@intutic/cli 2.8.1 → 2.9.0

package/dist/lib/localGates.js

@@ -0,0 +1,145 @@
+/**
+ * Harness gates and rules files with no control plane: what
+ * `intutic gates install` writes, and `intutic start` refreshes.
+ *
+ * The same writers `intutic connect` runs, fed from this machine only: the
+ * local `.intutic/sops` for the rules files and the `review_before:` tokens,
+ * and a policy snapshot compiled from no workspace policy
+ * (`writeLocalPolicySnapshot`), which still carries the destructive-command
+ * and skill tiers. Nothing here fetches, drains or reports; no MCP server is
+ * wrapped and no file is made immutable. The harnesses' LLM traffic is
+ * pointed at the local proxy only with `routing`, since a harness routed at a
+ * proxy that is not running stops working.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import { homedir } from 'node:os';
+import { gateKindForHarness, HarnessType } from '@intutic/shared-types';
+import { buildSnapshotRules, findGateFile, loadLocalSopEntries, localHoldTokensFor, localResolvedPolicy, noteProxyUrl, SNAPSHOT_JSON, SNAPSHOT_RULES, updatePreToolUseHooks, writeLocalPolicySnapshot, writeRuntimeEnv, } from '@intutic/sync-daemon';
+import { getAdapter } from '../harness/detector.js';
+import { writeHarnessConfigs } from '../harness/writeHarnessConfigs.js';
+import { loadCredentials } from '../config/store.js';
+import { localProxyPort } from './localProxy.js';
+/** The hook events log is rotated past this size; nothing drains it without a control plane. */
+export const HOOK_EVENTS_ROTATE_BYTES = 10 * 1024 * 1024;
+function snapshotDir() {
+    return node_path.join(homedir(), '.intutic', 'hooks');
+}
+/**
+ * Who wrote the policy snapshot the gates read: `local` (this module, marked
+ * `source: local`), `connect` (any other snapshot), or `none`.
+ */
+export async function gatesSource() {
+    let text;
+    try {
+        text = await node_fs.readFile(node_path.join(snapshotDir(), SNAPSHOT_JSON), 'utf-8');
+    }
+    catch {
+        return 'none';
+    }
+    try {
+        return JSON.parse(text).source === 'local' ? 'local' : 'connect';
+    }
+    catch {
+        return 'connect';
+    }
+}
+/** Whether the snapshot on this machine is one this module wrote. */
+export async function localGatesInstalled() {
+    return (await gatesSource()) === 'local';
+}
+/** Whether `runtime.env` still holds an API key, from a control plane this machine no longer has a login for. */
+async function staleRuntimeKey(envPath) {
+    let text;
+    try {
+        text = await node_fs.readFile(envPath, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    return text.split('\n').some((line) => /^INTUTIC_API_KEY=\S/.test(line.trim()));
+}
+/** Keeps one previous log (`.1`) once the live one passes {@link HOOK_EVENTS_ROTATE_BYTES}. */
+async function rotateHookEvents(workspaceRoot, dryRun) {
+    const log = node_path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    try {
+        if ((await node_fs.stat(log)).size <= HOOK_EVENTS_ROTATE_BYTES)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    if (!dryRun)
+        await node_fs.rename(log, `${log}.1`);
+    return `${log}.1`;
+}
+/**
+ * Writes (or with `dryRun`, reports) the local gates. See the module note for
+ * what it does not do.
+ */
+export async function installLocalGates(opts) {
+    const root = opts.workspaceRoot;
+    const harnesses = [...opts.harnesses];
+    const dryRun = Boolean(opts.dryRun);
+    const warn = opts.warn ?? (() => undefined);
+    const proxyUrl = `http://127.0.0.1:${localProxyPort()}`;
+    const home = homedir();
+    const files = [];
+    // The same reads connect makes: the rules files' SOPs (honouring the
+    // session's selection), and every local SOP's review_before: tokens.
+    const sops = await loadLocalSopEntries(root, harnesses, {
+        onError: (err) => warn(`Could not read every local SOP in .intutic/sops; the rules files are written without the ones that failed: ${err instanceof Error ? err.message : String(err)}`),
+    });
+    const holdTokens = await localHoldTokensFor(root, [], undefined, harnesses);
+    let snapshot;
+    if (dryRun) {
+        snapshot = { digest: '', ruleCount: buildSnapshotRules(localResolvedPolicy(), holdTokens, 'block').length };
+    }
+    else {
+        snapshot = await writeLocalPolicySnapshot({ localHoldTokens: holdTokens, snapshotDir: snapshotDir() });
+    }
+    files.push(node_path.join(snapshotDir(), SNAPSHOT_RULES), node_path.join(snapshotDir(), SNAPSHOT_JSON));
+    if (dryRun) {
+        for (const h of harnesses) {
+            const file = getAdapter(h)?.configFileName;
+            if (file && sops.some((sop) => sop.harnessTargets.includes(h)))
+                files.push(node_path.resolve(root, file));
+        }
+    }
+    else {
+        // disconnect recognises the base URLs it is written into by it.
+        if (opts.routing)
+            await noteProxyUrl(proxyUrl);
+        await writeHarnessConfigs(harnesses, root, sops, proxyUrl, false, {
+            routing: opts.routing,
+            onRulesFile: (path) => files.push(path),
+        });
+    }
+    if (harnesses.includes(HarnessType.CLAUDE_CODE)) {
+        if (!dryRun)
+            await updatePreToolUseHooks(root, [], undefined);
+        files.push(node_path.join(root, '.claude', 'settings.json'));
+        if (!process.env['VITEST'] && !process.env['INTUTIC_SKIP_GLOBAL_HOOKS'])
+            files.push(node_path.join(home, '.claude', 'settings.json'));
+    }
+    // A key left by an earlier connect makes every gate post its events to that
+    // control plane. With no login here, nothing should.
+    const runtimeEnv = node_path.join(home, '.intutic', 'env', 'runtime.env');
+    if ((await loadCredentials()) === null && (await staleRuntimeKey(runtimeEnv))) {
+        if (!dryRun)
+            await writeRuntimeEnv({ controlPlaneUrl: '', apiKey: '', workspaceId: '', envPath: runtimeEnv });
+        files.push(runtimeEnv);
+    }
+    const rotated = await rotateHookEvents(root, dryRun);
+    if (rotated)
+        files.push(rotated);
+    const gates = [];
+    for (const harness of harnesses) {
+        const kind = gateKindForHarness(harness);
+        gates.push({ harness, kind, path: kind === 'hook' ? await findGateFile(harness, root, home) : null });
+    }
+    return { files: [...new Set(files)], gates, snapshot, holdTokens, proxyUrl };
+}
+//# sourceMappingURL=localGates.js.map

package/dist/lib/localGates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localGates.js","sourceRoot":"","sources":["../../src/lib/localGates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEvE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAiCxD,SAAS,WAAW;IAClB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,KAAK,OAAO,CAAA;AAC1C,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,MAAe;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IAClD,OAAO,GAAG,GAAG,IAAI,CAAA;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAA;IAC/B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,cAAc,EAAE,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAA0B,EAAE;QACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,IAAI,CAAC,8GAA8G,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;KACzK,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,SAA0B,CAAC,CAAA;IAE5F,IAAI,QAA+C,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IAC7G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IAEvG,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,CAAA;YAC1C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,MAAM,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IACvI,CAAC;IAED,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7G,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEhC,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAsB,CAAC,CAAA;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AAC9E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "2.8.1",
+  "version": "2.9.0",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -40,10 +40,10 @@
     "ioredis": "^5.11.1",
     "picocolors": "^1",
     "yaml": "^2.9.0",
-    "@intutic/shared-types": "2.8.1",
-    "@intutic/id": "2.8.1",
-    "@intutic/logger": "2.8.1",
-    "@intutic/sync-daemon": "2.8.1"
+    "@intutic/shared-types": "2.9.0",
+    "@intutic/logger": "2.9.0",
+    "@intutic/sync-daemon": "2.9.0",
+    "@intutic/id": "2.9.0"
   },
   "devDependencies": {
     "typescript": "^5.5",