@intutic/cli 2.5.0 → 2.5.1

package/dist/lib/mdmManifest.js

@@ -18,6 +18,7 @@
  * @module
  */
 import { randomUUID } from 'node:crypto';
+import * as path from 'node:path';
 import { buildHooksConfig, systemHooksDirFor } from '@intutic/sync-daemon/harness/cursorHooks';
 import { ANTIGRAVITY_HOOK_NAME, buildAntigravityHookEntry, buildGeminiBeforeToolEntry } from '@intutic/sync-daemon';
 function escapeXml(value) {
@@ -102,7 +103,8 @@ ${derBase64}
 function resolveTargetPath(params) {
     if (params.targetPath)
         return params.targetPath;
-    return `${systemHooksDirFor(params.platform ?? process.platform)}/hooks.json`;
+    const platform = params.platform ?? process.platform;
+    return (platform === 'win32' ? path.win32 : path.posix).join(systemHooksDirFor(platform), 'hooks.json');
 }
 /**
  * Jamf-flavored deployment manifest wrapping the real `buildHooksConfig()`
@@ -180,6 +182,33 @@ export function generateAntigravityManifest(flavor, params) {
         },
     }, null, 2) + '\n';
 }
+/** Single-quote a value for POSIX sh. */
+function shQuote(value) {
+    return `'${value.split("'").join(`'\\''`)}'`;
+}
+/**
+ * The managed script. An MDM agent runs it as root with no `SUDO_UID`, so
+ * `enforce apply`'s default uid would be root's and the signed-in user's
+ * proxy would be denied egress. It passes the console user's uid instead:
+ * `stat -f %u /dev/console` on macOS (the console device belongs to the
+ * signed-in GUI user, or to root at the login window), and the user of
+ * seat0's active session via `loginctl` on Linux.
+ */
+function firewallScript(cliBinaryPath) {
+    return [
+        '#!/bin/sh',
+        'if [ "$(uname -s)" = Darwin ]; then',
+        '  uid=$(stat -f %u /dev/console)',
+        'else',
+        '  uid=$(loginctl show-session "$(loginctl show-seat seat0 -p ActiveSession --value 2>/dev/null)" -p User --value 2>/dev/null)',
+        'fi',
+        'case "$uid" in',
+        `  ''|0|*[!0-9]*) exec ${shQuote(cliBinaryPath)} enforce apply ;;`,
+        `  *) exec ${shQuote(cliBinaryPath)} enforce apply --uid "$uid" ;;`,
+        'esac',
+        '',
+    ].join('\n');
+}
 /**
  * Shared body for the two firewall-deployment manifests below — same
  * `content`/`schedule`/`prerequisites`/`honesty` fields, only the
@@ -189,10 +218,11 @@ function buildFirewallManifestBody(params) {
     const suffix = params.workspaceName ? ` (${params.workspaceName})` : '';
     return {
         suffix,
-        content: `${params.cliBinaryPath} enforce apply`,
+        content: firewallScript(params.cliBinaryPath),
         prerequisites: [
             `intutic CLI installed at ${params.cliBinaryPath} on the target machine`,
             'MDM agent executes the script with root (macOS/Linux) or administrator (Windows) privilege — `enforce apply` needs that to write firewall rules',
+            "The proxy runs as the user signed in at the console (`intutic start`, or the daemon `intutic daemon install --proxy` sets up). The script exempts that user's uid from the deny: the owner of /dev/console on macOS, the active seat0 session's user on Linux. With nobody signed in it exempts only root, and the next check-in after sign-in exempts the user.",
         ],
         honesty: 'This re-asserts the firewall on the configured cadence; a user with root/administrator access can still run `intutic enforce remove` and stay unenforced until the next check-in. It is not tamper-proof, it is tamper-resistant on a schedule.',
     };
@@ -230,7 +260,7 @@ export function generateIntuneFirewallManifest(params) {
         schedule: 'Daily platform script schedule, or trigger-on-checkin if the Intune script policy configuration supports it. Daily is the practical floor for a scripted policy run; tighten it if the Intune tenant supports more frequent check-ins.',
         prerequisites: body.prerequisites,
         deployment: {
-            intune: "Deploy via a macOS Shell script (Devices > Scripts) with 'Run script using signed-in credentials' as needed for root context, and a policy schedule; on Windows this would need an equivalent scheduled task — note this manifest's shell command is macOS/Linux-oriented since `enforce apply` is a Rust CLI subcommand available cross-platform but the recurring-execution mechanism differs by OS, and Windows Task Scheduler wiring is left to the operator.",
+            intune: "Deploy via a macOS Shell script (Devices > Scripts) with 'Run script as signed-in user' set to No, so it runs as root, and a policy schedule; on Windows this would need an equivalent scheduled task — note this manifest's shell command is macOS/Linux-oriented since `enforce apply` is a Rust CLI subcommand available cross-platform but the recurring-execution mechanism differs by OS, and Windows Task Scheduler wiring is left to the operator.",
         },
         honesty: body.honesty,
     }, null, 2) + '\n';

package/dist/lib/mdmManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"mdmManifest.js","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAEnH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAElF,OAAO;;;;kBAIS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;;;;;;;;;2CAWC,MAAM;;;;;;gBAMjC,aAAa;;;EAG3B,SAAS;;;;;qDAK0C,MAAM;;;;;;;;YAQ/C,YAAY;;;CAGvB,CAAA;AACD,CAAC;AAWD,SAAS,iBAAiB,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,UAAU,CAAA;IAC/C,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,yEAAyE;QACnF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,IAAI,EAAE,yGAAyG;SAChH;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,2EAA2E;QACrF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,MAAM,EAAE,2HAA2H;SACpI;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAID,MAAM,UAAU,GAA8B;IAC5C,IAAI,EAAE,sEAAsE;IAC5E,MAAM,EAAE,wFAAwF;CACjG,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,sDAAsD,CAAA;IACxF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,+BAA+B,CAAA;AACxC,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAA4B;IACpF,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,4DAA4D,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACxH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,2BAA2B,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE;QACvF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,6JAA6J;SAC7L;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAiC;IAC9F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,qDAAqD,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACjH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACtF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,+CAA+C,qBAAqB,4IAA4I;SAChP;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AASD;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,OAAO;QACL,MAAM;QACN,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,gBAAgB;QAChD,aAAa,EAAE;YACb,4BAA4B,MAAM,CAAC,aAAa,wBAAwB;YACxE,iJAAiJ;SAClJ;QACD,OAAO,EACL,iPAAiP;KACpP,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAgC;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,wEAAwE,IAAI,CAAC,MAAM,EAAE;QAC/F,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,mPAAmP;QACrP,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,IAAI,EAAE,6NAA6N;SACpO;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAAC,MAAgC;IAC7E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,0EAA0E,IAAI,CAAC,MAAM,EAAE;QACjG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,wOAAwO;QAC1O,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,MAAM,EACJ,mcAAmc;SACtc;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC"}
+{"version":3,"file":"mdmManifest.js","sourceRoot":"","sources":["../../src/lib/mdmManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAEnH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAElF,OAAO;;;;kBAIS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;;;;;;;;;2CAWC,MAAM;;;;;;gBAMjC,aAAa;;;EAG3B,SAAS;;;;;qDAK0C,MAAM;;;;;;;;YAQ/C,YAAY;;;CAGvB,CAAA;AACD,CAAC;AAWD,SAAS,iBAAiB,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,UAAU,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACpD,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAA;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,yEAAyE;QACnF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,IAAI,EAAE,yGAAyG;SAChH;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,MAA2B;IAChE,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,2EAA2E;QACrF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,MAAM,EAAE,2HAA2H;SACpI;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAID,MAAM,UAAU,GAA8B;IAC5C,IAAI,EAAE,sEAAsE;IAC5E,MAAM,EAAE,wFAAwF;CACjG,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAyB;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,sDAAsD,CAAA;IACxF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,+BAA+B,CAAA;AACxC,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAA4B;IACpF,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,4DAA4D,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACxH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,2BAA2B,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE;QACvF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,6JAA6J;SAC7L;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAiC;IAC9F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,qDAAqD,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAa;QACjH,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACtF,UAAU,EAAE;YACV,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,+CAA+C,qBAAqB,4IAA4I;SAChP;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AASD,yCAAyC;AACzC,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,aAAqB;IAC3C,OAAO;QACL,WAAW;QACX,qCAAqC;QACrC,kCAAkC;QAClC,MAAM;QACN,+HAA+H;QAC/H,IAAI;QACJ,gBAAgB;QAChB,yBAAyB,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAClE,aAAa,OAAO,CAAC,aAAa,CAAC,gCAAgC;QACnE,MAAM;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,OAAO;QACL,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC;QAC7C,aAAa,EAAE;YACb,4BAA4B,MAAM,CAAC,aAAa,wBAAwB;YACxE,iJAAiJ;YACjJ,kWAAkW;SACnW;QACD,OAAO,EACL,iPAAiP;KACpP,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAgC;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,wEAAwE,IAAI,CAAC,MAAM,EAAE;QAC/F,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,mPAAmP;QACrP,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,IAAI,EAAE,6NAA6N;SACpO;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAAC,MAAgC;IAC7E,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,QAAQ,EAAE,0EAA0E,IAAI,CAAC,MAAM,EAAE;QACjG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EACN,wOAAwO;QAC1O,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE;YACV,MAAM,EACJ,4bAA4b;SAC/b;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAA;AACV,CAAC"}

package/dist/lib/proxyBinary.d.ts

@@ -8,6 +8,7 @@
  *
  * @module
  */
+import * as node_os from 'node:os';
 /**
  * The version-pinned binary if present, else null. Version-specific on purpose:
  * a stale unversioned binary from an older CLI simply is not found, so the
@@ -16,4 +17,14 @@
 export declare function localProxyBinary(): string | null;
 /** The binary to spawn: the pinned one, or the PATH shim as a fallback. */
 export declare function resolveProxyBinary(): string;
+/**
+ * What to add to a spawned proxy's environment so an `intutic exec --sandbox`
+ * container can reach it. The proxy listens on loopback unless
+ * `INTUTIC_PROXY_BIND` says otherwise. A container reaches it as
+ * `host.docker.internal`: Docker Desktop delivers that from the host's
+ * loopback, but Docker on Linux delivers it on the `docker0` bridge. So on
+ * Linux this adds the bridge's address, which this host's containers reach and
+ * the network does not. An `INTUTIC_PROXY_BIND` already set is left alone.
+ */
+export declare function sandboxBindEnv(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, interfaces?: NodeJS.Dict<node_os.NetworkInterfaceInfo[]>): Record<string, string>;
 //# sourceMappingURL=proxyBinary.d.ts.map

package/dist/lib/proxyBinary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxyBinary.d.ts","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAIhD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"proxyBinary.d.ts","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAMlC;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAIhD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,UAAU,GAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAA+B,GACpF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}

package/dist/lib/proxyBinary.js

@@ -10,6 +10,7 @@
  */
 import * as node_path from 'node:path';
 import * as node_fs from 'node:fs';
+import * as node_os from 'node:os';
 import { createRequire } from 'node:module';
 import { getIntuticDir } from '../config/paths.js';
 const { version } = createRequire(import.meta.url)('../../package.json');
@@ -27,4 +28,19 @@ export function localProxyBinary() {
 export function resolveProxyBinary() {
     return localProxyBinary() ?? 'intutic-proxy';
 }
+/**
+ * What to add to a spawned proxy's environment so an `intutic exec --sandbox`
+ * container can reach it. The proxy listens on loopback unless
+ * `INTUTIC_PROXY_BIND` says otherwise. A container reaches it as
+ * `host.docker.internal`: Docker Desktop delivers that from the host's
+ * loopback, but Docker on Linux delivers it on the `docker0` bridge. So on
+ * Linux this adds the bridge's address, which this host's containers reach and
+ * the network does not. An `INTUTIC_PROXY_BIND` already set is left alone.
+ */
+export function sandboxBindEnv(env = process.env, platform = process.platform, interfaces = node_os.networkInterfaces()) {
+    if (env.INTUTIC_PROXY_BIND?.trim() || platform !== 'linux')
+        return {};
+    const bridge = interfaces.docker0?.find((a) => a.family === 'IPv4' && !a.internal);
+    return bridge ? { INTUTIC_PROXY_BIND: `127.0.0.1,${bridge.address}` } : {};
+}
 //# sourceMappingURL=proxyBinary.js.map

package/dist/lib/proxyBinary.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxyBinary.js","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAE/F;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,OAAO,GAAG,GAAG,EAAE,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,EAAE,IAAI,eAAe,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"proxyBinary.js","sourceRoot":"","sources":["../../src/lib/proxyBinary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAE/F;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,OAAO,GAAG,GAAG,EAAE,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,EAAE,IAAI,eAAe,CAAA;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,aAA0D,OAAO,CAAC,iBAAiB,EAAE;IAErF,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAA;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,aAAa,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5E,CAAC"}

package/dist/lib/sopFrontMatter.d.ts

@@ -12,10 +12,44 @@ export interface ParsedSopFile {
      * for a file `pull` never wrote (hand-authored, or pushed but not pulled).
      */
     contentHash: string | null;
+    /**
+     * From an `intutic_id:` key: the control-plane SOP this file was last
+     * pulled from or pushed to. `null` for a file never synced, which `sops
+     * push` creates as a new SOP.
+     */
+    intuticId: string | null;
+    /**
+     * From an `intutic_revision:` key: the SOP's `version_counter` when this
+     * file was last synced — the precondition `sops push` sends, so an edit
+     * made on the server since is refused rather than overwritten. Not the
+     * `version:` semver.
+     */
+    revision: number | null;
     /** Everything after the front-matter fence, or the whole trimmed input when there is none. */
     body: string;
 }
 export declare function parseSopFile(raw: string): ParsedSopFile;
+/** The sync record `sops pull`/`push` keep in a file's front matter. */
+export interface SopSyncRecord {
+    intuticId: string;
+    revision: number;
+}
+/**
+ * Set `key: value` lines inside a file's front-matter fence, replacing a line
+ * that already sets the key and keeping every other line — the enforcing keys
+ * the proxy reads (`deny_tools:`, `requires_before:`, …) included. The text
+ * after the fence is kept verbatim unless `body` is given. A file with no
+ * fence gets one holding only these keys. Unknown keys are inert to the
+ * proxy's parser, so the sync record never changes what a SOP enforces.
+ */
+export declare function setFrontMatter(raw: string, fields: Record<string, string>, body?: string): string;
+/**
+ * Record the SOP a file is synced with — `intutic_id:`, `intutic_revision:`
+ * and `content_hash:` (so `sops pull` treats the file as unedited) — keeping
+ * everything else in the file. Optional `extra` keys (a `version:` the server
+ * assigned) are set alongside.
+ */
+export declare function withSyncRecord(raw: string, record: SopSyncRecord, extra?: Record<string, string>): string;
 /**
  * Render a pulled SOP back into a front-matter-carrying file, with
  * `content_hash:` recording `sha256(body)` at write time — the marker
@@ -28,6 +62,7 @@ export declare function renderSopFile(sop: {
     riskTier: string;
     version: string;
     body: string;
+    record?: SopSyncRecord;
 }): string;
 /** `Deploy Checklist` / `deploy checklist!!` → `deploy-checklist`. */
 export declare function slugifyTitle(title: string): string;

package/dist/lib/sopFrontMatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sopFrontMatter.d.ts","sourceRoot":"","sources":["../../src/lib/sopFrontMatter.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAIhE,MAAM,WAAW,aAAa;IAC5B,kIAAkI;IAClI,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,uGAAuG;IACvG,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;IAC5B,iDAAiD;IACjD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAA;CACb;AAaD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAkCvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,MAAM,CAaT;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAcnD"}
+{"version":3,"file":"sopFrontMatter.d.ts","sourceRoot":"","sources":["../../src/lib/sopFrontMatter.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAIhE,MAAM,WAAW,aAAa;IAC5B,kIAAkI;IAClI,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,uGAAuG;IACvG,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;IAC5B,iDAAiD;IACjD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAA;CACb;AAaD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAoCvD;AAOD,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CA0BjG;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAQ7G;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB,GAAG,MAAM,CAcT;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAcnD"}

package/dist/lib/sopFrontMatter.js

@@ -56,9 +56,68 @@ export function parseSopFile(raw) {
         riskTier,
         version: scalar(front, 'version:'),
         contentHash: scalar(front, 'content_hash:'),
+        intuticId: scalar(front, 'intutic_id:'),
+        revision: parseRevision(scalar(front, 'intutic_revision:')),
         body,
     };
 }
+function parseRevision(raw) {
+    if (raw === null || !/^\d+$/.test(raw))
+        return null;
+    return Number(raw);
+}
+/**
+ * Set `key: value` lines inside a file's front-matter fence, replacing a line
+ * that already sets the key and keeping every other line — the enforcing keys
+ * the proxy reads (`deny_tools:`, `requires_before:`, …) included. The text
+ * after the fence is kept verbatim unless `body` is given. A file with no
+ * fence gets one holding only these keys. Unknown keys are inert to the
+ * proxy's parser, so the sync record never changes what a SOP enforces.
+ */
+export function setFrontMatter(raw, fields, body) {
+    const trimmed = raw.trimStart();
+    const set = (frontLines) => {
+        const out = [...frontLines];
+        for (const [key, value] of Object.entries(fields)) {
+            const line = `${key}: ${value}`;
+            const at = out.findIndex((l) => l.trim().startsWith(`${key}:`));
+            if (at === -1)
+                out.push(line);
+            else
+                out[at] = line;
+        }
+        return out;
+    };
+    if (trimmed.startsWith('---')) {
+        const rest = trimmed.slice(3);
+        const end = rest.indexOf('\n---');
+        if (end !== -1) {
+            // rest.slice(0, end) starts with the newline after the opening fence.
+            const frontLines = rest.slice(0, end).split('\n').slice(1);
+            const closing = rest.slice(end + 1);
+            const afterFence = closing.slice(3);
+            const tail = body === undefined ? afterFence : `\n\n${body}\n`;
+            return ['---', ...set(frontLines), '---'].join('\n') + tail;
+        }
+    }
+    const text = body ?? parseSopFile(raw).body;
+    return ['---', ...set([]), '---', '', text, ''].join('\n');
+}
+/**
+ * Record the SOP a file is synced with — `intutic_id:`, `intutic_revision:`
+ * and `content_hash:` (so `sops pull` treats the file as unedited) — keeping
+ * everything else in the file. Optional `extra` keys (a `version:` the server
+ * assigned) are set alongside.
+ */
+export function withSyncRecord(raw, record, extra = {}) {
+    const hash = createHash('sha256').update(parseSopFile(raw).body, 'utf8').digest('hex');
+    return setFrontMatter(raw, {
+        ...extra,
+        content_hash: hash,
+        intutic_id: record.intuticId,
+        intutic_revision: String(record.revision),
+    });
+}
 /**
  * Render a pulled SOP back into a front-matter-carrying file, with
  * `content_hash:` recording `sha256(body)` at write time — the marker
@@ -74,6 +133,7 @@ export function renderSopFile(sop) {
         `risk_tier: ${sop.riskTier}`,
         `version: ${sop.version}`,
         `content_hash: ${hash}`,
+        ...(sop.record ? [`intutic_id: ${sop.record.intuticId}`, `intutic_revision: ${sop.record.revision}`] : []),
         '---',
         '',
         sop.body,

package/dist/lib/sopFrontMatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sopFrontMatter.js","sourceRoot":"","sources":["../../src/lib/sopFrontMatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,MAAM,gBAAgB,GAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAmBtF,8FAA8F;AAC9F,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACrF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAErB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,IAAK,gBAAsC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnF,CAAC,CAAE,OAAuB;QAC1B,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QACpC,IAAI,EAAE;YAAE,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;IAC/B,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3C,IAAI;KACL,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAK7B;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxE,OAAO;QACL,KAAK;QACL,UAAU,GAAG,CAAC,KAAK,EAAE;QACrB,cAAc,GAAG,CAAC,QAAQ,EAAE;QAC5B,YAAY,GAAG,CAAC,OAAO,EAAE;QACzB,iBAAiB,IAAI,EAAE;QACvB,KAAK;QACL,EAAE;QACF,GAAG,CAAC,IAAI;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,KAAK;SACf,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAA;AAC5C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC3C,OAAO,IAAI;SACR,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7B,OAAO,MAAM,KAAK,mBAAmB,IAAI,GAAG,KAAK,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzE,CAAC"}
+{"version":3,"file":"sopFrontMatter.js","sourceRoot":"","sources":["../../src/lib/sopFrontMatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,MAAM,gBAAgB,GAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAgCtF,8FAA8F;AAC9F,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACrF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAErB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,IAAK,gBAAsC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnF,CAAC,CAAE,OAAuB;QAC1B,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QACpC,IAAI,EAAE;YAAE,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;IAC/B,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QACvC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAC3D,IAAI;KACL,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAkB;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAA8B,EAAE,IAAa;IACvF,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,CAAC,UAAoB,EAAY,EAAE;QAC7C,MAAM,GAAG,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAA;YAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAA;YAC/D,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;gBACxB,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;QACrB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,sEAAsE;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAA;YAC9D,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IAC3C,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAqB,EAAE,QAAgC,EAAE;IACnG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtF,OAAO,cAAc,CAAC,GAAG,EAAE;QACzB,GAAG,KAAK;QACR,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC1C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAM7B;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxE,OAAO;QACL,KAAK;QACL,UAAU,GAAG,CAAC,KAAK,EAAE;QACrB,cAAc,GAAG,CAAC,QAAQ,EAAE;QAC5B,YAAY,GAAG,CAAC,OAAO,EAAE;QACzB,iBAAiB,IAAI,EAAE;QACvB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,KAAK;QACL,EAAE;QACF,GAAG,CAAC,IAAI;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,KAAK;SACf,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAA;AAC5C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC3C,OAAO,IAAI;SACR,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7B,OAAO,MAAM,KAAK,mBAAmB,IAAI,GAAG,KAAK,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -40,10 +40,10 @@
     "ioredis": "^5.11.1",
     "picocolors": "^1",
     "yaml": "^2.9.0",
-    "@intutic/shared-types": "2.5.0",
-    "@intutic/id": "2.5.0",
-    "@intutic/sync-daemon": "2.5.0",
-    "@intutic/logger": "2.5.0"
+    "@intutic/shared-types": "2.5.1",
+    "@intutic/id": "2.5.1",
+    "@intutic/sync-daemon": "2.5.1",
+    "@intutic/logger": "2.5.1"
   },
   "devDependencies": {
     "typescript": "^5.5",

package/resources/sandbox/firecracker-launch.sh

@@ -45,6 +45,13 @@ while [ "$#" -gt 0 ]; do
   esac
 done
 [ -n "$KERNEL" ] && [ -n "$ROOTFS" ] || { echo "firecracker-launch: --kernel and --rootfs are required" >&2; exit 2; }
+# The agent runs in the guest over ssh, so without the guest key nothing would
+# run. Refuse before touching the host, rather than boot the VM and exit 0.
+if [ -z "$GUEST_KEY" ]; then
+  echo "firecracker-launch: INTUTIC_FC_GUEST_KEY is not set. It must be the path to the private ssh key the rootfs's sshd accepts for root; the agent runs in the guest over ssh." >&2
+  exit 2
+fi
+[ -r "$GUEST_KEY" ] || { echo "firecracker-launch: INTUTIC_FC_GUEST_KEY ($GUEST_KEY) is not a readable file" >&2; exit 2; }
 
 NFT="$(command -v nft || echo /usr/sbin/nft)"
 SOCK="$(mktemp -u /tmp/intutic-fc-XXXX.sock)"
@@ -104,13 +111,7 @@ api "machine-config" "{\"vcpu_count\":${VCPUS},\"mem_size_mib\":${MEM}}"
 api "actions" '{"action_type":"InstanceStart"}'
 
 # Wait for the guest to reach sshd, then run the agent command inside it. This
-# requires an sshd-enabled rootfs and INTUTIC_FC_GUEST_KEY (the guest ssh key).
-if [ -z "$GUEST_KEY" ]; then
-  echo "firecracker-launch: microVM booted. Set INTUTIC_FC_GUEST_KEY to run the agent in-guest over ssh." >&2
-  echo "  guest console: $CONSOLE" >&2
-  sleep 3
-  exit 0
-fi
+# requires an sshd-enabled rootfs and INTUTIC_FC_GUEST_KEY (checked above).
 SSH="ssh -i ${GUEST_KEY} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8"
 for _ in $(seq 1 20); do
   if $SSH "root@${GUEST_IP}" true 2>/dev/null; then break; fi