@intutic/cli 2.1.0 → 2.3.0

package/dist/harness/windsurf.js

@@ -1,10 +1,15 @@
 /**
  * windsurf.ts — Windsurf adapter (full implementation with hooks + TLS MITM proxy config).
  *
- * Writes .windsurfrules governance text and injects Cascade hook scripts
+ * Writes the rule sets to `.windsurf/rules/intutic-governance.md` with
+ * `trigger: always_on`, which Cascade includes in every message
+ * (https://docs.devin.ai/desktop/cascade/memories, where Windsurf's rules
+ * docs now live; `.windsurfrules`, which earlier versions overwrote, is the
+ * legacy single file, and the user's own copy of it comes back), and injects
+ * Cascade hook scripts
  * at user-level (~/.codeium/windsurf/hooks.json) and workspace-level
  * (.windsurf/hooks.json), merged with any hooks already there. Also merges
- * HTTP proxy settings into ~/.codeium/windsurf/settings.json, and switches
+ * HTTP proxy settings into Windsurf's user settings.json, and switches
  * the IDE HTTP proxy of every JetBrains IDE where the Windsurf plugin is set
  * up, so Windsurf's AI traffic goes through the Intutic TLS MITM proxy.
  *
@@ -14,20 +19,18 @@
 import { access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { buildMarkdownContent } from './base.js';
+import { HarnessType, rulesFrontMatterOf } from '@intutic/shared-types';
 import { loadCredentials } from '../config/store.js';
 import { writeWindsurfHooks } from '@intutic/sync-daemon/harness/windsurfHooks';
-import { writeFile, rename, mkdir } from 'node:fs/promises';
-import { dirname } from 'node:path';
-const CONFIG_FILE = '.windsurfrules';
+import { ownRulesFileHash, retireLegacyRulesFile, writeOwnRulesFile } from './rulesFiles.js';
+const CONFIG_FILE = '.windsurf/rules/intutic-governance.md';
+const LEGACY_FILE = '.windsurfrules';
 const WINDSURF_USER_DIR = join(homedir(), '.codeium', 'windsurf');
 export const windsurfAdapter = {
     type: HarnessType.WINDSURF,
     configFileName: CONFIG_FILE,
     async detect(workspaceRoot) {
-        for (const marker of [CONFIG_FILE, '.windsurf']) {
+        for (const marker of [LEGACY_FILE, '.windsurf']) {
             try {
                 await access(join(workspaceRoot, marker));
                 return true;
@@ -42,30 +45,20 @@ export const windsurfAdapter = {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // 1. Write .windsurfrules markdown governance text
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const content = buildMarkdownContent(sops, proxyUrl);
-        await mkdir(dirname(filePath), { recursive: true });
-        const tmp = filePath + '.intutic-tmp';
-        await writeFile(tmp, content, 'utf-8');
-        await rename(tmp, filePath);
-        // 2. Write Cascade hooks.json at user + workspace level, configure TLS MITM
-        //    proxy. The proxy serves HTTP CONNECT on the same listener as its API,
-        //    so the port is the one `intutic connect` runs it on (PORT, 4000 by
-        //    default).
+    /** Cascade hooks.json at user + workspace level, and the TLS MITM proxy.
+     *  The proxy serves HTTP CONNECT on the same listener as its API, so the
+     *  port is the one `intutic connect` runs it on (PORT, 4000 by default). */
+    async installGate(workspaceRoot, proxyUrl) {
         const proxyPort = parseInt(process.env.PORT || '4000', 10);
         const creds = await loadCredentials();
         await writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort, creds?.workspaceId || 'local');
-        return filePath;
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        await retireLegacyRulesFile(workspaceRoot, LEGACY_FILE);
+        return writeOwnRulesFile(workspaceRoot, CONFIG_FILE, sops, proxyUrl, rulesFrontMatterOf(HarnessType.WINDSURF, 'Intutic governance rules'));
+    },
+    readCurrentHash(workspaceRoot) {
+        return ownRulesFileHash(workspaceRoot, CONFIG_FILE);
     },
 };
 //# sourceMappingURL=windsurf.js.map

package/dist/harness/windsurf.js.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,mDAAmD;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACpD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;QACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAE3B,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,eAAe;QACf,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE3F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IACvF,CAAC;CACF,CAAA"}
+{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE5F,MAAM,WAAW,GAAG,uCAAuC,CAAA;AAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED;;gFAE4E;IAC5E,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC5I,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;CACF,CAAA"}

package/dist/harness/xirp.d.ts

@@ -13,13 +13,11 @@
  * That means this adapter exists for DETECTION/reporting only. `writeConfig`
  * writes nothing: whatever Intutic already writes for the wrapped harness
  * (`claudeCode.ts` / `codex.ts` / `antigravity.ts`'s own adapters) is what
- * governs a tool call made inside a Xirp-managed session — PROVIDED those
- * files actually reach the git worktree Xirp creates for that session, which
- * they do not by default: a worktree checkout has its own independent
- * working tree, and project-tier governance files are untracked. Part B of
- * the phase that added this adapter (`services/sync-daemon/src/lib/
- * gitWorktrees.ts` + its wiring into `syncLoop.ts`) is what closes that gap;
- * this adapter's only job is recognising that a Xirp-managed workspace is
+ * governs a tool call made inside a Xirp-managed session. Project-level
+ * files do not reach the git worktree Xirp creates for that session (a
+ * worktree has its own working tree, and these files are untracked), so it
+ * is the wrapped harness's user-level registration that applies there. This
+ * adapter's only job is recognising that a Xirp-managed workspace is
  * present at all, so `intutic status`/`intutic init` can report it.
  *
  * See `services/sync-daemon/__tests__/harness/gateRegistry.ts`'s NO_GATE row
@@ -32,8 +30,7 @@
  * download available in this environment, so none of the detection paths
  * below were live-verified against a real install — they follow this
  * codebase's own convention for comparable tools (`~/.grok`, `~/.muse`,
- * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source. See
- * TD-390.
+ * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/xirp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xirp.d.ts","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,WAAW,EAAE,eAgDzB,CAAA"}
+{"version":3,"file":"xirp.d.ts","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,WAAW,EAAE,eAgDzB,CAAA"}

package/dist/harness/xirp.js

@@ -13,13 +13,11 @@
  * That means this adapter exists for DETECTION/reporting only. `writeConfig`
  * writes nothing: whatever Intutic already writes for the wrapped harness
  * (`claudeCode.ts` / `codex.ts` / `antigravity.ts`'s own adapters) is what
- * governs a tool call made inside a Xirp-managed session — PROVIDED those
- * files actually reach the git worktree Xirp creates for that session, which
- * they do not by default: a worktree checkout has its own independent
- * working tree, and project-tier governance files are untracked. Part B of
- * the phase that added this adapter (`services/sync-daemon/src/lib/
- * gitWorktrees.ts` + its wiring into `syncLoop.ts`) is what closes that gap;
- * this adapter's only job is recognising that a Xirp-managed workspace is
+ * governs a tool call made inside a Xirp-managed session. Project-level
+ * files do not reach the git worktree Xirp creates for that session (a
+ * worktree has its own working tree, and these files are untracked), so it
+ * is the wrapped harness's user-level registration that applies there. This
+ * adapter's only job is recognising that a Xirp-managed workspace is
  * present at all, so `intutic status`/`intutic init` can report it.
  *
  * See `services/sync-daemon/__tests__/harness/gateRegistry.ts`'s NO_GATE row
@@ -32,8 +30,7 @@
  * download available in this environment, so none of the detection paths
  * below were live-verified against a real install — they follow this
  * codebase's own convention for comparable tools (`~/.grok`, `~/.muse`,
- * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source. See
- * TD-390.
+ * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -49,7 +46,7 @@ const XIRP_APP_PATH = '/Applications/Xirp.app';
 export const xirpAdapter = {
     type: HarnessType.XIRP,
     // No config file of its own — see module doc. Matches the goose/cline-
-    // style convention of an empty HARNESS_CONFIG_FILES entry for a harness
+    // style convention of an empty HARNESS_FILES entry for a harness
     // whose governance-relevant writes are not a single named file (in Xirp's
     // case: no writes of its own at all).
     configFileName: '',

package/dist/harness/xirp.js.map

@@ -1 +1 @@
-{"version":3,"file":"xirp.js","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,0EAA0E;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,sCAAsC;IACtC,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE/C,qEAAqE;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}
+{"version":3,"file":"xirp.js","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,0EAA0E;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,sCAAsC;IACtC,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE/C,qEAAqE;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}

package/dist/lib/api.d.ts

@@ -4,7 +4,6 @@
  * Uses native fetch() (Node 18+). All requests include
  * Authorization: Bearer <apiKey> header.
  *
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import type { SyncConfigPayload, DaemonStatus, SopHashReport } from '@intutic/shared-types';
@@ -45,6 +44,14 @@ export interface ApiClient {
         status: number;
         body: T;
     }>;
+    /**
+     * GET for a file download: the body as bytes.
+     *
+     * `get()` parses JSON, which a report served as markdown, CSV or PDF is
+     * not (`/api/v1/compliance/frameworks/:id/coverage?format=pdf`). A non-2xx
+     * throws exactly as `get()` does, since those errors are JSON.
+     */
+    getFile(path: string): Promise<Uint8Array>;
     /** Generic POST request for arbitrary API paths. */
     post<T>(path: string, body?: unknown): Promise<T>;
     /**
@@ -59,6 +66,19 @@ export interface ApiClient {
         status: number;
         body: T;
     }>;
+    /**
+     * PUT and DELETE that hand back the status, for the same reason:
+     * `PUT /api/v1/policy-guardrails/guardrails/:id` answers 400 with the
+     * validator's named checks and 409 with a `code`, and both are the answer.
+     */
+    putWithStatus<T>(path: string, body?: unknown): Promise<{
+        status: number;
+        body: T;
+    }>;
+    delWithStatus<T>(path: string): Promise<{
+        status: number;
+        body: T;
+    }>;
     /**
      * Multipart POST that hands back the status.
      *
@@ -83,6 +103,12 @@ export interface ApiClient {
  * @param controlPlaneUrl - Base URL (e.g., http://localhost:3001 or https://api.intutic.ai)
  * @param apiKey - API key (vk_*) or JWT access token
  */
+/**
+ * The error a failed call throws. A 403 carries the server's `detail` when it
+ * gives one (a role guard names the roles that may make the call), so a member
+ * whose role cannot do something is told which role can, not shown raw JSON.
+ */
+export declare function apiFailure(method: string, path: string, status: number, text: string): Error;
 export declare function createApiClient(controlPlaneUrl: string, apiKey: string): ApiClient;
 /**
  * Decodes a TOON payload, normalising "not TOON" to an empty list.

package/dist/lib/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpJ,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAmHlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpJ,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;OAIG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpF,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAU5F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CA2IlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}

package/dist/lib/api.js

@@ -4,7 +4,6 @@
  * Uses native fetch() (Node 18+). All requests include
  * Authorization: Bearer <apiKey> header.
  *
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import { toonDecode as sharedToonDecode } from '@intutic/shared-types';
@@ -15,6 +14,24 @@ import { injectTraceHeaders } from './otelPropagation.js';
  * @param controlPlaneUrl - Base URL (e.g., http://localhost:3001 or https://api.intutic.ai)
  * @param apiKey - API key (vk_*) or JWT access token
  */
+/**
+ * The error a failed call throws. A 403 carries the server's `detail` when it
+ * gives one (a role guard names the roles that may make the call), so a member
+ * whose role cannot do something is told which role can, not shown raw JSON.
+ */
+export function apiFailure(method, path, status, text) {
+    if (status === 403) {
+        try {
+            const body = JSON.parse(text);
+            if (typeof body.detail === 'string')
+                return new Error(`API ${method} ${path} refused (403): ${body.detail}`);
+        }
+        catch {
+            // Not JSON: fall through to the raw text.
+        }
+    }
+    return new Error(`API ${method} ${path} failed (${status}): ${text}`);
+}
 export function createApiClient(controlPlaneUrl, apiKey) {
     const baseHeaders = {
         'Content-Type': 'application/json',
@@ -33,10 +50,29 @@ export function createApiClient(controlPlaneUrl, apiKey) {
         });
         if (!res.ok) {
             const text = await res.text().catch(() => 'Unknown error');
-            throw new Error(`API ${method} ${path} failed (${res.status}): ${text}`);
+            throw apiFailure(method, path, res.status, text);
         }
         return unwrapToonEnvelope(await res.json());
     }
+    /** A JSON request whose non-2xx answer is returned, not thrown; a body that is not JSON comes back as `{ error: text }`. */
+    async function withStatus(method, path, body) {
+        const headers = { ...baseHeaders };
+        injectTraceHeaders(headers);
+        const res = await fetch(`${controlPlaneUrl}${path}`, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        const text = await res.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = { error: text };
+        }
+        return { status: res.status, body: unwrapToonEnvelope(parsed) };
+    }
     return {
         async fetchConfig(workspaceId) {
             return request('POST', '/api/v1/sync/config', { workspaceId });
@@ -72,26 +108,27 @@ export function createApiClient(controlPlaneUrl, apiKey) {
             }
             return { status: res.status, body: body };
         },
+        async getFile(path) {
+            const headers = { Authorization: baseHeaders.Authorization };
+            injectTraceHeaders(headers);
+            const res = await fetch(`${controlPlaneUrl}${path}`, { method: 'GET', headers });
+            if (!res.ok) {
+                const text = await res.text().catch(() => 'Unknown error');
+                throw apiFailure('GET', path, res.status, text);
+            }
+            return new Uint8Array(await res.arrayBuffer());
+        },
         async post(path, body) {
             return request('POST', path, body);
         },
         async postWithStatus(path, body) {
-            const headers = { ...baseHeaders };
-            injectTraceHeaders(headers);
-            const res = await fetch(`${controlPlaneUrl}${path}`, {
-                method: 'POST',
-                headers,
-                body: body ? JSON.stringify(body) : undefined,
-            });
-            const text = await res.text();
-            let parsed;
-            try {
-                parsed = JSON.parse(text);
-            }
-            catch {
-                parsed = { error: text };
-            }
-            return { status: res.status, body: unwrapToonEnvelope(parsed) };
+            return withStatus('POST', path, body);
+        },
+        async putWithStatus(path, body) {
+            return withStatus('PUT', path, body);
+        },
+        async delWithStatus(path) {
+            return withStatus('DELETE', path);
         },
         async postForm(path, form) {
             const headers = { Authorization: baseHeaders.Authorization };

package/dist/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA+CzD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,eAAuB,EAAE,MAAc;IACrE,MAAM,WAAW,GAAG;QAClB,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU,MAAM,EAAE;KACpC,CAAA;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,IAAI,EAAE,CAAA;QACvC,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAClD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,WAAmB;YACnC,OAAO,OAAO,CAAoB,MAAM,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAoB;YACrC,OAAO,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAqB;YACtC,OAAO,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,KAAK;YACT,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;YACzC,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY;YACvB,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,CAAC,aAAa,CAAI,IAAY;YACjC,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;YAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,oDAAoD;gBACpD,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAS,EAAE,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;YACxC,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAI,IAAY,EAAE,IAAc;YAClD,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;YAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC9C,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;QACtE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAc;YAC5C,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAA;YACpF,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;QACtE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc;YACzC,OAAO,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAClB,IAAgC,CAAC,QAAQ,CAAC,KAAK,MAAM,EACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAA+B,CAAA;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IACzC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAErF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,IAAI,CAAC,cAAc,CAAC,CAAA;IAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA8DzD;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;IACnF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAA;YACrD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,IAAI,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,IAAI,YAAY,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,eAAuB,EAAE,MAAc;IACrE,MAAM,WAAW,GAAG;QAClB,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU,MAAM,EAAE;KACpC,CAAA;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,IAAI,EAAE,CAAA;QACvC,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAClD,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAClD,CAAC;IAED,4HAA4H;IAC5H,KAAK,UAAU,UAAU,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACvE,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE;YACnD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;IACtE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,WAAmB;YACnC,OAAO,OAAO,CAAoB,MAAM,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAoB;YACrC,OAAO,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAqB;YACtC,OAAO,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,KAAK;YACT,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;YACzC,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY;YACvB,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,CAAC,aAAa,CAAI,IAAY;YACjC,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;YAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,oDAAoD;gBACpD,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAS,EAAE,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAA;YACpF,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;gBAC1D,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;YACxC,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAI,IAAY,EAAE,IAAc;YAClD,OAAO,UAAU,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,aAAa,CAAI,IAAY,EAAE,IAAc;YACjD,OAAO,UAAU,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,CAAC,aAAa,CAAI,IAAY;YACjC,OAAO,UAAU,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAc;YAC5C,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAA;YACpF,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;QACtE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc;YACzC,OAAO,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAClB,IAAgC,CAAC,QAAQ,CAAC,KAAK,MAAM,EACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAA+B,CAAA;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IACzC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAErF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,IAAI,CAAC,cAAc,CAAC,CAAA;IAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/lib/ciscoScanner.d.ts

@@ -5,7 +5,7 @@
  * command-pipeline taint analysis, and (with `--use-behavioral`) full
  * AST/dataflow analysis of skill content — genuinely deeper than this
  * codebase's own regex-genre scanning (`packages/shared-types/src/scriptScan.ts`,
- * Phase S2). TD-356 (`docs/TECH_DEBT.md`) named this integration as the
+ * Phase S2). This integration is the
  * follow-up to that phase's deliberately-scoped pattern matching.
  *
  * # Why a shell-out, not a dependency

package/dist/lib/ciscoScanner.js

@@ -5,7 +5,7 @@
  * command-pipeline taint analysis, and (with `--use-behavioral`) full
  * AST/dataflow analysis of skill content — genuinely deeper than this
  * codebase's own regex-genre scanning (`packages/shared-types/src/scriptScan.ts`,
- * Phase S2). TD-356 (`docs/TECH_DEBT.md`) named this integration as the
+ * Phase S2). This integration is the
  * follow-up to that phase's deliberately-scoped pattern matching.
  *
  * # Why a shell-out, not a dependency

package/dist/lib/decisionsLogRefresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsLogRefresh.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4BnG"}
+{"version":3,"file":"decisionsLogRefresh.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA2BnG"}

package/dist/lib/decisionsLogRefresh.js

@@ -13,8 +13,8 @@
  */
 import { loadCredentials } from '../config/store.js';
 import { createApiClient } from './api.js';
-import { refreshDecisionsDigest } from '@intutic/sync-daemon';
-import { HarnessType } from '@intutic/shared-types';
+import { refreshDecisionsDigest, retireClaudeMdDigest } from '@intutic/sync-daemon';
+import { loadConfig } from '../config/store.js';
 /**
  * Checks `WorkspaceSettings.decisionsLogEnabled` before writing anything.
  *
@@ -34,16 +34,15 @@ export async function refreshDecisionsLog(workspaceRoot) {
         if (!settings?.decisionsLogEnabled) {
             return { refreshed: false, reason: 'decisionsLogEnabled is off' };
         }
-        // The claude-code harness is the sole injection target (see
-        // decisionsDigest.ts's own doc comment) — passed unconditionally here
-        // since this one-shot trigger has no live harness-detection cycle to
-        // draw from the way the daemon's sync loop does.
+        // Every harness this machine governs gets the entries where it reads
+        // its instructions, as on the daemon's own cycle.
+        await retireClaudeMdDigest(workspaceRoot);
         const result = await refreshDecisionsDigest({
             controlPlaneUrl: creds.controlPlaneUrl,
             apiKey: creds.apiKey,
             workspaceId: creds.workspaceId,
             workspaceRoot,
-            harnesses: [HarnessType.CLAUDE_CODE],
+            harnesses: (loadConfig()?.harnesses ?? []),
         });
         return result ? { refreshed: true } : { refreshed: false, reason: 'digest fetch failed' };
     }

package/dist/lib/decisionsLogRefresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsLogRefresh.js","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAOnD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEpE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACnC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;QACnE,CAAC;QAED,4DAA4D;QAC5D,sEAAsE;QACtE,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa;YACb,SAAS,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC;SACrC,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"decisionsLogRefresh.js","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAO/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEpE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACnC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;QACnE,CAAC;QAED,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa;YACb,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,IAAI,EAAE,CAAkB;SAC5D,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}

package/dist/lib/deviceReport.d.ts

@@ -23,4 +23,19 @@ export interface ReportDeviceStateOptions {
  * surfacing, this function never throws over it.
  */
 export declare function reportDeviceState(opts?: ReportDeviceStateOptions): Promise<DeviceReportResult>;
+/** How long `intutic disconnect` waits for the control plane before going on without it. */
+export declare const DISCONNECT_REPORT_TIMEOUT_MS = 5000;
+/**
+ * Tells the control plane this machine ran `intutic disconnect`
+ * (`POST /api/v1/devices/disconnect`), so it stops expecting the machine's
+ * gates and does not read the machine going quiet as a fault. Sent before
+ * disconnect removes the credentials, under the fingerprint the device and
+ * the AI inventory report. Never throws, and gives up after
+ * {@link DISCONNECT_REPORT_TIMEOUT_MS}: an unreachable control plane must not
+ * stop a disconnect.
+ */
+export declare function reportDisconnect(opts: {
+    scope: 'machine' | 'harness';
+    harnesses: readonly string[];
+}): Promise<DeviceReportResult>;
 //# sourceMappingURL=deviceReport.d.ts.map

package/dist/lib/deviceReport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deviceReport.d.ts","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxG"}
+{"version":3,"file":"deviceReport.d.ts","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxG;AAED,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,OAAQ,CAAA;AAEjD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,SAAS,GAAG,SAAS,CAAA;IAC5B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAe9B"}

package/dist/lib/deviceReport.js

@@ -13,6 +13,7 @@ import { loadCredentials } from '../config/store.js';
 import { resolveControlPlaneUrl } from '../config/paths.js';
 import { createApiClient } from './api.js';
 import { readEnforcementState } from './enforcementState.js';
+import { inventoryDeviceIdentity } from './inventory.js';
 const { version: cliVersion } = createRequire(import.meta.url)('../../package.json');
 /**
  * Reads `~/.intutic/` credentials and the local enforcement state file, and
@@ -52,4 +53,33 @@ export async function reportDeviceState(opts = {}) {
         return { reported: false, reason: err instanceof Error ? err.message : String(err) };
     }
 }
+/** How long `intutic disconnect` waits for the control plane before going on without it. */
+export const DISCONNECT_REPORT_TIMEOUT_MS = 5_000;
+/**
+ * Tells the control plane this machine ran `intutic disconnect`
+ * (`POST /api/v1/devices/disconnect`), so it stops expecting the machine's
+ * gates and does not read the machine going quiet as a fault. Sent before
+ * disconnect removes the credentials, under the fingerprint the device and
+ * the AI inventory report. Never throws, and gives up after
+ * {@link DISCONNECT_REPORT_TIMEOUT_MS}: an unreachable control plane must not
+ * stop a disconnect.
+ */
+export async function reportDisconnect(opts) {
+    try {
+        const creds = await loadCredentials();
+        if (!creds)
+            return { reported: false, reason: 'not authenticated' };
+        const device = await inventoryDeviceIdentity(cliVersion);
+        const res = await fetch(`${resolveControlPlaneUrl()}/api/v1/devices/disconnect`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${creds.apiKey}` },
+            body: JSON.stringify({ fingerprint: device.fingerprint, hostname: device.hostname, scope: opts.scope, harnesses: opts.harnesses }),
+            signal: AbortSignal.timeout(DISCONNECT_REPORT_TIMEOUT_MS),
+        });
+        return res.ok ? { reported: true } : { reported: false, reason: `the control plane answered ${res.status}` };
+    }
+    catch (err) {
+        return { reported: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
 //# sourceMappingURL=deviceReport.js.map

package/dist/lib/deviceReport.js.map

@@ -1 +1 @@
-{"version":3,"file":"deviceReport.js","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAW3G;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAA;QAEzF,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU;SAC3C,CAAA;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QACnH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAA;QACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,CAAC;AACH,CAAC"}
+{"version":3,"file":"deviceReport.js","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAW3G;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAA;QAEzF,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU;SAC3C,CAAA;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QACnH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAA;QACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAGtC;IACC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,sBAAsB,EAAE,4BAA4B,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAClI,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC;SAC1D,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,CAAC;AACH,CAAC"}

package/dist/lib/envInjector.d.ts

@@ -4,21 +4,31 @@ export interface InjectionResult {
     vars: string[];
     method: string;
 }
+/**
+ * Where the injector reads and writes. Defaults to the real machine; tests
+ * pass temporary paths and a recording `exec` so they never touch it.
+ */
+export interface EnvInjectorTarget {
+    platform?: NodeJS.Platform;
+    /** The user's `~/.bashrc`. */
+    bashrc?: string;
+    /** The system-wide file used on Linux when it is writable. */
+    etcEnvironment?: string;
+    exec?: (command: string) => void;
+}
 export declare class PlatformNotSupportedError extends Error {
     constructor(platform: string);
 }
-export declare class ElevationRequiredError extends Error {
-    constructor(path: string);
-}
 /**
  * Injects ANTHROPIC_BASE_URL and OPENAI_BASE_URL as persistent env vars.
  *
  * @param proxyUrl - The Intutic proxy URL (e.g. https://proxy.acme.intutic.ai)
  * @returns InjectionResult describing what was done
  */
-export declare function injectBaseUrlEnvVars(proxyUrl: string): Promise<InjectionResult>;
+export declare function injectBaseUrlEnvVars(proxyUrl: string, target?: EnvInjectorTarget): Promise<InjectionResult>;
 /**
- * Removes the injected base URL env vars.
+ * Removes the injected base URL env vars: from wherever `injectBaseUrlEnvVars`
+ * can have put them, so a removal is idempotent and complete.
  */
-export declare function removeBaseUrlEnvVars(): Promise<void>;
+export declare function removeBaseUrlEnvVars(target?: EnvInjectorTarget): Promise<void>;
 //# sourceMappingURL=envInjector.d.ts.map

package/dist/lib/envInjector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envInjector.d.ts","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAG,MAAM,CAAC,QAAQ,CAAA;IAC1B,KAAK,EAAM,QAAQ,GAAG,MAAM,CAAA;IAC5B,IAAI,EAAO,MAAM,EAAE,CAAA;IACnB,MAAM,EAAK,MAAM,CAAA;CAClB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,QAAQ,EAAE,MAAM;CAI7B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAsED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCrF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB1D"}
+{"version":3,"file":"envInjector.d.ts","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAG,MAAM,CAAC,QAAQ,CAAA;IAC1B,KAAK,EAAM,QAAQ,GAAG,MAAM,CAAA;IAC5B,IAAI,EAAO,MAAM,EAAE,CAAA;IACnB,MAAM,EAAK,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAWD,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,QAAQ,EAAE,MAAM;CAI7B;AAmED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6BjH;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCpF"}