@intutic/cli 2.1.0 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -38,10 +38,11 @@
     "commander": "^13",
     "ioredis": "^5.11.1",
     "picocolors": "^1",
-    "@intutic/shared-types": "2.1.0",
-    "@intutic/logger": "2.1.0",
-    "@intutic/id": "2.1.0",
-    "@intutic/sync-daemon": "2.1.0"
+    "yaml": "^2.9.0",
+    "@intutic/shared-types": "2.3.0",
+    "@intutic/id": "2.3.0",
+    "@intutic/logger": "2.3.0",
+    "@intutic/sync-daemon": "2.3.0"
   },
   "devDependencies": {
     "typescript": "^5.5",

package/resources/sandbox/Dockerfile

@@ -1,4 +1,4 @@
-# Intutic sandbox base image (LLD #63 §6).
+# Intutic sandbox base image.
 #
 # A minimal, genuinely-isolating runtime for `intutic exec --sandbox`. It ships
 # only what the entrypoint needs to install the egress firewall and drop

package/resources/sandbox/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Intutic sandbox entrypoint (LLD #63 §6).
+# Intutic sandbox entrypoint.
 #
 # The container starts as root with NET_ADMIN so this script can install a
 # firewall; the agent must NOT keep that power. So, in order:
@@ -12,7 +12,7 @@
 #      the agent cannot alter or remove the firewall it now runs behind.
 #   4. exec the agent command.
 #
-# Honesty rule (LLD #63 §6): if the firewall cannot be applied, we refuse to run
+# Honesty rule: if the firewall cannot be applied, we refuse to run
 # rather than run ungoverned. A sandbox that silently fails open is worse than
 # no sandbox, because the caller believes it is protected.
 set -eu
@@ -79,8 +79,8 @@ fi
 # firewall above is therefore immutable from inside the sandbox.
 #
 # Attest, then exec — in that order, inside the SAME post-drop shell, so the
-# attestation call itself only has the locked-down firewall to route through
-# (LLD #63 §6, TD-333). Before this, `executionMode: 'SANDBOX'` on a session
+# attestation call itself only has the locked-down firewall to route through.
+# Before this, `executionMode: 'SANDBOX'` on a session
 # was set entirely by the host-side `intutic exec` CLI, before this container
 # even started — a claim with nothing behind it. This callback can only
 # succeed from a process that got this far: firewall installed, capabilities

package/resources/sandbox/firecracker-launch.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Firecracker microVM launch (LLD #63 §6, Increment 4).
+# Firecracker microVM launch.
 #
 # This is the boot sequence validated on a real KVM host (GCE nested-virt,
 # Intel): it sets up the tap link, installs a host-side default-deny egress

package/dist/harness/base.d.ts

@@ -1,20 +0,0 @@
-/**
- * Base adapter — shared logic for file-write harnesses.
- *
- * Cursor, Claude Code, Windsurf, and Aider all follow the same
- * pattern: detect by file existence, write markdown/text, hash file.
- *
- * LLD #8 — Sync Daemon / CLI
- * @module
- */
-import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
-import type { IHarnessAdapter } from './types.js';
-/** Build markdown content from SOPs (Cursor, Claude Code, Windsurf). */
-export declare function buildMarkdownContent(sops: SyncSopEntry[], proxyUrl: string): string;
-/**
- * Create a file-based harness adapter for markdown-style config files.
- *
- * Used by: Cursor (.cursorrules), Claude Code (CLAUDE.md), Windsurf (.windsurfrules)
- */
-export declare function createMarkdownAdapter(type: HarnessType, configFileName: string): IHarnessAdapter;
-//# sourceMappingURL=base.d.ts.map

package/dist/harness/base.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAejD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,GACrB,eAAe,CAiCjB"}

package/dist/harness/base.js

@@ -1,73 +0,0 @@
-/**
- * Base adapter — shared logic for file-write harnesses.
- *
- * Cursor, Claude Code, Windsurf, and Aider all follow the same
- * pattern: detect by file existence, write markdown/text, hash file.
- *
- * LLD #8 — Sync Daemon / CLI
- * @module
- */
-import { join } from 'node:path';
-import { access, writeFile, rename, mkdir } from 'node:fs/promises';
-import { dirname } from 'node:path';
-import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
-/** Header prepended to all governance config files. */
-function buildHeader() {
-    return [
-        '# Intutic Governance Rules (auto-generated)',
-        '# DO NOT EDIT — managed by intutic sync daemon',
-        `# Last sync: ${newIso()}`,
-        '',
-        '',
-    ].join('\n');
-}
-/** Build markdown content from SOPs (Cursor, Claude Code, Windsurf). */
-export function buildMarkdownContent(sops, proxyUrl) {
-    const header = buildHeader();
-    const proxySection = `> **Proxy URL:** \`${proxyUrl}\`\n\n`;
-    const sopSections = sops
-        .map((sop) => `## ${sop.title}\n\n${sop.content}`)
-        .join('\n\n---\n\n');
-    return header + proxySection + sopSections + '\n';
-}
-/**
- * Create a file-based harness adapter for markdown-style config files.
- *
- * Used by: Cursor (.cursorrules), Claude Code (CLAUDE.md), Windsurf (.windsurfrules)
- */
-export function createMarkdownAdapter(type, configFileName) {
-    return {
-        type,
-        configFileName,
-        async detect(workspaceRoot) {
-            try {
-                await access(join(workspaceRoot, configFileName));
-                return true;
-            }
-            catch {
-                return false;
-            }
-        },
-        async writeConfig(workspaceRoot, sops, proxyUrl) {
-            if (sops.length === 0)
-                return null;
-            const filePath = join(workspaceRoot, configFileName);
-            const tmpPath = filePath + '.intutic-tmp';
-            const content = buildMarkdownContent(sops, proxyUrl);
-            await mkdir(dirname(filePath), { recursive: true });
-            await writeFile(tmpPath, content, 'utf-8');
-            await rename(tmpPath, filePath);
-            return filePath;
-        },
-        async readCurrentHash(workspaceRoot) {
-            try {
-                return await hashFile(join(workspaceRoot, configFileName));
-            }
-            catch {
-                return null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=base.js.map

package/dist/harness/base.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,uDAAuD;AACvD,SAAS,WAAW;IAClB,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,QAAQ,QAAQ,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI;SACrB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;SACjD,IAAI,CAAC,aAAa,CAAC,CAAA;IACtB,OAAO,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,IAAI,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAiB,EACjB,cAAsB;IAEtB,OAAO;QACL,IAAI;QACJ,cAAc;QAEd,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;YACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC/B,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}