSync(etcEnvironment, 'utf8');
+    let next = withoutLines(content, (l) => ENV_VARS.some((key) => l.startsWith(`${key}=`)));
+    if (value !== null) {
+        if (next !== '' && !next.endsWith('\n'))
+            next += '\n';
+        for (const key of ENV_VARS)
+            next += `${key}="${sanitizeShellValue(value)}"\n`;
     }
+    if (next !== content)
+        fs.writeFileSync(etcEnvironment, next);
 }
 /**
  * Injects ANTHROPIC_BASE_URL and OPENAI_BASE_URL as persistent env vars.
@@ -100,66 +107,70 @@ function windowsRemove(key) {
  * @param proxyUrl - The Intutic proxy URL (e.g. https://proxy.acme.intutic.ai)
  * @returns InjectionResult describing what was done
  */
-export async function injectBaseUrlEnvVars(proxyUrl) {
-    const platform = os.platform();
+export async function injectBaseUrlEnvVars(proxyUrl, target) {
+    const t = resolveTarget(target);
+    const platform = t.platform;
     logger.info({ platform, proxyUrl }, 'envInjector.inject_start');
     if (platform === 'darwin') {
         for (const key of ENV_VARS)
-            macosInject(key, proxyUrl);
+            t.exec(`launchctl setenv ${key} "${sanitizeShellValue(proxyUrl)}"`);
         logger.info({ platform, vars: ENV_VARS }, 'envInjector.macos_launchctl_set');
         return { platform, scope: 'system', vars: [...ENV_VARS], method: 'launchctl setenv' };
     }
     if (platform === 'linux') {
-        // Attempt system-level first; fall back to user-level
-        let scope = 'user';
-        try {
-            const etcEnv = '/etc/environment';
-            // Only attempt if writable (i.e., running as root)
-            fs.accessSync(etcEnv, fs.constants.W_OK);
-            for (const key of ENV_VARS) {
-                let content = fs.readFileSync(etcEnv, 'utf8');
-                content = content.split('\n').filter(l => !l.startsWith(`${key}=`)).join('\n');
-                content += `\n${key}="${sanitizeShellValue(proxyUrl)}"`;
-                fs.writeFileSync(etcEnv, content.trim() + '\n', { mode: 0o644 });
-            }
-            scope = 'system';
+        if (isWritable(t.etcEnvironment)) {
+            linuxSetSystem(t.etcEnvironment, proxyUrl);
             logger.info({ platform, vars: ENV_VARS }, 'envInjector.linux_etc_environment_set');
+            return { platform, scope: 'system', vars: [...ENV_VARS], method: '/etc/environment' };
         }
-        catch {
-            // Not root \u2014 user-level fallback
-            for (const key of ENV_VARS)
-                linuxInjectUser(key, proxyUrl);
-            logger.info({ platform, vars: ENV_VARS }, 'envInjector.linux_bashrc_set');
-        }
-        return { platform, scope, vars: [...ENV_VARS], method: scope === 'system' ? '/etc/environment' : '~/.bashrc' };
+        linuxInjectUser(t.bashrc, proxyUrl);
+        logger.info({ platform, vars: ENV_VARS }, 'envInjector.linux_bashrc_set');
+        return { platform, scope: 'user', vars: [...ENV_VARS], method: '~/.bashrc' };
     }
     if (platform === 'win32') {
         for (const key of ENV_VARS)
-            windowsInject(key, proxyUrl);
+            t.exec(`setx ${key} "${sanitizeShellValue(proxyUrl)}"`);
         logger.info({ platform, vars: ENV_VARS }, 'envInjector.windows_setx_set');
         return { platform, scope: 'user', vars: [...ENV_VARS], method: 'setx' };
     }
     throw new PlatformNotSupportedError(platform);
 }
 /**
- * Removes the injected base URL env vars.
+ * Removes the injected base URL env vars: from wherever `injectBaseUrlEnvVars`
+ * can have put them, so a removal is idempotent and complete.
  */
-export async function removeBaseUrlEnvVars() {
-    const platform = os.platform();
+export async function removeBaseUrlEnvVars(target) {
+    const t = resolveTarget(target);
+    const platform = t.platform;
     logger.info({ platform }, 'envInjector.remove_start');
     if (platform === 'darwin') {
-        for (const key of ENV_VARS)
-            macosRemove(key);
+        for (const key of ENV_VARS) {
+            try {
+                t.exec(`launchctl unsetenv ${key}`);
+            }
+            catch {
+                // `launchctl unsetenv` exits non-zero when the key was never set (or the
+                // session has no launchd domain, e.g. over ssh): already absent.
+            }
+        }
         return;
     }
     if (platform === 'linux') {
-        for (const key of ENV_VARS)
-            linuxRemoveUser(key);
+        linuxRemoveUser(t.bashrc);
+        // Persist wrote here instead when it ran as root.
+        if (isWritable(t.etcEnvironment))
+            linuxSetSystem(t.etcEnvironment, null);
         return;
     }
     if (platform === 'win32') {
-        for (const key of ENV_VARS)
-            windowsRemove(key);
+        for (const key of ENV_VARS) {
+            try {
+                t.exec(`reg delete HKCU\\Environment /v ${key} /f`);
+            }
+            catch {
+                // `reg delete` exits 1 when the value is already gone: absence is success.
+            }
+        }
         return;
     }
     throw new PlatformNotSupportedError(platform);

package/dist/lib/envInjector.js.map

@@ -1 +1 @@
-{"version":3,"file":"envInjector.js","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;AAE1C,MAAM,QAAQ,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,CAAU,CAAA;AASnE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,QAAgB;QAC1B,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,IAAY;QACtB,KAAK,CAAC,8CAA8C,IAAI,+BAA+B,CAAC,CAAA;QACxF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa;IAC7C,QAAQ,CAAC,oBAAoB,GAAG,KAAK,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,QAAQ,CAAC,sBAAsB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,8EAA8E;QAC9E,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,iBAAiB,GAAG,EAAE,CAAA;IACrC,MAAM,IAAI,GAAK,UAAU,GAAG,KAAK,kBAAkB,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAA;IAEvE,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,gCAAgC;QAChC,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,wEAAwE;IAC1E,CAAC;IAED,qCAAqC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,iBAAiB,GAAG,EAAE,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,gFAAgF;QAChF,2EAA2E;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa;IAC/C,QAAQ,CAAC,QAAQ,GAAG,KAAK,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,mCAAmC,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAE/D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACvF,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,sDAAsD;QACtD,IAAI,KAAK,GAAsB,MAAM,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAA;YACjC,mDAAmD;YACnD,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACxC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC7C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC9E,OAAO,IAAI,KAAK,GAAG,KAAK,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAA;gBACvD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClE,CAAC;YACD,KAAK,GAAG,QAAQ,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAA;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;YACtC,KAAK,MAAM,GAAG,IAAI,QAAQ;gBAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChH,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAErD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,eAAe,CAAC,GAAG,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,aAAa,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAM;IACR,CAAC;IACD,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"envInjector.js","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;AAE1C,MAAM,QAAQ,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,CAAU,CAAA;AAsBnE,SAAS,aAAa,CAAC,IAAuB,EAAE;IAC9C,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;QACtD,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,kBAAkB;QACtD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;KACxE,CAAA;AACH,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,QAAgB;QAC1B,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACnG,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,iBAAiB,GAAG,EAAE,CAAA;AAC/B,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,IAAY,EAAE,IAA+B;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa;IACpD,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,oEAAoE;QACpE,6BAA6B;QAC7B,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IACD,IAAI,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9F,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,IAAI,CAAA;IACrD,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,IAAI,IAAI,UAAU,GAAG,KAAK,kBAAkB,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,IAAI,CAAA;IACzG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAM,CAAC,qBAAqB;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAChG,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,cAAsB,EAAE,KAAoB;IAClE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACxF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI,IAAI,CAAA;QACrD,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,IAAI,IAAI,GAAG,GAAG,KAAK,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAA;IAC/E,CAAC;IACD,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAA0B;IACrF,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAE/D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,KAAK,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC/F,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACvF,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAA;YAClF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;QACvF,CAAC;QACD,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC9E,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACnF,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IACnE,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAErD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzB,kDAAkD;QAClD,IAAI,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;YAAE,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;QACxE,OAAM;IACR,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,mCAAmC,GAAG,KAAK,CAAC,CAAA;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;YAC7E,CAAC;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC"}

package/dist/lib/localProxy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Where the local proxy listens, for every command that talks to it.
+ *
+ * One source: `INTUTIC_PROXY_URL` (default `http://localhost:4000`), the
+ * variable `intutic exec` already points agents at. `connect` used to take its
+ * port from `PORT` while `budget` and `doctor` hardcoded 4000, so moving the
+ * proxy left them probing a port nothing listened on. `PORT` is not read: in a
+ * developer's shell it usually belongs to some other server.
+ *
+ * @module
+ */
+/** The local proxy's port, from `INTUTIC_PROXY_URL` (an empty value means unset). */
+export declare function localProxyPort(): number;
+/**
+ * `http://127.0.0.1:<port>`: the loopback address, not `localhost`, so a probe
+ * cannot resolve to `::1` while the proxy listens on IPv4 only.
+ */
+export declare function localProxyProbeBase(): string;
+//# sourceMappingURL=localProxy.d.ts.map

package/dist/lib/localProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localProxy.d.ts","sourceRoot":"","sources":["../../src/lib/localProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,CASvC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/lib/localProxy.js

@@ -0,0 +1,33 @@
+/**
+ * Where the local proxy listens, for every command that talks to it.
+ *
+ * One source: `INTUTIC_PROXY_URL` (default `http://localhost:4000`), the
+ * variable `intutic exec` already points agents at. `connect` used to take its
+ * port from `PORT` while `budget` and `doctor` hardcoded 4000, so moving the
+ * proxy left them probing a port nothing listened on. `PORT` is not read: in a
+ * developer's shell it usually belongs to some other server.
+ *
+ * @module
+ */
+const DEFAULT_PROXY_PORT = 4000;
+/** The local proxy's port, from `INTUTIC_PROXY_URL` (an empty value means unset). */
+export function localProxyPort() {
+    const raw = process.env.INTUTIC_PROXY_URL;
+    if (!raw)
+        return DEFAULT_PROXY_PORT;
+    try {
+        const port = Number(new URL(raw).port);
+        return port > 0 ? port : DEFAULT_PROXY_PORT;
+    }
+    catch {
+        return DEFAULT_PROXY_PORT;
+    }
+}
+/**
+ * `http://127.0.0.1:<port>`: the loopback address, not `localhost`, so a probe
+ * cannot resolve to `::1` while the proxy listens on IPv4 only.
+ */
+export function localProxyProbeBase() {
+    return `http://127.0.0.1:${localProxyPort()}`;
+}
+//# sourceMappingURL=localProxy.js.map

package/dist/lib/localProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localProxy.js","sourceRoot":"","sources":["../../src/lib/localProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,kBAAkB,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QACtC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,oBAAoB,cAAc,EAAE,EAAE,CAAA;AAC/C,CAAC"}

package/dist/lib/onboarding.d.ts

@@ -6,5 +6,5 @@
  * LLD #8 — Sync Daemon / CLI
  * @module
  */
-export declare function printOnboardingGuide(harnesses: string[], userAuthToken?: string, devMode?: boolean): void;
+export declare function printOnboardingGuide(harnesses: string[], userAuthToken?: string): void;
 //# sourceMappingURL=onboarding.d.ts.map

package/dist/lib/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyCH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,IAAI,CA2NvG"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAgOtF"}

package/dist/lib/onboarding.js

@@ -8,30 +8,18 @@
  */
 import pc from 'picocolors';
 import { log } from './logger.js';
+import { anthropicBaseUrl, openaiBaseUrl } from '@intutic/shared-types';
 /**
  * Print tailored setup instructions for a list of harnesses.
  *
  * @param harnesses - List of harness types (e.g. ['cursor', 'aider'])
  * @param apiKey - Optional API key to display in the instructions
- * @param devMode - retained for call-site compatibility; the proxy is always local
  */
 function maskUserToken(tokenVal) {
     if (!tokenVal)
-        return '<YOUR_INTUTIC_API_KEY>';
+        return '<YOUR_PROVIDER_API_KEY>';
     return `${tokenVal.substring(0, 4)}...${tokenVal.substring(tokenVal.length - 4)}`;
 }
-/**
- * Trims trailing `/` characters without a regex — see the identical helper
- * in `commands/exec.ts` for why: `/\/+$/` is flagged by static analysis as a
- * polynomial-time pattern on external input, and a loop sidesteps the whole
- * category rather than needing an exemption.
- */
-function trimTrailingSlashes(s) {
-    let end = s.length;
-    while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */)
-        end--;
-    return s.slice(0, end);
-}
 function writeCliOutput(line) {
     process.stdout.write(line + '\n');
 }
@@ -41,15 +29,14 @@ function printEnvVar(envName, envVal) {
 function printYamlKey(keyName, keyVal, spaces = 5) {
     writeCliOutput(`${' '.repeat(spaces)}${keyName}: ${keyVal}`);
 }
-export function printOnboardingGuide(harnesses, userAuthToken, devMode = false) {
+export function printOnboardingGuide(harnesses, userAuthToken) {
     const safeDisplayValue = maskUserToken(userAuthToken);
     // Always the local proxy. This used to branch to a remote host when devMode
     // was false, which meant the onboarding instructions we print told people to
     // send their agent traffic somewhere other than the proxy they had just
     // started. Set INTUTIC_PROXY_URL to override.
-    void devMode;
-    const proxyHost = trimTrailingSlashes(process.env.INTUTIC_PROXY_URL ?? 'http://localhost:4000');
-    const proxyUrl = `${proxyHost}/v1`;
+    const proxyHost = anthropicBaseUrl(process.env.INTUTIC_PROXY_URL);
+    const proxyUrl = openaiBaseUrl(process.env.INTUTIC_PROXY_URL);
     writeCliOutput('');
     log.header('Intutic — Setup & Integration Instructions');
     writeCliOutput(`To route your agent traffic through the Intutic proxy, follow the setup below.`);
@@ -57,10 +44,15 @@ export function printOnboardingGuide(harnesses, userAuthToken, devMode = false)
     if (userAuthToken) {
         writeCliOutput(`Your Intutic API Key is: ${pc.green(safeDisplayValue)}`);
     }
+    else {
+        // Standalone, the proxy forwards the agent's own provider key upstream;
+        // there is no Intutic key to hand out.
+        writeCliOutput('Not logged in: wherever a key is asked for below, use your own provider API key.');
+    }
     if (harnesses.length === 0) {
         writeCliOutput('');
         log.info('No harnesses were automatically detected in this workspace.');
-        writeCliOutput(`Please refer to the full integration guide at: ${pc.bold('user.md')}`);
+        writeCliOutput(`See the integration guides at: ${pc.bold('https://docs.intutic.ai/integrations/')}`);
         writeCliOutput('Or use the general subprocess wrapper to launch any CLI agent:');
         writeCliOutput(`  ${pc.bold(`intutic exec -- <your-agent-command>`)}`);
         return;
@@ -71,7 +63,7 @@ export function printOnboardingGuide(harnesses, userAuthToken, devMode = false)
             case 'cursor':
                 writeCliOutput(`  1. Open Cursor Settings (Cmd+, or Ctrl+,).`);
                 writeCliOutput(`  2. Navigate to the ${pc.bold('Models')} tab.`);
-                writeCliOutput(`  3. Under ${pc.bold('OpenAI API Key')}, enter your Intutic API Key:`);
+                writeCliOutput(`  3. Under ${pc.bold('OpenAI API Key')}, enter your API key:`);
                 writeCliOutput(`     ${pc.green(safeDisplayValue)}`);
                 writeCliOutput(`  4. Enable the ${pc.bold('"Override OpenAI Base URL"')} toggle.`);
                 writeCliOutput(`  5. Set the override URL to:`);
@@ -113,7 +105,7 @@ export function printOnboardingGuide(harnesses, userAuthToken, devMode = false)
                 writeCliOutput(`  2. Click the settings gear icon (⚙️).`);
                 writeCliOutput(`  3. Set ${pc.bold('API Provider')} to: OpenAI Compatible`);
                 writeCliOutput(`  4. Set ${pc.bold('Base URL')} to: ${pc.cyan(proxyUrl)}`);
-                writeCliOutput(`  5. Set ${pc.bold('API Key')} to your Intutic API Key:`);
+                writeCliOutput(`  5. Set ${pc.bold('API Key')} to your API key:`);
                 writeCliOutput(`     ${pc.green(safeDisplayValue)}`);
                 writeCliOutput(`  6. Enter the target Model ID (e.g. gpt-4o) and save.`);
                 break;
@@ -176,19 +168,21 @@ export function printOnboardingGuide(harnesses, userAuthToken, devMode = false)
                 writeCliOutput(`  In your OpenAI Chat Model node inside n8n:`);
                 writeCliOutput(`  1. Expand "Parameters" and set ${pc.bold('Base URL')} to:`);
                 writeCliOutput(`     ${pc.cyan(proxyUrl)}`);
-                writeCliOutput(`  2. Select/Create a custom credential set and use your Intutic API Key.`);
+                writeCliOutput(`  2. Select/Create a custom credential set and use your API key.`);
                 break;
             case 'windsurf':
-                writeCliOutput(`  Set the custom API base URL and key in the Windsurf settings tab.`);
+                writeCliOutput(`  Windsurf has no base-URL setting. intutic connect routes Cascade through the`);
+                writeCliOutput(`  proxy's TLS interception (http.proxy in Windsurf's user settings.json).`);
                 break;
             case 'dsh':
                 writeCliOutput(`  Every sync registers the Intutic gate into each EXISTING dsh profile`);
                 writeCliOutput(`  (${pc.bold('cordis.patch.yml')} + the ${pc.bold('@intutic/gate')} package.json dependency) and`);
-                writeCliOutput(`  redirects both the llm-deepseek (default) and llm-pi-ai (selectable) LLM`);
-                writeCliOutput(`  routes in ${pc.bold('settings.yaml')} through the Intutic proxy — no manual config edit.`);
+                writeCliOutput(`  points dsh's default LLM route (the ${pc.bold('llm-deepseek')} entry, in that same`);
+                writeCliOutput(`  ${pc.bold('cordis.patch.yml')}) at the Intutic proxy — no manual config edit.`);
                 writeCliOutput(`  `);
-                writeCliOutput(`  One manual step remains, PER PROFILE: this daemon cannot run a package`);
-                writeCliOutput(`  manager in a directory it does not own, so finish activation with:`);
+                writeCliOutput(`  One manual step remains, PER PROFILE — until it runs, dsh only warns and`);
+                writeCliOutput(`  runs UNGOVERNED. This daemon cannot run a package manager in a directory`);
+                writeCliOutput(`  it does not own, so finish activation with:`);
                 writeCliOutput(`     ${pc.bold('dsh plugin --profile <name> add @intutic/gate')}`);
                 writeCliOutput(`  See ${pc.cyan('$DSH_HOME/INSTALL.md')} (auto-generated, lists your current profiles).`);
                 writeCliOutput(`  `);

package/dist/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,wBAAwB,CAAA;IAC9C,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,cAAc,CAAC,eAAe,OAAO,KAAK,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAC/D,cAAc,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAmB,EAAE,aAAsB,EAAE,OAAO,GAAG,KAAK;IAC/F,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,8CAA8C;IAC9C,KAAK,OAAO,CAAA;IACZ,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAElC,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAA;IACxD,cAAc,CAAC,gFAAgF,CAAC,CAAA;IAChG,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,cAAc,CAAC,4BAA4B,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,CAAC,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACvE,cAAc,CAAC,kDAAkD,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACtF,cAAc,CAAC,gEAAgE,CAAC,CAAA;QAChF,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;QACtE,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3F,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,QAAQ;gBACX,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAChE,cAAc,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,CAAA;gBACtF,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAA;gBAClF,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,sDAAsD,CAAC,CAAA;gBACtE,MAAK;YAEP,KAAK,aAAa;gBAChB,cAAc,CAAC,+DAA+D,CAAC,CAAA;gBAC/E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAA;gBAC3D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACxE,WAAW,CAAC,mBAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAC5D,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAA;gBAChF,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,qCAAqC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;gBACnG,cAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;gBACnD,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAA;gBACvF,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBACxC,cAAc,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;gBAC/C,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;gBAC3C,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACrE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBAC3E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;gBACxE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAA;gBAC3F,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBACpD,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAA;gBAC9D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,mCAAmC,CAAC,CAAA;gBACnD,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACjE,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAA;gBAC9F,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,cAAc,CAAC,oBAAoB,CAAC,CAAA;gBACpC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,4BAA4B,QAAQ,IAAI,CAAC,CAAA;gBACxD,cAAc,CAAC,8BAA8B,gBAAgB,IAAI,CAAC,CAAA;gBAClE,cAAc,CAAC,2CAA2C,CAAC,CAAA;gBAC3D,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,YAAY,CAAC,CAAA;gBAC5B,cAAc,CAAC,UAAU,CAAC,CAAA;gBAC1B,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;gBACzF,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACvC,cAAc,CAAC,iCAAiC,CAAC,CAAA;gBACjD,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,oBAAoB,QAAQ,GAAG,CAAC,CAAA;gBAC/C,cAAc,CAAC,kCAAkC,CAAC,CAAA;gBAClD,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACvE,cAAc,CAAC,oBAAoB,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAA;gBAC/D,MAAK;YAEP,KAAK,gBAAgB;gBACnB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,mEAAmE,CAAC,CAAA;gBACnF,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,MAAK;YAEP,KAAK,YAAY;gBACf,cAAc,CAAC,oEAAoE,CAAC,CAAA;gBACpF,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,cAAc,CAAC,sBAAsB,KAAK,KAAK,gBAAgB,GAAG,CAAC,CAAA;gBACnE,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,oCAAoC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC7E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,qEAAqE,CAAC,CAAA;gBACrF,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;gBAClH,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,qDAAqD,CAAC,CAAA;gBAC5G,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;gBAClF,cAAc,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,CAAA;gBACzG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,+EAA+E,CAAC,CAAA;gBAC/F,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,MAAK;YAEP,KAAK,MAAM;gBACT,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,8CAA8C;gBAC9C,cAAc,CAAC,yEAAyE,CAAC,CAAA;gBACzF,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,8EAA8E,CAAC,CAAA;gBAC9F,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAA;gBACrE,MAAK;YAEP,KAAK,UAAU;gBACb,sEAAsE;gBACtE,mDAAmD;gBACnD,cAAc,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,sBAAsB,CAAC,CAAA;gBAC5G,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,gDAAgD,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAC3F,cAAc,CAAC,wDAAwD,QAAQ,SAAS,CAAC,CAAA;gBACzF,cAAc,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;gBACtI,MAAK;YAEP,KAAK,sBAAsB;gBACzB,iEAAiE;gBACjE,qEAAqE;gBACrE,mEAAmE;gBACnE,kBAAkB;gBAClB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,8DAA8D,CAAC,CAAA;gBAC9E,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAA;gBACrF,MAAK;YAEP;gBACE,cAAc,CAAC,qDAAqD,CAAC,CAAA;gBACrE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;gBACzE,cAAc,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChF,MAAK;QACT,CAAC;IACH,CAAC;IAED,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpB,CAAC"}
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,yBAAyB,CAAA;IAC/C,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACnF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,cAAc,CAAC,eAAe,OAAO,KAAK,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAC/D,cAAc,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAmB,EAAE,aAAsB;IAC9E,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAE7D,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAA;IACxD,cAAc,CAAC,gFAAgF,CAAC,CAAA;IAChG,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,cAAc,CAAC,4BAA4B,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uCAAuC;QACvC,cAAc,CAAC,kFAAkF,CAAC,CAAA;IACpG,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,CAAC,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACvE,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAA;QACpG,cAAc,CAAC,gEAAgE,CAAC,CAAA;QAChF,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;QACtE,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3F,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,QAAQ;gBACX,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAChE,cAAc,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;gBAC9E,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAA;gBAClF,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,sDAAsD,CAAC,CAAA;gBACtE,MAAK;YAEP,KAAK,aAAa;gBAChB,cAAc,CAAC,+DAA+D,CAAC,CAAA;gBAC/E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAA;gBAC3D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACxE,WAAW,CAAC,mBAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAC5D,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAA;gBAChF,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,qCAAqC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;gBACnG,cAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;gBACnD,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAA;gBACvF,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBACxC,cAAc,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;gBAC/C,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;gBAC3C,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACrE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBAC3E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;gBACjE,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;gBACxE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAA;gBAC3F,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBACpD,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAA;gBAC9D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,mCAAmC,CAAC,CAAA;gBACnD,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACjE,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAA;gBAC9F,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,cAAc,CAAC,oBAAoB,CAAC,CAAA;gBACpC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,4BAA4B,QAAQ,IAAI,CAAC,CAAA;gBACxD,cAAc,CAAC,8BAA8B,gBAAgB,IAAI,CAAC,CAAA;gBAClE,cAAc,CAAC,2CAA2C,CAAC,CAAA;gBAC3D,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,YAAY,CAAC,CAAA;gBAC5B,cAAc,CAAC,UAAU,CAAC,CAAA;gBAC1B,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;gBACzF,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACvC,cAAc,CAAC,iCAAiC,CAAC,CAAA;gBACjD,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,oBAAoB,QAAQ,GAAG,CAAC,CAAA;gBAC/C,cAAc,CAAC,kCAAkC,CAAC,CAAA;gBAClD,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACvE,cAAc,CAAC,oBAAoB,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAA;gBAC/D,MAAK;YAEP,KAAK,gBAAgB;gBACnB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,mEAAmE,CAAC,CAAA;gBACnF,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,MAAK;YAEP,KAAK,YAAY;gBACf,cAAc,CAAC,oEAAoE,CAAC,CAAA;gBACpF,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,cAAc,CAAC,sBAAsB,KAAK,KAAK,gBAAgB,GAAG,CAAC,CAAA;gBACnE,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,oCAAoC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC7E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,kEAAkE,CAAC,CAAA;gBAClF,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,gFAAgF,CAAC,CAAA;gBAChG,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;gBAClH,cAAc,CAAC,yCAAyC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAA;gBACtG,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,iDAAiD,CAAC,CAAA;gBACjG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,+CAA+C,CAAC,CAAA;gBAC/D,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;gBAClF,cAAc,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,CAAA;gBACzG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,+EAA+E,CAAC,CAAA;gBAC/F,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,MAAK;YAEP,KAAK,MAAM;gBACT,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,8CAA8C;gBAC9C,cAAc,CAAC,yEAAyE,CAAC,CAAA;gBACzF,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,8EAA8E,CAAC,CAAA;gBAC9F,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAA;gBACrE,MAAK;YAEP,KAAK,UAAU;gBACb,sEAAsE;gBACtE,mDAAmD;gBACnD,cAAc,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,sBAAsB,CAAC,CAAA;gBAC5G,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,gDAAgD,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAC3F,cAAc,CAAC,wDAAwD,QAAQ,SAAS,CAAC,CAAA;gBACzF,cAAc,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;gBACtI,MAAK;YAEP,KAAK,sBAAsB;gBACzB,iEAAiE;gBACjE,qEAAqE;gBACrE,mEAAmE;gBACnE,kBAAkB;gBAClB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,8DAA8D,CAAC,CAAA;gBAC9E,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAA;gBACrF,MAAK;YAEP;gBACE,cAAc,CAAC,qDAAqD,CAAC,CAAA;gBACrE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;gBACzE,cAAc,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChF,MAAK;QACT,CAAC;IACH,CAAC;IAED,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpB,CAAC"}

package/dist/lib/otelPropagation.d.ts

@@ -2,7 +2,7 @@
  * OpenTelemetry trace-context propagation for outbound CLI HTTP calls.
  *
  * Deliberately lighter than the NodeSDK instrumentation used by
- * control-plane/gateway-daemon/mcp-daemon: `intutic connect` is a daemon
+ * control-plane/mcp-daemon: `intutic connect` is a daemon
  * every open-core user installs, and the auto-instrumentations-node
  * meta-package is heavy (dozens of instrumented libraries the CLI doesn't
  * use) for a benefit only the minority who run a collector would see.

package/dist/lib/otelPropagation.js

@@ -2,7 +2,7 @@
  * OpenTelemetry trace-context propagation for outbound CLI HTTP calls.
  *
  * Deliberately lighter than the NodeSDK instrumentation used by
- * control-plane/gateway-daemon/mcp-daemon: `intutic connect` is a daemon
+ * control-plane/mcp-daemon: `intutic connect` is a daemon
  * every open-core user installs, and the auto-instrumentations-node
  * meta-package is heavy (dozens of instrumented libraries the CLI doesn't
  * use) for a benefit only the minority who run a collector would see.

package/dist/lib/policySnapshot.d.ts

@@ -18,7 +18,8 @@
  *              wait" would be a supported way to disarm governance.
  *   empty    — parsed, but no rules. The writer always ships the destructive
  *              tier, so zero rules means the compile produced nothing.
- *   invalid  — digest or workspace mismatch. The gates drop the dynamic tier.
+ *   invalid  — digest or workspace mismatch. The gates drop the dynamic tier,
+ *              keeping only its SSO-group refusals.
  *   absent   — no file. The compiled floor still applies; nothing else does.
  *
  * Kept deliberately faithful rather than improved: a reader that disagrees with

package/dist/lib/policySnapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAE3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAA;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACrE,oBAAoB,CAiFtB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACtD,oBAAoB,CAkBtB"}
+{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAE3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAA;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACrE,oBAAoB,CAsFtB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACtD,oBAAoB,CAkBtB"}

package/dist/lib/policySnapshot.js

@@ -18,7 +18,8 @@
  *              wait" would be a supported way to disarm governance.
  *   empty    — parsed, but no rules. The writer always ships the destructive
  *              tier, so zero rules means the compile produced nothing.
- *   invalid  — digest or workspace mismatch. The gates drop the dynamic tier.
+ *   invalid  — digest or workspace mismatch. The gates drop the dynamic tier,
+ *              keeping only its SSO-group refusals.
  *   absent   — no file. The compiled floor still applies; nothing else does.
  *
  * Kept deliberately faithful rather than improved: a reader that disagrees with
@@ -75,6 +76,9 @@ export function parsePolicySnapshot(text, opts = {}) {
         droppedRules: 0,
         path: opts.path ?? resolveSnapshotRulesPath(),
     };
+    // The SSO-group refusals the gates keep when they drop the rest of an
+    // invalid snapshot's dynamic tier.
+    let ssoGroupRefusals = 0;
     const lines = text.split('\n');
     for (const line of lines) {
         if (line.startsWith('#digest ')) {
@@ -109,6 +113,8 @@ export function parsePolicySnapshot(text, opts = {}) {
             continue;
         }
         out.ruleCount += 1;
+        if (f[0].startsWith('sso_group.') && f[1] === 'block')
+            ssoGroupRefusals += 1;
     }
     // Integrity, cheapest failure first. A digest nobody recomputes is a comment;
     // a workspace id nobody compares means workspace A's rules get enforced on B's
@@ -126,10 +132,11 @@ export function parsePolicySnapshot(text, opts = {}) {
     if (out.state === 'ok' && out.ruleCount === 0)
         out.state = 'empty';
     // The dynamic tier is additive, so dropping it returns to yesterday's
-    // behaviour rather than opening a hole. Reported as zero rules because zero is
-    // what the gates will have.
+    // behaviour rather than opening a hole — except the SSO-group refusals,
+    // which the gates keep because they only ever refuse. Reported as what the
+    // gates will have.
     if (out.state === 'invalid')
-        out.ruleCount = 0;
+        out.ruleCount = ssoGroupRefusals;
     if (out.state === 'ok' && out.generatedAt) {
         const t = Date.parse(out.generatedAt);
         if (!Number.isNaN(t)) {