@intutic/cli 2.4.0 → 2.5.1

package/dist/harness/openhands.js.map

@@ -1 +1 @@
-{"version":3,"file":"openhands.js","sourceRoot":"","sources":["../../src/harness/openhands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,WAAW,GAAG,aAAa,CAAA;AACjC,MAAM,UAAU,GAAG,8CAA8C,CAAA;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,UAAU;IAE1B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,wCAAwC;IACxC,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACnD,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAChD,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,qCAAqC,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;YAC3C,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACjC,OAAO,GAAG,UAAU,CAAA;QACtB,CAAC;QAED,OAAO,CAAC,MAAM,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"openhands.js","sourceRoot":"","sources":["../../src/harness/openhands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,WAAW,GAAG,aAAa,CAAA;AACjC,MAAM,UAAU,GAAG,8CAA8C,CAAA;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,UAAU;IAE1B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,wCAAwC;IACxC,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACnD,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAChD,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,qCAAqC,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;YAClE,OAAO,GAAG,UAAU,CAAA;QACtB,CAAC;QAED,OAAO,CAAC,MAAM,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/windsurf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,eAAe,EAAE,eA4B7B,CAAA"}
+{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAUjD,eAAO,MAAM,eAAe,EAAE,eA6B7B,CAAA"}

package/dist/harness/windsurf.js

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { HarnessType, rulesFrontMatterOf } from '@intutic/shared-types';
 import { loadCredentials } from '../config/store.js';
+import { localProxyPort } from '../lib/localProxy.js';
 import { writeWindsurfHooks } from '@intutic/sync-daemon/harness/windsurfHooks';
 import { ownRulesFileHash, retireLegacyRulesFile, writeOwnRulesFile } from './rulesFiles.js';
 const CONFIG_FILE = '.windsurf/rules/intutic-governance.md';
@@ -47,9 +48,10 @@ export const windsurfAdapter = {
     },
     /** Cascade hooks.json at user + workspace level, and the TLS MITM proxy.
      *  The proxy serves HTTP CONNECT on the same listener as its API, so the
-     *  port is the one `intutic connect` runs it on (PORT, 4000 by default). */
+     *  port is the one `intutic connect` and `start` run it on: the port of
+     *  INTUTIC_PROXY_URL, 4000 by default. `PORT` is not read. */
     async installGate(workspaceRoot, proxyUrl) {
-        const proxyPort = parseInt(process.env.PORT || '4000', 10);
+        const proxyPort = localProxyPort();
         const creds = await loadCredentials();
         await writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort, creds?.workspaceId || 'local');
     },

package/dist/harness/windsurf.js.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE5F,MAAM,WAAW,GAAG,uCAAuC,CAAA;AAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED;;gFAE4E;IAC5E,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC5I,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;CACF,CAAA"}
+{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE5F,MAAM,WAAW,GAAG,uCAAuC,CAAA;AAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED;;;kEAG8D;IAC9D,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC5I,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;CACF,CAAA"}

package/dist/lib/api.d.ts

@@ -26,9 +26,13 @@ export interface ApiClient {
     login(email: string, password: string): Promise<{
         accessToken: string;
         refreshToken: string;
-        workspaceId: string;
-        email: string;
-        memberId: string;
+        expiresIn: number;
+        member: {
+            memberId: string;
+            workspaceId: string;
+            email: string;
+            role: string;
+        };
     }>;
     /** Generic GET request for arbitrary API paths. */
     get<T>(path: string): Promise<T>;

package/dist/lib/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpJ,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;OAIG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpF,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAU5F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CA2IlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;IACjM,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;OAIG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpF,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAU5F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CA2IlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}

package/dist/lib/caTrust.d.ts

@@ -4,7 +4,9 @@
  * Two trust scopes:
  * - `'user'` — per-user, non-elevated. Already shipping today via
  *   `commands/connect.ts` (macOS login keychain, Windows `certutil`), run
- *   silently on every `intutic connect`.
+ *   silently on every `intutic connect`. Linux has no per-user store its TLS
+ *   clients share, so connect uses `ensureLinuxCaTrust` instead: the system
+ *   store when it runs as root, otherwise the exact commands to run.
  * - `'system'` — machine-wide, requires root/admin. New here — this is the
  *   half `enterprise install` (`commands/enterprise.ts`) needs and the
  *   deleted `enterprise-install.ts` (commit `8481b5d9`) used to provide.
@@ -31,6 +33,11 @@ export interface CaTrustResult {
     mechanism: string;
     detail: string;
 }
+/**
+ * Every path this module installs the CA to on Linux — `enterprise install`'s
+ * copy and `intutic connect`'s — so `doctor` checks the same files it writes.
+ */
+export declare const LINUX_CA_TRUST_PATHS: readonly string[];
 /**
  * The command(s) that trust `caCertPath` at the given scope, for the given
  * platform. Pure — no I/O — so it doubles as the source of truth for
@@ -45,6 +52,41 @@ export interface CaTrustResult {
  * `execFile` can't run a shell pipeline — callers must run both in order.
  */
 export declare function caTrustCommandFor(platform: NodeJS.Platform, scope: TrustScope, caCertPath: string): CaTrustCommand[] | null;
+/**
+ * The shell lines that trust `caCertPath` in the Linux system store the way
+ * connect does (connect's own file name), for a user to run. Pure. Each needs
+ * root, so each is prefixed with `sudo`.
+ */
+export declare function linuxSystemTrustShellCommands(tool: 'update-ca-certificates' | 'update-ca-trust', caCertPath: string): string[];
+/** The CA connect installed in the Linux system store, and how to take it out. */
+export interface LinuxConnectCaRemoval {
+    /** connect's copy of the CA. */
+    dest: string;
+    /** Rebuilds the bundle without it. */
+    update: CaTrustCommand;
+    /** The same, as shell lines for a user without root. */
+    commands: string[];
+}
+/** connect's copy of the CA in the Linux system store, or null when there is none. */
+export declare function linuxConnectCaRemoval(): Promise<LinuxConnectCaRemoval | null>;
+/** Removes connect's copy of the CA and rebuilds the bundle. Needs root. */
+export declare function removeLinuxConnectCaTrust(removal: LinuxConnectCaRemoval): Promise<void>;
+export interface LinuxCaTrustOutcome {
+    /**
+     * `trusted`: already in the system store. `installed`: put there now (as
+     * root). `needs-root`: the user must run `commands`. `unsupported`: no
+     * trust tool on this machine. `failed`: installing as root failed.
+     */
+    state: 'trusted' | 'installed' | 'needs-root' | 'unsupported' | 'failed';
+    detail: string;
+    commands?: string[];
+}
+/**
+ * `intutic connect`'s Linux CA trust. Linux has no per-user trust store that
+ * the system's TLS clients read, and the system store needs root, so: as root
+ * the CA is installed; otherwise connect prints the exact commands to run.
+ */
+export declare function ensureLinuxCaTrust(caCertPath: string, isRoot?: boolean): Promise<LinuxCaTrustOutcome>;
 /**
  * Installs `caCertPath` into the OS trust store at `scope`.
  *

package/dist/lib/caTrust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caTrust.d.ts","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAE1C,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,GACjB,cAAc,EAAE,GAAG,IAAI,CA8BzB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BlG;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBxE"}
+{"version":3,"file":"caTrust.d.ts","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAE1C,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAkBD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAKjD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,GACjB,cAAc,EAAE,GAAG,IAAI,CA8BzB;AAuCD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,wBAAwB,GAAG,iBAAiB,EAClD,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAIV;AAED,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,sCAAsC;IACtC,MAAM,EAAE,cAAc,CAAA;IACtB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAcnF;AAED,4EAA4E;AAC5E,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7F;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAA;IACxE,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,OAAkC,GACzC,OAAO,CAAC,mBAAmB,CAAC,CA0B9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BlG;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBxE"}

package/dist/lib/caTrust.js

@@ -4,7 +4,9 @@
  * Two trust scopes:
  * - `'user'` — per-user, non-elevated. Already shipping today via
  *   `commands/connect.ts` (macOS login keychain, Windows `certutil`), run
- *   silently on every `intutic connect`.
+ *   silently on every `intutic connect`. Linux has no per-user store its TLS
+ *   clients share, so connect uses `ensureLinuxCaTrust` instead: the system
+ *   store when it runs as root, otherwise the exact commands to run.
  * - `'system'` — machine-wide, requires root/admin. New here — this is the
  *   half `enterprise install` (`commands/enterprise.ts`) needs and the
  *   deleted `enterprise-install.ts` (commit `8481b5d9`) used to provide.
@@ -19,10 +21,30 @@
  */
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { copyFile, readFile } from 'node:fs/promises';
+import { access, copyFile, readFile, unlink } from 'node:fs/promises';
 const execFileAsync = promisify(execFile);
 const LINUX_DEBIAN_DEST = '/usr/local/share/ca-certificates/intutic-ca.crt';
 const LINUX_RHEL_DEST = '/etc/pki/ca-trust/source/anchors/intutic-ca.crt';
+/**
+ * Where `intutic connect` puts the CA on Linux: beside the machine-wide copy
+ * `enterprise install` writes, not on top of it, so `intutic disconnect` can
+ * tell connect's copy from the administrator's and remove only its own — the
+ * same split as the login and System keychains on macOS.
+ */
+const LINUX_CONNECT_DEBIAN_DEST = '/usr/local/share/ca-certificates/intutic-connect-ca.crt';
+const LINUX_CONNECT_RHEL_DEST = '/etc/pki/ca-trust/source/anchors/intutic-connect-ca.crt';
+const ENTERPRISE_DESTS = { debian: LINUX_DEBIAN_DEST, rhel: LINUX_RHEL_DEST };
+const CONNECT_DESTS = { debian: LINUX_CONNECT_DEBIAN_DEST, rhel: LINUX_CONNECT_RHEL_DEST };
+/**
+ * Every path this module installs the CA to on Linux — `enterprise install`'s
+ * copy and `intutic connect`'s — so `doctor` checks the same files it writes.
+ */
+export const LINUX_CA_TRUST_PATHS = [
+    LINUX_DEBIAN_DEST,
+    LINUX_RHEL_DEST,
+    LINUX_CONNECT_DEBIAN_DEST,
+    LINUX_CONNECT_RHEL_DEST,
+];
 /**
  * The command(s) that trust `caCertPath` at the given scope, for the given
  * platform. Pure — no I/O — so it doubles as the source of truth for
@@ -74,20 +96,20 @@ async function commandExists(cmd) {
         return false;
     }
 }
-async function installLinuxSystemCaTrust(caCertPath) {
+async function installLinuxSystemCaTrust(caCertPath, dests = ENTERPRISE_DESTS) {
     // Debian/Ubuntu is tried first (more common in practice); RHEL/Fedora's
     // update-ca-trust is the fallback. Neither present -> fail loudly rather
     // than silently doing nothing, matching this function's contract that a
     // false `installed` always carries the real reason in `detail`.
     if (await commandExists('update-ca-certificates')) {
-        await copyFile(caCertPath, LINUX_DEBIAN_DEST);
+        await copyFile(caCertPath, dests.debian);
         await execFileAsync('update-ca-certificates', []);
-        return { installed: true, scope: 'system', mechanism: 'update-ca-certificates', detail: `Installed to ${LINUX_DEBIAN_DEST}` };
+        return { installed: true, scope: 'system', mechanism: 'update-ca-certificates', detail: `Installed to ${dests.debian}` };
     }
     if (await commandExists('update-ca-trust')) {
-        await copyFile(caCertPath, LINUX_RHEL_DEST);
+        await copyFile(caCertPath, dests.rhel);
         await execFileAsync('update-ca-trust', ['extract']);
-        return { installed: true, scope: 'system', mechanism: 'update-ca-trust', detail: `Installed to ${LINUX_RHEL_DEST}` };
+        return { installed: true, scope: 'system', mechanism: 'update-ca-trust', detail: `Installed to ${dests.rhel}` };
     }
     return {
         installed: false,
@@ -96,6 +118,76 @@ async function installLinuxSystemCaTrust(caCertPath) {
         detail: 'Neither update-ca-certificates (Debian/Ubuntu) nor update-ca-trust (RHEL/Fedora) is available on this system.',
     };
 }
+/** Quotes `s` for a POSIX shell only when it needs it. */
+function shellQuote(s) {
+    return /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * The shell lines that trust `caCertPath` in the Linux system store the way
+ * connect does (connect's own file name), for a user to run. Pure. Each needs
+ * root, so each is prefixed with `sudo`.
+ */
+export function linuxSystemTrustShellCommands(tool, caCertPath) {
+    return tool === 'update-ca-certificates'
+        ? [`sudo cp ${shellQuote(caCertPath)} ${LINUX_CONNECT_DEBIAN_DEST}`, 'sudo update-ca-certificates']
+        : [`sudo cp ${shellQuote(caCertPath)} ${LINUX_CONNECT_RHEL_DEST}`, 'sudo update-ca-trust extract'];
+}
+/** connect's copy of the CA in the Linux system store, or null when there is none. */
+export async function linuxConnectCaRemoval() {
+    const candidates = [
+        [LINUX_CONNECT_DEBIAN_DEST, { step: 'Rebuild the system CA bundle (Debian/Ubuntu)', cmd: 'update-ca-certificates', args: ['--fresh'] }],
+        [LINUX_CONNECT_RHEL_DEST, { step: 'Rebuild the system CA bundle (RHEL/Fedora)', cmd: 'update-ca-trust', args: ['extract'] }],
+    ];
+    for (const [dest, update] of candidates) {
+        try {
+            await access(dest);
+        }
+        catch {
+            continue;
+        }
+        return { dest, update, commands: [`sudo rm ${dest}`, `sudo ${[update.cmd, ...update.args].join(' ')}`] };
+    }
+    return null;
+}
+/** Removes connect's copy of the CA and rebuilds the bundle. Needs root. */
+export async function removeLinuxConnectCaTrust(removal) {
+    await unlink(removal.dest);
+    await execFileAsync(removal.update.cmd, removal.update.args);
+}
+/**
+ * `intutic connect`'s Linux CA trust. Linux has no per-user trust store that
+ * the system's TLS clients read, and the system store needs root, so: as root
+ * the CA is installed; otherwise connect prints the exact commands to run.
+ */
+export async function ensureLinuxCaTrust(caCertPath, isRoot = process.getuid?.() === 0) {
+    if (await verifyCaTrust(caCertPath))
+        return { state: 'trusted', detail: 'The CA is in the system trust store.' };
+    if (isRoot) {
+        try {
+            const result = await installLinuxSystemCaTrust(caCertPath, CONNECT_DESTS);
+            return result.installed
+                ? { state: 'installed', detail: result.detail }
+                : { state: 'unsupported', detail: result.detail };
+        }
+        catch (err) {
+            return { state: 'failed', detail: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    const tool = (await commandExists('update-ca-certificates'))
+        ? 'update-ca-certificates'
+        : (await commandExists('update-ca-trust')) ? 'update-ca-trust' : null;
+    if (!tool) {
+        return {
+            state: 'unsupported',
+            detail: 'Neither update-ca-certificates (Debian/Ubuntu) nor update-ca-trust (RHEL/Fedora) is available on this system.',
+        };
+    }
+    return {
+        state: 'needs-root',
+        detail: 'Trusting the CA on Linux means adding it to the system trust store, which needs root.',
+        commands: linuxSystemTrustShellCommands(tool, caCertPath),
+    };
+}
 /**
  * Installs `caCertPath` into the OS trust store at `scope`.
  *
@@ -156,9 +248,17 @@ export async function verifyCaTrust(caCertPath) {
         }
     }
     if (process.platform === 'linux') {
+        // The installed copy must be this CA, not one an earlier proxy generated.
         try {
-            const installed = await readFile(LINUX_DEBIAN_DEST, 'utf-8').catch(() => readFile(LINUX_RHEL_DEST, 'utf-8'));
-            return installed.length > 0;
+            const ours = (await readFile(caCertPath, 'utf-8')).trim();
+            if (!ours)
+                return false;
+            for (const dest of [LINUX_DEBIAN_DEST, LINUX_RHEL_DEST, LINUX_CONNECT_DEBIAN_DEST, LINUX_CONNECT_RHEL_DEST]) {
+                const installed = await readFile(dest, 'utf-8').catch(() => '');
+                if (installed.trim() === ours)
+                    return true;
+            }
+            return false;
         }
         catch {
             return false;

package/dist/lib/caTrust.js.map

@@ -1 +1 @@
-{"version":3,"file":"caTrust.js","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmBzC,MAAM,iBAAiB,GAAG,iDAAiD,CAAA;AAC3E,MAAM,eAAe,GAAG,iDAAiD,CAAA;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,KAAiB,EACjB,UAAkB;IAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,uCAAuC,CAAA;QACpH,OAAO,CAAC;gBACN,IAAI,EAAE,kCAAkC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW;gBAC1F,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;aAChF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC;gBACN,IAAI,EAAE,yDAAyD;gBAC/D,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;aACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,OAAO;YACL,EAAE,IAAI,EAAE,yEAAyE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE;YACrI,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE;SAClF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,UAAkB;IACzD,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,MAAM,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QAC7C,MAAM,aAAa,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,iBAAiB,EAAE,EAAE,CAAA;IAC/H,CAAC;IACD,IAAI,MAAM,aAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;QAC3C,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,eAAe,EAAE,EAAE,CAAA;IACtH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+GAA+G;KACxH,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAiB;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEjC,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QAClH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK;YACL,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,MAAM,KAAK,gDAAgD,QAAQ,GAAG;SAC/E,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5H,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,SAAS,EAAE,EAAE,CAAA;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACnH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAClE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAA;YAC5G,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"caTrust.js","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAErE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmBzC,MAAM,iBAAiB,GAAG,iDAAiD,CAAA;AAC3E,MAAM,eAAe,GAAG,iDAAiD,CAAA;AAEzE;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,yDAAyD,CAAA;AAC3F,MAAM,uBAAuB,GAAG,yDAAyD,CAAA;AAGzF,MAAM,gBAAgB,GAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;AACzF,MAAM,aAAa,GAAe,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAA;AAEtG;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,iBAAiB;IACjB,eAAe;IACf,yBAAyB;IACzB,uBAAuB;CACxB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,KAAiB,EACjB,UAAkB;IAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,uCAAuC,CAAA;QACpH,OAAO,CAAC;gBACN,IAAI,EAAE,kCAAkC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW;gBAC1F,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;aAChF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC;gBACN,IAAI,EAAE,yDAAyD;gBAC/D,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;aACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,OAAO;YACL,EAAE,IAAI,EAAE,yEAAyE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE;YACrI,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE;SAClF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,QAAoB,gBAAgB;IAC/F,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,MAAM,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,MAAM,aAAa,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;IAC1H,CAAC;IACD,IAAI,MAAM,aAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAA;IACjH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+GAA+G;KACxH,CAAA;AACH,CAAC;AAED,0DAA0D;AAC1D,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAkD,EAClD,UAAkB;IAElB,OAAO,IAAI,KAAK,wBAAwB;QACtC,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,UAAU,CAAC,IAAI,yBAAyB,EAAE,EAAE,6BAA6B,CAAC;QACnG,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,UAAU,CAAC,IAAI,uBAAuB,EAAE,EAAE,8BAA8B,CAAC,CAAA;AACtG,CAAC;AAYD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,UAAU,GAAoC;QAClD,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE,GAAG,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QACvI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,4CAA4C,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;KAC7H,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAA;IAC1G,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAA8B;IAC5E,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,SAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;IAE1C,IAAI,MAAM,aAAa,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IAChH,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YACzE,OAAO,MAAM,CAAC,SAAS;gBACrB,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/C,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACtF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,+GAA+G;SACxH,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,uFAAuF;QAC/F,QAAQ,EAAE,6BAA6B,CAAC,IAAI,EAAE,UAAU,CAAC;KAC1D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAiB;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEjC,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QAClH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK;YACL,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,MAAM,KAAK,gDAAgD,QAAQ,GAAG;SAC/E,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5H,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,SAAS,EAAE,EAAE,CAAA;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACnH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAClE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACzD,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAA;YACvB,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBAC5G,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC/D,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAA;YAC5C,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/lib/chaos/experiment.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Reading a chaos experiment file: YAML, checked against `ExperimentSchema`.
+ *
+ * @module
+ */
+import { type Experiment } from '@intutic/shared-types';
+export type ExperimentResult = {
+    ok: true;
+    experiment: Experiment;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Validate an experiment's text. Errors carry the path of the offending field. */
+export declare function parseExperiment(text: string): ExperimentResult;
+/** Read and validate an experiment file. */
+export declare function loadExperiment(file: string): Promise<ExperimentResult>;
+//# sourceMappingURL=experiment.d.ts.map

package/dist/lib/chaos/experiment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"experiment.d.ts","sourceRoot":"","sources":["../../../src/lib/chaos/experiment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEzE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAErG,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAgB9D;AAED,4CAA4C;AAC5C,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQ5E"}

package/dist/lib/chaos/experiment.js

@@ -0,0 +1,40 @@
+/**
+ * Reading a chaos experiment file: YAML, checked against `ExperimentSchema`.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import { parse as parseYaml } from 'yaml';
+import { ExperimentSchema } from '@intutic/shared-types';
+/** Validate an experiment's text. Errors carry the path of the offending field. */
+export function parseExperiment(text) {
+    let raw;
+    try {
+        raw = parseYaml(text);
+    }
+    catch (err) {
+        return { ok: false, errors: [`not valid YAML: ${err instanceof Error ? err.message : String(err)}`] };
+    }
+    const parsed = ExperimentSchema.safeParse(raw);
+    if (parsed.success)
+        return { ok: true, experiment: parsed.data };
+    return {
+        ok: false,
+        errors: parsed.error.issues.map((issue) => {
+            const where = issue.path.length ? issue.path.map(String).join('.') : '(top level)';
+            return `${where}: ${issue.message}`;
+        }),
+    };
+}
+/** Read and validate an experiment file. */
+export async function loadExperiment(file) {
+    let text;
+    try {
+        text = await fs.readFile(file, 'utf-8');
+    }
+    catch (err) {
+        return { ok: false, errors: [`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`] };
+    }
+    return parseExperiment(text);
+}
+//# sourceMappingURL=experiment.js.map

package/dist/lib/chaos/experiment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"experiment.js","sourceRoot":"","sources":["../../../src/lib/chaos/experiment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAA;AAIzE,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAA;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;YAClF,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;QACrC,CAAC,CAAC;KACH,CAAA;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,eAAe,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAA;IAC5G,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC"}

package/dist/lib/chaos/probes.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Chaos probes, abort conditions and the run verdict.
+ *
+ * Pure functions over what a repetition left behind: its events, the agent's
+ * stdout and the verify command's exit code. The runner gathers those; this
+ * module decides what they mean.
+ *
+ * @module
+ */
+import { type ChaosEvent, type Experiment, type ProbeId, type ProbeOutcome, type RunVerdict } from '@intutic/shared-types';
+/** What one repetition left behind, as the probes read it. */
+export interface Observation {
+    events: ChaosEvent[];
+    agentOut: string;
+    /** The verify command's exit code; null when verify never ran (an abort). */
+    verifyExitCode: number | null;
+    canary: string;
+}
+/** A probe's result in one repetition: pass, fail, or not evaluated (null). */
+export type ProbeResult = boolean | null;
+/** A probe across the faulted repetitions, as the report shows it. */
+export interface ProbeReport extends ProbeOutcome {
+    passes: number;
+    /** task_success only: every evaluated repetition passed (pass^k). */
+    allPassed?: boolean;
+}
+/** The summed `llm_usage` cost of a repetition, in USD. */
+export declare function repetitionCost(events: readonly ChaosEvent[]): number;
+/**
+ * The first abort condition the events and elapsed time meet, as a reason,
+ * or null. Checked every second while the agent runs, and once after it exits.
+ */
+export declare function abortReason(abort: Experiment['abort'], events: readonly ChaosEvent[], elapsedS: number): string | null;
+/**
+ * After the last `fault_injected`, did a `tool_call` with ok=true on the same
+ * target come within `within` subsequent tool calls? Null when nothing was
+ * injected: there was nothing to recover from.
+ *
+ * Read the way the components record calls:
+ * - a proxy fault's target is a model or a host, never a tool, so any
+ *   successful tool call counts;
+ * - the MCP proxy records the faulted call itself after the fault (an error,
+ *   a stale or an injected result), and that record is the fault, not a
+ *   recovery from it, so it is skipped;
+ * - with the MCP proxy in the run, a gate's record of an `mcp__` call only
+ *   says the gate let it through; the MCP proxy's record of the same call
+ *   carries the outcome, so the gate's is not counted twice;
+ * - `mcp__<server>__<tool>` and `<tool>` are the same target.
+ */
+export declare function recoveredWithin(events: readonly ChaosEvent[], within: number): ProbeResult;
+/**
+ * Evaluate the experiment's probes for one faulted repetition.
+ *
+ * `baselineMeanCost` is the mean cost of the baseline repetitions; when it is
+ * 0 (or there is none) `cost_multiplier_below` is not evaluated, since a ratio
+ * to nothing means nothing. `failure_surfaced` and `recovered_within` are not
+ * evaluated in a repetition where no fault fired.
+ */
+export declare function evaluateRepetition(probes: Experiment['probes'], obs: Observation, baselineMeanCost: number | null): Partial<Record<ProbeId, ProbeResult>>;
+/** Fold per-repetition probe results into one outcome per probe. */
+export declare function aggregateProbes(probes: Experiment['probes'], perRepetition: ReadonlyArray<Partial<Record<ProbeId, ProbeResult>>>): ProbeReport[];
+/** A faulted repetition's events, for the silence checks. */
+export interface FaultedEvents {
+    /** 0-based repetition index, as in the plan. */
+    repetition: number;
+    events: readonly ChaosEvent[];
+}
+/**
+ * Silence is not success. Warn for every fault none of whose injecting
+ * components reported `plan_loaded` in a faulted repetition (it could not
+ * have fired there), and for every fault that never produced a
+ * `fault_injected` event in any of them.
+ */
+export declare function silenceWarnings(faults: Experiment['faults'], faulted: readonly FaultedEvents[]): string[];
+/** What the verdict needs to know about the run. */
+export interface VerdictInput {
+    /** verify exit codes of the baseline repetitions that ran it. */
+    baselineVerify: ReadonlyArray<{
+        repetition: number;
+        code: number | null;
+    }>;
+    probes: ProbeOutcome[];
+    /** `fault_injected` events across the faulted repetitions. */
+    faultsInjected: number;
+    /** Set when the run stopped on an abort condition or a runner error. */
+    abortReason?: string;
+}
+/**
+ * The run verdict. A baseline repetition failing `task_success` makes the run
+ * invalid — the task fails without faults, so nothing can be said about the
+ * agent's resilience. So does a complete run in which no fault fired: its
+ * probes measured the agent without any fault, and a score would read as
+ * resilience it never showed. Otherwise an abort gives `aborted` with the
+ * probes it reached, and a complete run is `scored`.
+ */
+export declare function decideVerdict(input: VerdictInput): RunVerdict;
+//# sourceMappingURL=probes.d.ts.map

package/dist/lib/chaos/probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../../src/lib/chaos/probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EAEf,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAA;AAE9B,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,+EAA+E;AAC/E,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,IAAI,CAAA;AAExC,sEAAsE;AACtE,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAIpE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAC1B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAaf;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAmB1F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,GAAG,EAAE,WAAW,EAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CA6BvC;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,GAClE,WAAW,EAAE,CAcf;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,EAAE,CAkBzG;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,cAAc,EAAE,aAAa,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IAC1E,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,CAc7D"}