@intutic/cli 2.4.0 → 2.5.1

package/dist/lib/chaos/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../src/lib/chaos/workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA;AAEnC,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAExC,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,uBAAuB;IACvB,6BAA6B;IAC7B,mBAAmB;IACnB,oBAAoB;CACZ,CAAA;AA+BV,MAAM,iBAAiB,GAAG,uBAAuB,CAAA;AACjD,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AAEnD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IACzD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAsB,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE3G,gEAAgE;IAChE,KAAK,MAAM,GAAG,IAAI,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnG,CAAC;IACD,qEAAqE;IACrE,wBAAwB;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjG,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,iEAAiE;IACjE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACvD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAA;IAC5B,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3G,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpF,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC9E,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAA;QACjC,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,EAAE,CAAA;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,gBAAgB,IAAI,iBAAiB,EAAE,CAAA;IAChF,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,yBAAyB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,mDAAmD;YACvG,2GAA2G,CAC9G,CAAA;IACH,CAAC;SAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,yBAAyB,IAAI,CAAC,aAAa,IAAI,mBAAmB,GAAG,iBAAiB,6BAA6B;YACjH,6FAA6F,CAChG,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IAChG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC7F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAC,KAAe;IACtC,MAAM,YAAY,GAAG,KAAK;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,OAAO,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;AAClF,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACtD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAA;IACnC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,EAAU;IAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IACjD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;iBACjC,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;IACH,CAAC,CAAA;IACD,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/lib/ciscoScanner.d.ts

@@ -167,10 +167,15 @@ export declare function runCiscoScan(skillDirs: readonly string[]): Promise<Cisc
  * invocations are an artifact of this integration's own per-directory
  * invocation strategy, not something the SARIF consumer should see.
  *
- * Only the CONTAINER is merged: rule catalogs are de-duplicated by `id`,
- * results are concatenated. Every individual rule/result object is passed
- * through unmodified — never rewritten — preserving the "append verbatim"
- * contract this integration promises for `--sarif` output.
+ * Rule catalogs are de-duplicated by `id` and results are concatenated, each
+ * passed through as the tool wrote it, with one exception. Every run carries
+ * `originalUriBaseIds`, which says where its relative `artifactLocation.uri`s
+ * are rooted — and each run roots `%SRCROOT%` at its OWN scanned directory.
+ * Dropping them (as this did) left every location unresolvable. They are
+ * merged: a base id that two runs define differently is renamed for the later
+ * run (`%SRCROOT%_2`), and that run's results are copied with their
+ * `uriBaseId` references renamed to match, so each location still resolves to
+ * the directory it was found in.
  *
  * Returns `null` when given no runs (nothing to append).
  */

package/dist/lib/ciscoScanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ciscoScanner.d.ts","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAYH;;;eAGe;AACf,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAE3C,yEAAyE;AACzE,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAErD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQlE;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B;2CACuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf;;;6CAGyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;2CAEuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX;;kDAE8C;IAC9C,EAAE,EAAE,OAAO,CAAA;IACX;6BACyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;8EAE0E;IAC1E,SAAS,EAAE,OAAO,EAAE,CAAA;IACpB;+DAC2D;IAC3D,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAkID;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM9F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAyB9E"}
+{"version":3,"file":"ciscoScanner.d.ts","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAYH;;;eAGe;AACf,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAE3C,yEAAyE;AACzE,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAErD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQlE;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B;2CACuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf;;;6CAGyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;2CAEuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX;;kDAE8C;IAC9C,EAAE,EAAE,OAAO,CAAA;IACX;6BACyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;8EAE0E;IAC1E,SAAS,EAAE,OAAO,EAAE,CAAA;IACpB;+DAC2D;IAC3D,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAkID;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM9F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CA4C9E"}

package/dist/lib/ciscoScanner.js

@@ -256,10 +256,15 @@ export async function runCiscoScan(skillDirs) {
  * invocations are an artifact of this integration's own per-directory
  * invocation strategy, not something the SARIF consumer should see.
  *
- * Only the CONTAINER is merged: rule catalogs are de-duplicated by `id`,
- * results are concatenated. Every individual rule/result object is passed
- * through unmodified — never rewritten — preserving the "append verbatim"
- * contract this integration promises for `--sarif` output.
+ * Rule catalogs are de-duplicated by `id` and results are concatenated, each
+ * passed through as the tool wrote it, with one exception. Every run carries
+ * `originalUriBaseIds`, which says where its relative `artifactLocation.uri`s
+ * are rooted — and each run roots `%SRCROOT%` at its OWN scanned directory.
+ * Dropping them (as this did) left every location unresolvable. They are
+ * merged: a base id that two runs define differently is renamed for the later
+ * run (`%SRCROOT%_2`), and that run's results are copied with their
+ * `uriBaseId` references renamed to match, so each location still resolves to
+ * the directory it was found in.
  *
  * Returns `null` when given no runs (nothing to append).
  */
@@ -269,16 +274,32 @@ export function combineCiscoSarifRuns(runs) {
     const base = runs[0];
     const rulesById = new Map();
     const results = [];
-    for (const run of runs) {
+    const baseIds = {};
+    runs.forEach((run, index) => {
         const r = run;
         for (const rule of r.tool?.driver?.rules ?? []) {
             const id = rule?.id;
             if (typeof id === 'string')
                 rulesById.set(id, rule);
         }
-        if (Array.isArray(r.results))
-            results.push(...r.results);
-    }
+        const renamed = new Map();
+        const own = r.originalUriBaseIds;
+        if (own && typeof own === 'object' && !Array.isArray(own)) {
+            for (const [id, location] of Object.entries(own)) {
+                let key = id;
+                if (key in baseIds && JSON.stringify(baseIds[key]) !== JSON.stringify(location)) {
+                    key = `${id}_${index + 1}`;
+                    while (key in baseIds)
+                        key = `${key}_`;
+                    renamed.set(id, key);
+                }
+                baseIds[key] = location;
+            }
+        }
+        if (Array.isArray(r.results)) {
+            results.push(...(renamed.size === 0 ? r.results : r.results.map((res) => renameUriBaseIds(res, renamed))));
+        }
+    });
     return {
         tool: {
             driver: {
@@ -286,7 +307,20 @@ export function combineCiscoSarifRuns(runs) {
                 rules: [...rulesById.values()],
             },
         },
+        ...(Object.keys(baseIds).length > 0 ? { originalUriBaseIds: baseIds } : {}),
         results,
     };
 }
+/** A copy of `value` with every `uriBaseId` string found in `renamed` replaced. */
+function renameUriBaseIds(value, renamed) {
+    if (Array.isArray(value))
+        return value.map((v) => renameUriBaseIds(v, renamed));
+    if (!value || typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = k === 'uriBaseId' && typeof v === 'string' && renamed.has(v) ? renamed.get(v) : renameUriBaseIds(v, renamed);
+    }
+    return out;
+}
 //# sourceMappingURL=ciscoScanner.js.map

package/dist/lib/ciscoScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciscoScanner.js","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;eAGe;AACf,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,yEAAyE;AACzE,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AA4CD,SAAS,0BAA0B;IACjC,OAAO,CACL,IAAI,oBAAoB,uCAAuC;QAC/D,oEAAoE;QACpE,yEAAyE;QACzE,gBAAgB,CACjB,CAAA;AACH,CAAC;AAWD;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IACjG,IAAI,SAAoC,CAAA;IAExC,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,oBAAoB,EACpB,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EACjF,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAoB,CAAA;QACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG;gBACH,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,uCAAuC,qBAAqB,eAAe,GAAG,EAAE;aACxF,CAAA;QACH,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,SAAS,GAAG,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC5C,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EACH,mDAAmD,GAAG,EAAE;gBACxD,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;SACrE,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,kCAAkC,GAAG,qBAAqB;SAClE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAE,MAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3G,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,GAA+B,EAAE,OAAO,CAAA;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAMT,CAAA;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAA;YACnD,MAAM,GAAG,GAAG,OAAO,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3G,sEAAsE;YACtE,8DAA8D;YAC9D,kEAAkE;YAClE,2DAA2D;YAC3D,oEAAoE;YACpE,oEAAoE;YACpE,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC3D,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACxD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAClE,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxF,QAAQ;gBACR,IAAI,EAAE,OAAO,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC9F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAA4B;IAC7D,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAyE,CAAA;IAC5F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,MAAM,OAAO,GAAc,EAAE,CAAA;IAE7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAyE,CAAA;QACnF,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAI,IAAyB,EAAE,EAAE,CAAA;YACzC,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;gBAChG,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aAC/B;SACF;QACD,OAAO;KACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"ciscoScanner.js","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;eAGe;AACf,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,yEAAyE;AACzE,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AA4CD,SAAS,0BAA0B;IACjC,OAAO,CACL,IAAI,oBAAoB,uCAAuC;QAC/D,oEAAoE;QACpE,yEAAyE;QACzE,gBAAgB,CACjB,CAAA;AACH,CAAC;AAWD;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IACjG,IAAI,SAAoC,CAAA;IAExC,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,oBAAoB,EACpB,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EACjF,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAoB,CAAA;QACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG;gBACH,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,uCAAuC,qBAAqB,eAAe,GAAG,EAAE;aACxF,CAAA;QACH,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,SAAS,GAAG,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC5C,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EACH,mDAAmD,GAAG,EAAE;gBACxD,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;SACrE,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,kCAAkC,GAAG,qBAAqB;SAClE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAE,MAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3G,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,GAA+B,EAAE,OAAO,CAAA;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAMT,CAAA;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAA;YACnD,MAAM,GAAG,GAAG,OAAO,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3G,sEAAsE;YACtE,8DAA8D;YAC9D,kEAAkE;YAClE,2DAA2D;YAC3D,oEAAoE;YACpE,oEAAoE;YACpE,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC3D,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACxD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAClE,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxF,QAAQ;gBACR,IAAI,EAAE,OAAO,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC9F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAA4B;IAC7D,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAyE,CAAA;IAC5F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,MAAM,OAAO,GAAc,EAAE,CAAA;IAC7B,MAAM,OAAO,GAA4B,EAAE,CAAA;IAE3C,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,GAAuG,CAAA;QACjH,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAI,IAAyB,EAAE,EAAE,CAAA;YACzC,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,CAAA;QAChC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;gBAC5E,IAAI,GAAG,GAAG,EAAE,CAAA;gBACZ,IAAI,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChF,GAAG,GAAG,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAA;oBAC1B,OAAO,GAAG,IAAI,OAAO;wBAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;oBACtC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACtB,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;YACzB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;gBAChG,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aAC/B;SACF;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO;KACR,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAoC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACvH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/lib/decisionsLogRefresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsLogRefresh.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA2BnG"}
+{"version":3,"file":"decisionsLogRefresh.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA8BnG"}

package/dist/lib/decisionsLogRefresh.js

@@ -12,6 +12,7 @@
  * @module
  */
 import { loadCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
 import { createApiClient } from './api.js';
 import { refreshDecisionsDigest, retireClaudeMdDigest } from '@intutic/sync-daemon';
 import { loadConfig } from '../config/store.js';
@@ -29,7 +30,10 @@ export async function refreshDecisionsLog(workspaceRoot) {
         const creds = await loadCredentials();
         if (!creds)
             return { refreshed: false, reason: 'not authenticated' };
-        const client = createApiClient(creds.controlPlaneUrl, creds.apiKey);
+        // The shared resolver, as every command uses: the saved login URL alone
+        // ignored INTUTIC_CONTROL_PLANE_URL and a workspace set up with --dev.
+        const controlPlaneUrl = resolveControlPlaneUrl();
+        const client = createApiClient(controlPlaneUrl, creds.apiKey);
         const { settings } = await client.get('/api/v1/workspace/settings');
         if (!settings?.decisionsLogEnabled) {
             return { refreshed: false, reason: 'decisionsLogEnabled is off' };
@@ -38,7 +42,7 @@ export async function refreshDecisionsLog(workspaceRoot) {
         // its instructions, as on the daemon's own cycle.
         await retireClaudeMdDigest(workspaceRoot);
         const result = await refreshDecisionsDigest({
-            controlPlaneUrl: creds.controlPlaneUrl,
+            controlPlaneUrl,
             apiKey: creds.apiKey,
             workspaceId: creds.workspaceId,
             workspaceRoot,

package/dist/lib/decisionsLogRefresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsLogRefresh.js","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAO/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEpE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACnC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;QACnE,CAAC;QAED,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa;YACb,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,IAAI,EAAE,CAAkB;SAC5D,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"decisionsLogRefresh.js","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAO/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEpE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,eAAe,GAAG,sBAAsB,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACnC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;QACnE,CAAC;QAED,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,eAAe;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa;YACb,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,IAAI,EAAE,CAAkB;SAC5D,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}

package/dist/lib/enforcementState.d.ts

@@ -66,4 +66,11 @@ export declare function readEnforcementState(path?: string): Promise<Enforcement
  * CA-trust leg (from `enterprise install`), and vice versa.
  */
 export declare function writeEnforcementState(legs: EnforcementStateLegs, cliVersion: string, path?: string): Promise<EnforcementState>;
+/**
+ * Whether this machine is expected to be contained, and so whether a direct
+ * connection to an AI provider is a bypass worth reporting: the workspace
+ * enforces egress, or this machine applied `intutic enforce` (the firewall leg).
+ * Anywhere else a direct connection is the normal state.
+ */
+export declare function containmentExpected(egressMode: string | undefined, state: EnforcementState | null): boolean;
 //# sourceMappingURL=enforcementState.d.ts.map

package/dist/lib/enforcementState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enforcementState.d.ts","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,WAAW,CAAC,EAAE,cAAc,CAAA;CAC7B;AAED,0GAA0G;AAC1G,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC,CAAA;AAEjG,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAMzF;AA6BD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAItG;AAUD,0DAA0D;AAC1D,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,MAA+B,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElH;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAA+B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAoB3B"}
+{"version":3,"file":"enforcementState.d.ts","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,WAAW,CAAC,EAAE,cAAc,CAAA;CAC7B;AAED,0GAA0G;AAC1G,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC,CAAA;AAEjG,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAMzF;AA6BD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAItG;AAUD,0DAA0D;AAC1D,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,MAA+B,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElH;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAA+B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAoB3B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAE3G"}

package/dist/lib/enforcementState.js

@@ -110,4 +110,13 @@ export async function writeEnforcementState(legs, cliVersion, path = enforcement
     await rename(tmp, path);
     return next;
 }
+/**
+ * Whether this machine is expected to be contained, and so whether a direct
+ * connection to an AI provider is a bypass worth reporting: the workspace
+ * enforces egress, or this machine applied `intutic enforce` (the firewall leg).
+ * Anywhere else a direct connection is the normal state.
+ */
+export function containmentExpected(egressMode, state) {
+    return egressMode === 'enforce' || state?.firewall?.active === true;
+}
 //# sourceMappingURL=enforcementState.js.map

package/dist/lib/enforcementState.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcementState.js","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmCzC,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC/E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,6DAA6D,CAAA;IAC/F,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,iBAAiB,mCAAmC,CAAA;IAC3F,CAAC;IACD,OAAO,yCAAyC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAyB;IACpD,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9D,OAAO,EAAE,IAAI,IAAI,CAAA;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;gBAC5C,OAAO;gBACP,yCAAyC;gBACzC,IAAI;gBACJ,aAAa;aACd,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACpE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAA;IACnG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAqB,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,oBAAoB,EAAE;IAC9E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,UAAkB,EAClB,OAAe,oBAAoB,EAAE;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAA;IAEzE,MAAM,IAAI,GAAqB;QAC7B,WAAW;QACX,QAAQ,EAAE,QAAQ,EAAE;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO;QAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;KACvD,CAAA;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,cAAc,CAAA;IACjC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAEvB,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"enforcementState.js","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmCzC,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC/E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,6DAA6D,CAAA;IAC/F,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,iBAAiB,mCAAmC,CAAA;IAC3F,CAAC;IACD,OAAO,yCAAyC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAyB;IACpD,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9D,OAAO,EAAE,IAAI,IAAI,CAAA;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;gBAC5C,OAAO;gBACP,yCAAyC;gBACzC,IAAI;gBACJ,aAAa;aACd,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACpE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAA;IACnG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAqB,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,oBAAoB,EAAE;IAC9E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,UAAkB,EAClB,OAAe,oBAAoB,EAAE;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAA;IAEzE,MAAM,IAAI,GAAqB;QAC7B,WAAW;QACX,QAAQ,EAAE,QAAQ,EAAE;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO;QAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;KACvD,CAAA;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,cAAc,CAAA;IACjC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAEvB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA8B,EAAE,KAA8B;IAChG,OAAO,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;AACrE,CAAC"}

package/dist/lib/gitHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitHooks.d.ts","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA8IH;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG7E"}
+{"version":3,"file":"gitHooks.d.ts","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgJH;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG7E"}

package/dist/lib/gitHooks.js

@@ -11,6 +11,7 @@
 import * as node_fs from 'node:fs/promises';
 import * as node_path from 'node:path';
 import { secretPatternAlternation } from '@intutic/shared-types';
+import { writeFileAtomic } from '@intutic/sync-daemon/lib/atomicWrite';
 import { log } from './logger.js';
 /** Marker line identifying a post-commit/post-checkout hook as ours — the overwrite guard. */
 const GIT_CONTEXT_MARKER = '# Intutic Git Context Sync Hook';
@@ -109,8 +110,8 @@ exit 0
  *
  * Reads the existing file first: absent, or already carrying `marker` (a
  * previous install of this same hook, safe to overwrite with the current
- * content — this is what makes a re-run idempotent), writes `content` and
- * marks it executable. Anything else is a hook this codebase did not write —
+ * content — this is what makes a re-run idempotent), writes `content`
+ * executable, atomically. Anything else is a hook this codebase did not write —
  * left standing untouched, with `warnMessage` logged so the operator knows
  * why the hook they expected is missing.
  *
@@ -128,8 +129,9 @@ async function writeHookIfOursOrAbsent(hooksDir, name, content, marker, warnMess
         existing = null;
     }
     if (existing === null || existing.includes(marker)) {
-        await node_fs.writeFile(hookPath, content, { encoding: 'utf-8', mode: 0o755 });
-        await node_fs.chmod(hookPath, 0o755);
+        // Atomic: git runs the hook at moments this does not choose, and a hook
+        // read half-written is a pre-commit secret scan that never ran.
+        await writeFileAtomic(hookPath, content, { mode: 0o755 });
         return true;
     }
     log.warn(warnMessage);

package/dist/lib/gitHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitHooks.js","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AAE5D,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,4CAA4C,CAAA;AAEtE;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,OAAO;;EAEP,kBAAkB;;;;CAInB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;CAIlB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;oGAIiF,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsB7H,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAElD,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,QAAQ,EACR,aAAa,EACb,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,2EAA2E;YACzE,mEAAmE;YACnE,gGAAgG,CACnG,CAAA;QACD,MAAM,qBAAqB,GAAG,MAAM,uBAAuB,CACzD,QAAQ,EACR,eAAe,EACf,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,6EAA6E;YAC3E,qEAAqE;YACrE,gGAAgG,CACnG,CAAA;QAED,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,wEAAwE;QACxE,uEAAuE;QACvE,WAAW;QACX,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAA;QAED,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,eAAe;QACf,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,wFAAwF;YACxF,wEAAwE,CAC3E,CAAA;QAED,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,IAAI,mBAAmB;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,qBAAqB;YAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC1D,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChE,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;QAC7F,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"gitHooks.js","sourceRoot":"","sources":["../../src/lib/gitHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AAE5D,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,4CAA4C,CAAA;AAEtE;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,OAAO;;EAEP,kBAAkB;;;;CAInB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;CAIlB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB;IACvB,OAAO;;EAEP,iBAAiB;;;;oGAIiF,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsB7H,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAElD,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,QAAQ,EACR,aAAa,EACb,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,2EAA2E;YACzE,mEAAmE;YACnE,gGAAgG,CACnG,CAAA;QACD,MAAM,qBAAqB,GAAG,MAAM,uBAAuB,CACzD,QAAQ,EACR,eAAe,EACf,qBAAqB,EAAE,EACvB,kBAAkB,EAClB,6EAA6E;YAC3E,qEAAqE;YACrE,gGAAgG,CACnG,CAAA;QAED,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,wEAAwE;QACxE,uEAAuE;QACvE,WAAW;QACX,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,6EAA6E;YAC7E,mCAAmC,CACtC,CAAA;QAED,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,eAAe;QACf,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CACtD,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,0EAA0E;YACxE,wFAAwF;YACxF,wEAAwE,CAC3E,CAAA;QAED,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,IAAI,mBAAmB;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,qBAAqB;YAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC1D,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChE,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;QAC7F,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/lib/mdmManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdmManifest.d.ts","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AAUD,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA+CvE;AAED,MAAM,WAAW,mBAAmB;IAClC,oHAAoH;IACpH,cAAc,EAAE,MAAM,CAAA;IACtB,iJAAiJ;IACjJ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAOD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAcxE;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAc1E;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;AAOzC;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAI7E;AAED,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAc9F;AAED,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAcxG;AAED,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,aAAa,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAkBrF;AAED,8FAA8F;AAC9F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAmBvF"}
+{"version":3,"file":"mdmManifest.d.ts","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AAUD,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA+CvE;AAED,MAAM,WAAW,mBAAmB;IAClC,oHAAoH;IACpH,cAAc,EAAE,MAAM,CAAA;IACtB,iJAAiJ;IACjJ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAQD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAcxE;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAc1E;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;AAOzC;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAI7E;AAED,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAc9F;AAED,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAcxG;AAED,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,aAAa,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAmDD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAkBrF;AAED,8FAA8F;AAC9F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAmBvF"}

package/dist/lib/mdmManifest.js

@@ -18,6 +18,7 @@
  * @module
  */
 import { randomUUID } from 'node:crypto';
+import * as path from 'node:path';
 import { buildHooksConfig, systemHooksDirFor } from '@intutic/sync-daemon/harness/cursorHooks';
 import { ANTIGRAVITY_HOOK_NAME, buildAntigravityHookEntry, buildGeminiBeforeToolEntry } from '@intutic/sync-daemon';
 function escapeXml(value) {
@@ -102,7 +103,8 @@ ${derBase64}
 function resolveTargetPath(params) {
     if (params.targetPath)
         return params.targetPath;
-    return `${systemHooksDirFor(params.platform ?? process.platform)}/hooks.json`;
+    const platform = params.platform ?? process.platform;
+    return (platform === 'win32' ? path.win32 : path.posix).join(systemHooksDirFor(platform), 'hooks.json');
 }
 /**
  * Jamf-flavored deployment manifest wrapping the real `buildHooksConfig()`
@@ -180,6 +182,33 @@ export function generateAntigravityManifest(flavor, params) {
         },
     }, null, 2) + '\n';
 }
+/** Single-quote a value for POSIX sh. */
+function shQuote(value) {
+    return `'${value.split("'").join(`'\\''`)}'`;
+}
+/**
+ * The managed script. An MDM agent runs it as root with no `SUDO_UID`, so
+ * `enforce apply`'s default uid would be root's and the signed-in user's
+ * proxy would be denied egress. It passes the console user's uid instead:
+ * `stat -f %u /dev/console` on macOS (the console device belongs to the
+ * signed-in GUI user, or to root at the login window), and the user of
+ * seat0's active session via `loginctl` on Linux.
+ */
+function firewallScript(cliBinaryPath) {
+    return [
+        '#!/bin/sh',
+        'if [ "$(uname -s)" = Darwin ]; then',
+        '  uid=$(stat -f %u /dev/console)',
+        'else',
+        '  uid=$(loginctl show-session "$(loginctl show-seat seat0 -p ActiveSession --value 2>/dev/null)" -p User --value 2>/dev/null)',
+        'fi',
+        'case "$uid" in',
+        `  ''|0|*[!0-9]*) exec ${shQuote(cliBinaryPath)} enforce apply ;;`,
+        `  *) exec ${shQuote(cliBinaryPath)} enforce apply --uid "$uid" ;;`,
+        'esac',
+        '',
+    ].join('\n');
+}
 /**
  * Shared body for the two firewall-deployment manifests below — same
  * `content`/`schedule`/`prerequisites`/`honesty` fields, only the
@@ -189,10 +218,11 @@ function buildFirewallManifestBody(params) {
     const suffix = params.workspaceName ? ` (${params.workspaceName})` : '';
     return {
         suffix,
-        content: `${params.cliBinaryPath} enforce apply`,
+        content: firewallScript(params.cliBinaryPath),
         prerequisites: [
             `intutic CLI installed at ${params.cliBinaryPath} on the target machine`,
             'MDM agent executes the script with root (macOS/Linux) or administrator (Windows) privilege — `enforce apply` needs that to write firewall rules',
+            "The proxy runs as the user signed in at the console (`intutic start`, or the daemon `intutic daemon install --proxy` sets up). The script exempts that user's uid from the deny: the owner of /dev/console on macOS, the active seat0 session's user on Linux. With nobody signed in it exempts only root, and the next check-in after sign-in exempts the user.",
         ],
         honesty: 'This re-asserts the firewall on the configured cadence; a user with root/administrator access can still run `intutic enforce remove` and stay unenforced until the next check-in. It is not tamper-proof, it is tamper-resistant on a schedule.',
     };
@@ -230,7 +260,7 @@ export function generateIntuneFirewallManifest(params) {
         schedule: 'Daily platform script schedule, or trigger-on-checkin if the Intune script policy configuration supports it. Daily is the practical floor for a scripted policy run; tighten it if the Intune tenant supports more frequent check-ins.',
         prerequisites: body.prerequisites,
         deployment: {
-            intune: "Deploy via a macOS Shell script (Devices > Scripts) with 'Run script using signed-in credentials' as needed for root context, and a policy schedule; on Windows this would need an equivalent scheduled task — note this manifest's shell command is macOS/Linux-oriented since `enforce apply` is a Rust CLI subcommand available cross-platform but the recurring-execution mechanism differs by OS, and Windows Task Scheduler wiring is left to the operator.",
+            intune: "Deploy via a macOS Shell script (Devices > Scripts) with 'Run script as signed-in user' set to No, so it runs as root, and a policy schedule; on Windows this would need an equivalent scheduled task — note this manifest's shell command is macOS/Linux-oriented since `enforce apply` is a Rust CLI subcommand available cross-platform but the recurring-execution mechanism differs by OS, and Windows Task Scheduler wiring is left to the operator.",
         },
         honesty: body.honesty,
     }, null, 2) + '\n';

package/dist/lib/mdmManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"mdmManifest.js","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAEnH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAElF,OAAO;;;;kBAIS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;;;;;;;;;2CAWC,MAAM;;;;;;gBAMjC,aAAa;;;EAG3B,SAAS;;;;;qDAK0C,MAAM;;;;;;;;YAQ/C,YAAY;;;CAGvB,CAAA;AACD,CAAC;AAWD,SAAS,iBAAiB,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,UAAU,CAAA;IAC/C,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,yEAAyE;QACnF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,IAAI,EAAE,yGAAyG;SAChH;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,2EAA2E;QACrF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,MAAM,EAAE,2HAA2H;SACpI;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAID,MAAM,UAAU,GAA8B;IAC5C,IAAI,EAAE,sEAAsE;IAC5E,MAAM,EAAE,wFAAwF;CACjG,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,sDAAsD,CAAA;IACxF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,+BAA+B,CAAA;AACxC,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAA4B;IACpF,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,4DAA4D,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACxH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,2BAA2B,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE;QACvF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,6JAA6J;SAC7L;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAiC;IAC9F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,qDAAqD,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACjH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACtF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,+CAA+C,qBAAqB,4IAA4I;SAChP;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AASD;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,OAAO;QACL,MAAM;QACN,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,gBAAgB;QAChD,aAAa,EAAE;YACb,4BAA4B,MAAM,CAAC,aAAa,wBAAwB;YACxE,iJAAiJ;SAClJ;QACD,OAAO,EACL,iPAAiP;KACpP,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAgC;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,wEAAwE,IAAI,CAAC,MAAM,EAAE;QAC/F,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,mPAAmP;QACrP,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,IAAI,EAAE,6NAA6N;SACpO;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAAC,MAAgC;IAC7E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,0EAA0E,IAAI,CAAC,MAAM,EAAE;QACjG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,wOAAwO;QAC1O,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,MAAM,EACJ,mcAAmc;SACtc;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC"}
+{"version":3,"file":"mdmManifest.js","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAEnH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAElF,OAAO;;;;kBAIS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;;;;;;;;;2CAWC,MAAM;;;;;;gBAMjC,aAAa;;;EAG3B,SAAS;;;;;qDAK0C,MAAM;;;;;;;;YAQ/C,YAAY;;;CAGvB,CAAA;AACD,CAAC;AAWD,SAAS,iBAAiB,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,UAAU,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACpD,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAA;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,yEAAyE;QACnF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,IAAI,EAAE,yGAAyG;SAChH;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,2EAA2E;QACrF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,MAAM,EAAE,2HAA2H;SACpI;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAID,MAAM,UAAU,GAA8B;IAC5C,IAAI,EAAE,sEAAsE;IAC5E,MAAM,EAAE,wFAAwF;CACjG,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,sDAAsD,CAAA;IACxF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,+BAA+B,CAAA;AACxC,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAA4B;IACpF,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,4DAA4D,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACxH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,2BAA2B,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE;QACvF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,6JAA6J;SAC7L;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAiC;IAC9F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,qDAAqD,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACjH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACtF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,+CAA+C,qBAAqB,4IAA4I;SAChP;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AASD,yCAAyC;AACzC,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,aAAqB;IAC3C,OAAO;QACL,WAAW;QACX,qCAAqC;QACrC,kCAAkC;QAClC,MAAM;QACN,+HAA+H;QAC/H,IAAI;QACJ,gBAAgB;QAChB,yBAAyB,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAClE,aAAa,OAAO,CAAC,aAAa,CAAC,gCAAgC;QACnE,MAAM;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,OAAO;QACL,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC;QAC7C,aAAa,EAAE;YACb,4BAA4B,MAAM,CAAC,aAAa,wBAAwB;YACxE,iJAAiJ;YACjJ,kWAAkW;SACnW;QACD,OAAO,EACL,iPAAiP;KACpP,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAgC;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,wEAAwE,IAAI,CAAC,MAAM,EAAE;QAC/F,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,mPAAmP;QACrP,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,IAAI,EAAE,6NAA6N;SACpO;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAAC,MAAgC;IAC7E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,0EAA0E,IAAI,CAAC,MAAM,EAAE;QACjG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,wOAAwO;QAC1O,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,MAAM,EACJ,4bAA4b;SAC/b;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC"}

package/dist/lib/proxyBinary.d.ts

@@ -8,6 +8,7 @@
  *
  * @module
  */
+import * as node_os from 'node:os';
 /**
  * The version-pinned binary if present, else null. Version-specific on purpose:
  * a stale unversioned binary from an older CLI simply is not found, so the
@@ -16,4 +17,14 @@
 export declare function localProxyBinary(): string | null;
 /** The binary to spawn: the pinned one, or the PATH shim as a fallback. */
 export declare function resolveProxyBinary(): string;
+/**
+ * What to add to a spawned proxy's environment so an `intutic exec --sandbox`
+ * container can reach it. The proxy listens on loopback unless
+ * `INTUTIC_PROXY_BIND` says otherwise. A container reaches it as
+ * `host.docker.internal`: Docker Desktop delivers that from the host's
+ * loopback, but Docker on Linux delivers it on the `docker0` bridge. So on
+ * Linux this adds the bridge's address, which this host's containers reach and
+ * the network does not. An `INTUTIC_PROXY_BIND` already set is left alone.
+ */
+export declare function sandboxBindEnv(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, interfaces?: NodeJS.Dict<node_os.NetworkInterfaceInfo[]>): Record<string, string>;
 //# sourceMappingURL=proxyBinary.d.ts.map

package/dist/lib/proxyBinary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxyBinary.d.ts","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAIhD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"proxyBinary.d.ts","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAMlC;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAIhD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,UAAU,GAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAA+B,GACpF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}

package/dist/lib/proxyBinary.js

@@ -10,6 +10,7 @@
  */
 import * as node_path from 'node:path';
 import * as node_fs from 'node:fs';
+import * as node_os from 'node:os';
 import { createRequire } from 'node:module';
 import { getIntuticDir } from '../config/paths.js';
 const { version } = createRequire(import.meta.url)('../../package.json');
@@ -27,4 +28,19 @@ export function localProxyBinary() {
 export function resolveProxyBinary() {
     return localProxyBinary() ?? 'intutic-proxy';
 }
+/**
+ * What to add to a spawned proxy's environment so an `intutic exec --sandbox`
+ * container can reach it. The proxy listens on loopback unless
+ * `INTUTIC_PROXY_BIND` says otherwise. A container reaches it as
+ * `host.docker.internal`: Docker Desktop delivers that from the host's
+ * loopback, but Docker on Linux delivers it on the `docker0` bridge. So on
+ * Linux this adds the bridge's address, which this host's containers reach and
+ * the network does not. An `INTUTIC_PROXY_BIND` already set is left alone.
+ */
+export function sandboxBindEnv(env = process.env, platform = process.platform, interfaces = node_os.networkInterfaces()) {
+    if (env.INTUTIC_PROXY_BIND?.trim() || platform !== 'linux')
+        return {};
+    const bridge = interfaces.docker0?.find((a) => a.family === 'IPv4' && !a.internal);
+    return bridge ? { INTUTIC_PROXY_BIND: `127.0.0.1,${bridge.address}` } : {};
+}
 //# sourceMappingURL=proxyBinary.js.map

package/dist/lib/proxyBinary.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxyBinary.js","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAE/F;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,OAAO,GAAG,GAAG,EAAE,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,EAAE,IAAI,eAAe,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"proxyBinary.js","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAE/F;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,OAAO,GAAG,GAAG,EAAE,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,EAAE,IAAI,eAAe,CAAA;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,aAA0D,OAAO,CAAC,iBAAiB,EAAE;IAErF,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAA;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,aAAa,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5E,CAAC"}

package/dist/lib/sandbox/firecracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,MAAM,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,OAAO,CAAA;QACvB,YAAY,EAAE,OAAO,CAAA;KACtB,CAAC,CAAA;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,gBAAgB,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAkBlF;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGtD;AASD,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,IAAI,iBAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBhC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAoC9C"}
+{"version":3,"file":"firecracker.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,MAAM,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,OAAO,CAAA;QACvB,YAAY,EAAE,OAAO,CAAA;KACtB,CAAC,CAAA;IACF,oBAAoB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,gBAAgB,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAkBlF;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGtD;AASD,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,IAAI,iBAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBhC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAsC9C"}

package/dist/lib/sandbox/firecracker.js

@@ -121,9 +121,12 @@ export class FirecrackerBackend {
         ];
         return new Promise((resolve) => {
             const child = spawn('bash', args, {
-                stdio: 'inherit',
+                stdio: spec.onStdout ? ['inherit', 'pipe', 'inherit'] : 'inherit',
                 env: { ...process.env, ...this.env },
             });
+            if (spec.onStdout)
+                child.stdout?.on('data', spec.onStdout);
+            spec.signal?.addEventListener('abort', () => child.kill('SIGTERM'), { once: true });
             child.on('error', (err) => {
                 log.error(`firecracker launch failed: ${err.message}`);
                 resolve(127);

package/dist/lib/sandbox/firecracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAkCjD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,QAAQ,GACZ,0DAA0D;QAC1D,MAAM,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,YAAY,CAAA;IAC3D,OAAO;QACL,aAAa,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAC1E,MAAM,EAAE;YACN;gBACE,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,KAAK;aACpB;SACF;QACD,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3E,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;KACxE,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjE,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB;IACvB,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,aAAa,CAAA;IACZ,IAAI,CAAoB;IACxB,GAAG,CAAwB;IAE5C,YAAY,IAAwB,EAAE,GAA2B;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;QACvE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;YACzD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG;YACX,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO;SACtB,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../../src/lib/sandbox/firecracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAkCjD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,QAAQ,GACZ,0DAA0D;QAC1D,MAAM,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,YAAY,CAAA;IAC3D,OAAO;QACL,aAAa,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;QAC1E,MAAM,EAAE;YACN;gBACE,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,IAAI,CAAC,UAAU;gBAC7B,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,KAAK;aACpB;SACF;QACD,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3E,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;KACxE,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjE,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB;IACvB,sEAAsE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,aAAa,CAAA;IACZ,IAAI,CAAoB;IACxB,GAAG,CAAwB;IAE5C,YAAY,IAAwB,EAAE,GAA2B;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;QACvE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;YACzD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG;YACX,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO;SACtB,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/lib/sandbox/image.d.ts

@@ -1,5 +1,5 @@
 /**
- * The default sandbox image, built locally from the Dockerfile the CLI ships.
+ * The sandbox images, built locally from the Dockerfiles the CLI ships.
  *
  * There is no registry copy to pull: the default used to be
  * `intutic/sandbox:latest`, a name nothing publishes, so `intutic exec
@@ -8,19 +8,28 @@
  * which is in the npm package, so the first sandboxed run builds it and tags it
  * with the CLI version; later runs, and upgrades to the same version, reuse it.
  *
+ * A second well-known tag, `<default>-node`, is the default image plus Node.js
+ * and npm (`Dockerfile.node`), the base for agents that run on Node. It is
+ * built the same way, on first use, FROM the default image.
+ *
  * @module
  */
 /** The image `--sandbox-image` defaults to: built locally, tagged with this CLI's version. */
 export declare const DEFAULT_SANDBOX_IMAGE: string;
+/**
+ * The default image plus Node.js and npm, for agents that run on Node (Claude
+ * Code, Codex, …): same entrypoint, firewall and capability drop.
+ */
+export declare const NODE_SANDBOX_IMAGE: string;
 /** Directory holding the shipped Dockerfile and entrypoint. */
 export declare function sandboxBuildContext(): string;
 /** Runs a container-runtime command; resolves with its exit code. */
 export type RuntimeRunner = (runtime: string, args: string[], inheritOutput: boolean) => Promise<number>;
 /**
- * Make sure `image` can be run. Only the default image is built here; any
- * other name is the user's own and the runtime pulls it as usual.
+ * Make sure `image` can be run. Only the two well-known images are built here;
+ * any other name is the user's own and the runtime pulls it as usual.
  *
- * Throws with a message for the user when the default image is missing and
+ * Throws with a message for the user when a well-known image is missing and
  * cannot be built.
  */
 export declare function ensureSandboxImage(runtime: string, image: string, run?: RuntimeRunner, context?: string): Promise<void>;

package/dist/lib/sandbox/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAA+B,CAAA;AAEjE,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AASxG;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,aAA4B,EACjC,OAAO,GAAE,MAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAA+B,CAAA;AAEjE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAA;AAEjE,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AASxG;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,aAA4B,EACjC,OAAO,GAAE,MAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAqBf"}