@intutic/cli 2.2.0 → 2.3.0

package/dist/lib/policySnapshot.js

@@ -18,8 +18,9 @@
  *              wait" would be a supported way to disarm governance.
  *   empty    — parsed, but no rules. The writer always ships the destructive
  *              tier, so zero rules means the compile produced nothing.
- *   invalid  — digest or workspace mismatch. The gates drop the dynamic tier,
- *              keeping only its SSO-group refusals.
+ *   invalid  — digest missing or mismatched, or another workspace's. The
+ *              gates drop the dynamic tier, keeping only its SSO-group
+ *              refusals, and refuse every MCP call.
  *   absent   — no file. The compiled floor still applies; nothing else does.
  *
  * Kept deliberately faithful rather than improved: a reader that disagrees with
@@ -121,7 +122,9 @@ export function parsePolicySnapshot(text, opts = {}) {
     // machine, with B's audit events attributing A's policy to B.
     const body = lines.filter((l) => l && l.charAt(0) !== '#').join('\n');
     const actual = createHash('sha256').update(body).digest('hex').slice(0, 32);
-    if (out.digest !== 'none' && actual !== out.digest)
+    // No digest line fails too, as it does in every gate: the daemon always
+    // writes one.
+    if (actual !== out.digest)
         out.state = 'invalid';
     if (out.state === 'ok' &&
         out.workspaceId &&

package/dist/lib/policySnapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"policySnapshot.js","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAsB1D;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAA;IACpD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAoE,EAAE;IAEtE,MAAM,GAAG,GAAyB;QAChC,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,wBAAwB,EAAE;KAC9C,CAAA;IAED,sEAAsE;IACtE,mCAAmC;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QACnC,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,uEAAuE;YACvE,sCAAsC;YACtC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,SAAS,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO;YAAE,gBAAgB,IAAI,CAAC,CAAA;IAC/E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAA;IAEzE,IACE,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,WAAW;QACf,IAAI,CAAC,mBAAmB;QACxB,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,mBAAmB,EAC5C,CAAC;QACD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAA;IACvB,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAA;IAElE,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E,mBAAmB;IACnB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,gBAAgB,CAAA;IAE7D,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ;YACR,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;YAChF,IAAI,GAAG,CAAC,OAAO,GAAG,yBAAyB;gBAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAA;QAClE,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAA;IACvC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,CAAC;YACf,IAAI;SACL,CAAA;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}
+{"version":3,"file":"policySnapshot.js","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAsB1D;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAA;IACpD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAoE,EAAE;IAEtE,MAAM,GAAG,GAAyB;QAChC,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,wBAAwB,EAAE;KAC9C,CAAA;IAED,sEAAsE;IACtE,mCAAmC;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QACnC,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,uEAAuE;YACvE,sCAAsC;YACtC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,SAAS,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO;YAAE,gBAAgB,IAAI,CAAC,CAAA;IAC/E,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,wEAAwE;IACxE,cAAc;IACd,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAA;IAEhD,IACE,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,WAAW;QACf,IAAI,CAAC,mBAAmB;QACxB,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,mBAAmB,EAC5C,CAAC;QACD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAA;IACvB,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAA;IAElE,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E,mBAAmB;IACnB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,gBAAgB,CAAA;IAE7D,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ;YACR,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;YAChF,IAAI,GAAG,CAAC,OAAO,GAAG,yBAAyB;gBAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAA;QAClE,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAA;IACvC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,CAAC;YACf,IAAI;SACL,CAAA;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}

package/dist/lib/process.d.ts

@@ -4,7 +4,6 @@
  * Uses native platform commands (`ps` on macOS/Linux, `tasklist` on Windows)
  * to find running agent processes. No external dependencies.
  *
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 /** A detected running agent process. */
@@ -41,6 +40,11 @@ export declare function parseProcessOutput(output: string, platform: string): Ar
  * @returns Array of detected active processes
  */
 export declare function getActiveAgentProcesses(): ActiveProcess[];
+/** The agents in a process list, by signature: the first matching PID per agent. */
+export declare function matchAgentProcesses(rawProcesses: ReadonlyArray<{
+    pid: number;
+    command: string;
+}>): ActiveProcess[];
 /**
  * Check if the Intutic sync daemon is currently running.
  *

package/dist/lib/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/lib/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAA;CAChB;AAkID;;;;GAIG;AACH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B5G;AAiBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,EAAE,CAuBzD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAY7C"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/lib/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAA;CAChB;AAyID;;;;GAIG;AACH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B5G;AAiBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,EAAE,CAEzD;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAsBlH;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAY7C"}

package/dist/lib/process.js

@@ -4,7 +4,6 @@
  * Uses native platform commands (`ps` on macOS/Linux, `tasklist` on Windows)
  * to find running agent processes. No external dependencies.
  *
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import { execSync } from 'node:child_process';
@@ -70,6 +69,13 @@ const PROCESS_SIGNATURES = [
         name: 'Antigravity',
         patterns: [/\bantigravity\b/i],
     },
+    {
+        name: 'Gemini CLI',
+        // Anchored on the invoked command name like `grok`: `gemini` is a common
+        // word in arguments and paths. Also the npm package, which a node process
+        // running the CLI shows before the resolved binary name does.
+        patterns: [/(^|[/\\\s])gemini(\s|$)/, /@google\/gemini-cli\b/],
+    },
     {
         name: 'Muse Code',
         // See services/sync-daemon/src/lib/processPoller.ts's copy of this table
@@ -113,8 +119,8 @@ const PROCESS_SIGNATURES = [
         // path the same way Cursor.app/Claude.app/Windsurf.app are above, not
         // the bare-word CLI pattern grok/muse needed. NOT independently
         // verified against a real Xirp install (macOS-only beta, no public
-        // download available in this environment — see xirp.ts's module doc and
-        // TD-390). See services/sync-daemon/src/lib/processPoller.ts's
+        // download available in this environment — see xirp.ts's module doc).
+        // See services/sync-daemon/src/lib/processPoller.ts's
         // `detectTmuxParentedAgents` for a SEPARATE, weaker, probabilistic
         // signal (a tmux-parented claude/codex/gemini process) this flat
         // process-list scan has no parent-PID data to produce on its own.
@@ -195,7 +201,10 @@ function getRawProcessList() {
  * @returns Array of detected active processes
  */
 export function getActiveAgentProcesses() {
-    const rawProcesses = getRawProcessList();
+    return matchAgentProcesses(getRawProcessList());
+}
+/** The agents in a process list, by signature: the first matching PID per agent. */
+export function matchAgentProcesses(rawProcesses) {
     const seen = new Set();
     const results = [];
     for (const proc of rawProcesses) {

package/dist/lib/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/lib/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAY7C;;;;GAIG;AACH,MAAM,kBAAkB,GAInB;IACH;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,kBAAkB,EAAE,oCAAoC,CAAC;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,6BAA6B,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,8BAA8B,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;KAChD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC,mEAAmE,CAAC;KAChF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,kBAAkB,CAAC;KAC/B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,qCAAqC;QACrC,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,qEAAqE;QACrE,iEAAiE;QACjE,qCAAqC;QACrC,QAAQ,EAAE,CAAC,uBAAuB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,QAAQ,EAAE,CAAC,6BAA6B,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,KAAK;QACX,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,qEAAqE;QACrE,mEAAmE;QACnE,QAAQ,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,MAAM;QACZ,uEAAuE;QACvE,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,yEAAyE;QACzE,+DAA+D;QAC/D,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,0DAA0D;QAC1D,QAAQ,EAAE,CAAC,2BAA2B,CAAC;KACxC;CACF,CAAA;AAED;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IACjE,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACzE,MAAM,OAAO,GAA4C,EAAE,CAAA;IAE3D,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,SAAQ;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;YAChD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS;YACtB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAExE,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAoB,EAAE,CAAA;IAEnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAClB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,uBAAuB;qBAC7D,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAA;IAC9B,MAAM,WAAW,GAAG,6CAA6C,CAAA;IAEjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU;YAAE,SAAQ;QACrC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/lib/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAY7C;;;;GAIG;AACH,MAAM,kBAAkB,GAInB;IACH;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,kBAAkB,EAAE,oCAAoC,CAAC;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,6BAA6B,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,8BAA8B,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;KAChD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC,mEAAmE,CAAC;KAChF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,kBAAkB,CAAC;KAC/B;IACD;QACE,IAAI,EAAE,YAAY;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,8DAA8D;QAC9D,QAAQ,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;KAC/D;IACD;QACE,IAAI,EAAE,WAAW;QACjB,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,qCAAqC;QACrC,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,qEAAqE;QACrE,iEAAiE;QACjE,qCAAqC;QACrC,QAAQ,EAAE,CAAC,uBAAuB,CAAC;KACpC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,QAAQ,EAAE,CAAC,6BAA6B,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,KAAK;QACX,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,qEAAqE;QACrE,mEAAmE;QACnE,QAAQ,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,MAAM;QACZ,uEAAuE;QACvE,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,sEAAsE;QACtE,sDAAsD;QACtD,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,yEAAyE;QACzE,+DAA+D;QAC/D,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,0DAA0D;QAC1D,QAAQ,EAAE,CAAC,2BAA2B,CAAC;KACxC;CACF,CAAA;AAED;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IACjE,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACzE,MAAM,OAAO,GAA4C,EAAE,CAAA;IAE3D,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,SAAQ;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;YAChD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS;YACtB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAExE,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,mBAAmB,CAAC,iBAAiB,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,YAA6D;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAoB,EAAE,CAAA;IAEnC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAClB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,uBAAuB;qBAC7D,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAA;IAC9B,MAAM,WAAW,GAAG,6CAA6C,CAAA;IAEjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU;YAAE,SAAQ;QACrC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/lib/providerProbe.d.ts

@@ -1,6 +1,6 @@
 /**
- * CLI-side provider credential verification (LLD #70, model catalog &
- * cohort wizard).
+ * CLI-side provider credential verification (model catalog & cohort
+ * wizard).
  *
  * `buildVerificationProbe`/`classifyProbeResponse` in `@intutic/shared-types`
  * describe WHAT request proves a credential works; this is the CLI's

package/dist/lib/providerProbe.js

@@ -1,6 +1,6 @@
 /**
- * CLI-side provider credential verification (LLD #70, model catalog &
- * cohort wizard).
+ * CLI-side provider credential verification (model catalog & cohort
+ * wizard).
  *
  * `buildVerificationProbe`/`classifyProbeResponse` in `@intutic/shared-types`
  * describe WHAT request proves a credential works; this is the CLI's

package/dist/lib/sandbox/firecracker.d.ts

@@ -1,6 +1,6 @@
 /**
- * FirecrackerBackend — VM-grade isolation via a Firecracker microVM (LLD #63 §6,
- * Increment 4). Same `SandboxBackend` interface as the container backend; the
+ * FirecrackerBackend — VM-grade isolation via a Firecracker microVM.
+ * Same `SandboxBackend` interface as the container backend; the
  * difference is the boundary: a separate guest kernel over KVM rather than
  * shared-kernel namespaces.
  *
@@ -10,7 +10,7 @@
  * source address). That keeps the enforcement outside the guest, where the
  * agent cannot touch it, which is stronger than the in-container firewall.
  *
- * Honesty status (see LLD #63 §7 + TECH_DEBT): the microVM *boots on real KVM*
+ * Honesty status: the microVM *boots on real KVM*
  * — validated on a GCE nested-virt host, where Firecracker loaded and ran the
  * guest kernel through this exact config + API sequence (the launch script this
  * backend invokes). What is NOT yet validated end-to-end is an agent running to

package/dist/lib/sandbox/firecracker.js

@@ -1,6 +1,6 @@
 /**
- * FirecrackerBackend — VM-grade isolation via a Firecracker microVM (LLD #63 §6,
- * Increment 4). Same `SandboxBackend` interface as the container backend; the
+ * FirecrackerBackend — VM-grade isolation via a Firecracker microVM.
+ * Same `SandboxBackend` interface as the container backend; the
  * difference is the boundary: a separate guest kernel over KVM rather than
  * shared-kernel namespaces.
  *
@@ -10,7 +10,7 @@
  * source address). That keeps the enforcement outside the guest, where the
  * agent cannot touch it, which is stronger than the in-container firewall.
  *
- * Honesty status (see LLD #63 §7 + TECH_DEBT): the microVM *boots on real KVM*
+ * Honesty status: the microVM *boots on real KVM*
  * — validated on a GCE nested-virt host, where Firecracker loaded and ran the
  * guest kernel through this exact config + API sequence (the launch script this
  * backend invokes). What is NOT yet validated end-to-end is an agent running to

package/dist/lib/sandbox/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Sandbox backend selection (LLD #63 §6).
+ * Sandbox backend selection.
  *
  * Picks the requested backend, or the best available one. The honesty rule:
  * a backend whose `health()` is false is never silently swapped for a weaker
@@ -28,7 +28,7 @@ export declare function firecrackerOptionsFromEnv(env?: NodeJS.ProcessEnv): Fire
 /**
  * Select a backend by kind. Both backends gate on their own `health()`; the
  * caller refuses when a backend is unavailable rather than downgrading to a
- * weaker one (the honesty rule, LLD #63 §6).
+ * weaker one (the honesty rule).
  */
 export declare function selectBackend(kind: SandboxKind, env: Record<string, string>, runtime?: OciRuntime): SandboxBackend;
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/sandbox/index.js

@@ -1,5 +1,5 @@
 /**
- * Sandbox backend selection (LLD #63 §6).
+ * Sandbox backend selection.
  *
  * Picks the requested backend, or the best available one. The honesty rule:
  * a backend whose `health()` is false is never silently swapped for a weaker
@@ -39,7 +39,7 @@ export function firecrackerOptionsFromEnv(env = process.env) {
 /**
  * Select a backend by kind. Both backends gate on their own `health()`; the
  * caller refuses when a backend is unavailable rather than downgrading to a
- * weaker one (the honesty rule, LLD #63 §6).
+ * weaker one (the honesty rule).
  */
 export function selectBackend(kind, env, runtime) {
     switch (kind) {

package/dist/lib/sandbox/oci.d.ts

@@ -1,5 +1,5 @@
 /**
- * OciBackend — a genuinely-isolating container sandbox (LLD #63 §6).
+ * OciBackend — a genuinely-isolating container sandbox.
  *
  * The isolation envelope, and why each piece is here:
  *   --cap-drop=ALL                 start from zero capabilities

package/dist/lib/sandbox/oci.js

@@ -1,5 +1,5 @@
 /**
- * OciBackend — a genuinely-isolating container sandbox (LLD #63 §6).
+ * OciBackend — a genuinely-isolating container sandbox.
  *
  * The isolation envelope, and why each piece is here:
  *   --cap-drop=ALL                 start from zero capabilities

package/dist/lib/sandbox/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Sandbox runtime abstraction (LLD #63 §6).
+ * Sandbox runtime abstraction.
  *
  * A `SandboxBackend` launches an agent command inside an isolated runtime whose
  * *only* egress is the governing proxy — unifying "isolate the process" with

package/dist/lib/sandbox/types.js

@@ -1,5 +1,5 @@
 /**
- * Sandbox runtime abstraction (LLD #63 §6).
+ * Sandbox runtime abstraction.
  *
  * A `SandboxBackend` launches an agent command inside an isolated runtime whose
  * *only* egress is the governing proxy — unifying "isolate the process" with

package/dist/lib/sopFrontMatter.d.ts

@@ -36,7 +36,7 @@ export declare function titleFromFileName(fileName: string): string;
 /**
  * Add `intutic sops pull`'s `content_hash:` marker to a file that already
  * carries its own front matter — a projected guardrail, whose fence holds
- * the enforcing keys the proxy reads (LLD #71, Wave 9).
+ * the enforcing keys the proxy reads.
  *
  * Not `renderSopFile`: that wraps a second fence around the text, and the
  * proxy reads only the first, so the enforcing keys would become body prose

package/dist/lib/sopFrontMatter.js

@@ -101,7 +101,7 @@ export function titleFromFileName(fileName) {
 /**
  * Add `intutic sops pull`'s `content_hash:` marker to a file that already
  * carries its own front matter — a projected guardrail, whose fence holds
- * the enforcing keys the proxy reads (LLD #71, Wave 9).
+ * the enforcing keys the proxy reads.
  *
  * Not `renderSopFile`: that wraps a second fence around the text, and the
  * proxy reads only the first, so the enforcing keys would become body prose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -38,10 +38,11 @@
     "commander": "^13",
     "ioredis": "^5.11.1",
     "picocolors": "^1",
-    "@intutic/id": "2.2.0",
-    "@intutic/logger": "2.2.0",
-    "@intutic/sync-daemon": "2.2.0",
-    "@intutic/shared-types": "2.2.0"
+    "yaml": "^2.9.0",
+    "@intutic/shared-types": "2.3.0",
+    "@intutic/id": "2.3.0",
+    "@intutic/logger": "2.3.0",
+    "@intutic/sync-daemon": "2.3.0"
   },
   "devDependencies": {
     "typescript": "^5.5",

package/resources/sandbox/Dockerfile

@@ -1,4 +1,4 @@
-# Intutic sandbox base image (LLD #63 §6).
+# Intutic sandbox base image.
 #
 # A minimal, genuinely-isolating runtime for `intutic exec --sandbox`. It ships
 # only what the entrypoint needs to install the egress firewall and drop

package/resources/sandbox/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Intutic sandbox entrypoint (LLD #63 §6).
+# Intutic sandbox entrypoint.
 #
 # The container starts as root with NET_ADMIN so this script can install a
 # firewall; the agent must NOT keep that power. So, in order:
@@ -12,7 +12,7 @@
 #      the agent cannot alter or remove the firewall it now runs behind.
 #   4. exec the agent command.
 #
-# Honesty rule (LLD #63 §6): if the firewall cannot be applied, we refuse to run
+# Honesty rule: if the firewall cannot be applied, we refuse to run
 # rather than run ungoverned. A sandbox that silently fails open is worse than
 # no sandbox, because the caller believes it is protected.
 set -eu
@@ -79,8 +79,8 @@ fi
 # firewall above is therefore immutable from inside the sandbox.
 #
 # Attest, then exec — in that order, inside the SAME post-drop shell, so the
-# attestation call itself only has the locked-down firewall to route through
-# (LLD #63 §6, TD-333). Before this, `executionMode: 'SANDBOX'` on a session
+# attestation call itself only has the locked-down firewall to route through.
+# Before this, `executionMode: 'SANDBOX'` on a session
 # was set entirely by the host-side `intutic exec` CLI, before this container
 # even started — a claim with nothing behind it. This callback can only
 # succeed from a process that got this far: firewall installed, capabilities

package/resources/sandbox/firecracker-launch.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Firecracker microVM launch (LLD #63 §6, Increment 4).
+# Firecracker microVM launch.
 #
 # This is the boot sequence validated on a real KVM host (GCE nested-virt,
 # Intel): it sets up the tap link, installs a host-side default-deny egress

package/dist/harness/base.d.ts

@@ -1,24 +0,0 @@
-/**
- * Base adapter — shared logic for file-write harnesses.
- *
- * Cursor, Claude Code, Windsurf, and Aider all follow the same
- * pattern: detect by file existence, write markdown/text, hash file.
- *
- * LLD #8 — Sync Daemon / CLI
- * @module
- */
-import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
-import type { IHarnessAdapter } from './types.js';
-/**
- * Build markdown content from SOPs (Cursor, Claude Code, Windsurf). Each SOP
- * the control plane synced ends with its `sop://` pointer comment, which maps
- * the rules in the file back to the SOP that produced them.
- */
-export declare function buildMarkdownContent(sops: SyncSopEntry[], proxyUrl: string): string;
-/**
- * Create a file-based harness adapter for markdown-style config files.
- *
- * Used by: Cursor (.cursorrules), Claude Code (CLAUDE.md), Windsurf (.windsurfrules)
- */
-export declare function createMarkdownAdapter(type: HarnessType, configFileName: string): IHarnessAdapter;
-//# sourceMappingURL=base.d.ts.map

package/dist/harness/base.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAgBjD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,GACrB,eAAe,CA8BjB"}

package/dist/harness/base.js

@@ -1,74 +0,0 @@
-/**
- * Base adapter — shared logic for file-write harnesses.
- *
- * Cursor, Claude Code, Windsurf, and Aider all follow the same
- * pattern: detect by file existence, write markdown/text, hash file.
- *
- * LLD #8 — Sync Daemon / CLI
- * @module
- */
-import { join } from 'node:path';
-import { access } from 'node:fs/promises';
-import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
-import { writeOwnedFile } from '@intutic/sync-daemon';
-/** Header prepended to all governance config files. */
-function buildHeader() {
-    return [
-        '# Intutic Governance Rules (auto-generated)',
-        '# DO NOT EDIT — managed by intutic sync daemon',
-        `# Last sync: ${newIso()}`,
-        '',
-        '',
-    ].join('\n');
-}
-/**
- * Build markdown content from SOPs (Cursor, Claude Code, Windsurf). Each SOP
- * the control plane synced ends with its `sop://` pointer comment, which maps
- * the rules in the file back to the SOP that produced them.
- */
-export function buildMarkdownContent(sops, proxyUrl) {
-    const header = buildHeader();
-    const proxySection = `> **Proxy URL:** \`${proxyUrl}\`\n\n`;
-    const sopSections = sops
-        .map((sop) => `## ${sop.title}\n\n${sop.content}${sop.sopRef ? `\n${sop.sopRef}` : ''}`)
-        .join('\n\n---\n\n');
-    return header + proxySection + sopSections + '\n';
-}
-/**
- * Create a file-based harness adapter for markdown-style config files.
- *
- * Used by: Cursor (.cursorrules), Claude Code (CLAUDE.md), Windsurf (.windsurfrules)
- */
-export function createMarkdownAdapter(type, configFileName) {
-    return {
-        type,
-        configFileName,
-        async detect(workspaceRoot) {
-            try {
-                await access(join(workspaceRoot, configFileName));
-                return true;
-            }
-            catch {
-                return false;
-            }
-        },
-        async writeConfig(workspaceRoot, sops, proxyUrl) {
-            if (sops.length === 0)
-                return null;
-            const filePath = join(workspaceRoot, configFileName);
-            const content = buildMarkdownContent(sops, proxyUrl);
-            await writeOwnedFile(filePath, workspaceRoot, content);
-            return filePath;
-        },
-        async readCurrentHash(workspaceRoot) {
-            try {
-                return await hashFile(join(workspaceRoot, configFileName));
-            }
-            catch {
-                return null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=base.js.map

package/dist/harness/base.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,uDAAuD;AACvD,SAAS,WAAW;IAClB,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,QAAQ,QAAQ,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI;SACrB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACvF,IAAI,CAAC,aAAa,CAAC,CAAA;IACtB,OAAO,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,IAAI,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAiB,EACjB,cAAsB;IAEtB,OAAO;QACL,IAAI;QACJ,cAAc;QAEd,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;YACtD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}