@intutic/mcp-governance-proxy 1.0.3

package/.turbo/turbo-build.log

@@ -0,0 +1 @@
+$ tsc

package/.turbo/turbo-test.log

@@ -0,0 +1,51 @@
+$ vitest run
+
+ RUN  v3.2.6 /Users/ishangupta/intutic-enterprise/packages/mcp-proxy
+
+ ✓ src/__tests__/dlp.test.ts (14 tests) 9ms
+stderr | src/__tests__/config.test.ts > loadConfig > loads variables from runtime.env and parses CLI arguments
+[mcp-proxy] INTUTIC_MCP_PROXY_MODE=daemon is stored but not yet active — running in per-session mode (Phase 4). Will be activated in Phase 5.
+
+ ✓ src/__tests__/config.test.ts (2 tests) 20ms
+{"level":"info","time":"2026-07-22T18:22:42.382Z","pid":56861,"hostname":"Ishans-MacBook-Pro-9.local","name":"mcp-proxy.policyCache","workspaceId":"ws_test_cache_miss","msg":"policy_cache.invalidated"}
+{"level":"info","time":"2026-07-22T18:22:42.419Z","pid":56861,"hostname":"Ishans-MacBook-Pro-9.local","name":"mcp-proxy.policyCache","workspaceId":"ws_test_cache_miss","msg":"policy_cache.invalidated"}
+ ✓ src/__tests__/unit/policyCache.test.ts (4 tests) 210ms
+{"level":"debug","time":"2026-07-22T18:22:42.429Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Bash","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.429Z","name":"mcp-proxy-interceptor","action":"dlp_block","toolName":"Bash","findings":[{"pattern":"sk-[A-Za-z0-9]{20,}","description":"OpenAI API key pattern"}],"msg":"DLP block"}
+{"level":"debug","time":"2026-07-22T18:22:42.430Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Write","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"dlp_block","toolName":"Write","findings":[{"pattern":"sk-ant-[A-Za-z0-9\\-_]{20,}","description":"Anthropic API key pattern"}],"msg":"DLP block"}
+{"level":"debug","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Bash","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"dlp_block","toolName":"Bash","findings":[{"pattern":"rm\\s+-rf?\\s+\\/","description":"Destructive rm -rf / command"}],"msg":"DLP block"}
+{"level":"debug","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"mcp__database__execute","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"dlp_block","toolName":"mcp__database__execute","findings":[{"pattern":"DROP\\s+TABLE","description":"SQL DROP TABLE statement"}],"msg":"DLP block"}
+{"level":"debug","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Read","msg":"Evaluating tool call"}
+{"level":"debug","time":"2026-07-22T18:22:42.431Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Bash","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.432Z","name":"mcp-proxy-interceptor","action":"policy_block","toolName":"Bash","ruleId":"rule-1","reason":"Bash execution not permitted in this workspace","msg":"Policy block"}
+{"level":"debug","time":"2026-07-22T18:22:42.433Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Read","msg":"Evaluating tool call"}
+{"level":"debug","time":"2026-07-22T18:22:42.433Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"mcp__postgres__query","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.433Z","name":"mcp-proxy-interceptor","action":"policy_block","toolName":"mcp__postgres__query","ruleId":"rule-2","reason":"Production database access blocked","msg":"Policy block"}
+{"level":"debug","time":"2026-07-22T18:22:42.433Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"mcp__postgres__query","msg":"Evaluating tool call"}
+{"level":"debug","time":"2026-07-22T18:22:42.436Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Write","msg":"Evaluating tool call"}
+{"level":"warn","time":"2026-07-22T18:22:42.438Z","name":"mcp-proxy-interceptor","action":"policy_approval_required","toolName":"Write","ruleId":"rule-3","msg":"Tool requires human approval per SOP rule rule-3: File writes require review"}
+{"level":"debug","time":"2026-07-22T18:22:42.439Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Read","msg":"Evaluating tool call"}
+{"level":"error","time":"2026-07-22T18:22:42.439Z","name":"mcp-proxy-interceptor","action":"policy_error","err":"Policy engine down","msg":"Policy evaluation error"}
+{"level":"debug","time":"2026-07-22T18:22:42.440Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Read","msg":"Evaluating tool call"}
+{"level":"error","time":"2026-07-22T18:22:42.440Z","name":"mcp-proxy-interceptor","action":"policy_error","err":"Policy engine down","msg":"Policy evaluation error"}
+{"level":"debug","time":"2026-07-22T18:22:42.440Z","name":"mcp-proxy-interceptor","action":"interceptor_decide","toolName":"Read","msg":"Evaluating tool call"}
+{"level":"error","time":"2026-07-22T18:22:42.446Z","name":"mcp-proxy-interceptor","action":"dlp_error","err":"Converting circular structure to JSON\n    --> starting at object with constructor 'Object'\n    --- property 'self' closes the circle","msg":"DLP scan error — skipping"}
+ ✓ src/__tests__/interceptor.test.ts (13 tests) 19ms
+{"level":"info","time":"2026-07-22T18:22:42.562Z","pid":56863,"hostname":"Ishans-MacBook-Pro-9.local","name":"mcp-proxy.policyCache","workspaceId":"ws_test","msg":"policy_cache.invalidated"}
+{"level":"info","time":"2026-07-22T18:22:42.570Z","name":"mcp-proxy-policy","action":"policy_refreshed_from_daemon","ruleCount":1,"msg":"SOP rules refreshed from daemon"}
+ ✓ src/__tests__/unit/socketServer.test.ts (5 tests) 144ms
+{"level":"debug","time":"2026-07-22T18:22:42.571Z","name":"mcp-proxy-emitter","action":"telemetry_enqueued","msg":"Telemetry successfully enqueued to daemon"}
+{"level":"warn","time":"2026-07-22T18:22:42.572Z","name":"mcp-proxy-policy","action":"policy_daemon_failed","err":"connect ENOENT /tmp/nonexistent-1784744562571.sock","msg":"Failed to refresh policy from daemon socket — falling back to HTTP"}
+{"level":"debug","time":"2026-07-22T18:22:42.572Z","name":"mcp-proxy-policy","action":"policy_refresh","url":"http://127.0.0.1:51982/api/v1/sop/rules?workspaceId=ws_fallback&active=true","msg":"Fetching SOP rules from control plane"}
+{"level":"info","time":"2026-07-22T18:22:42.573Z","name":"mcp-proxy-policy","action":"policy_refreshed","ruleCount":1,"msg":"SOP rules refreshed"}
+ ✓ src/__tests__/integration/daemon-shim.test.ts (4 tests) 141ms
+ ✓ src/__tests__/unit/telemetryBatcher.test.ts (1 test) 446ms
+
+ Test Files  7 passed (7)
+      Tests  43 passed (43)
+   Start at  14:22:41
+   Duration  1.15s (transform 482ms, setup 0ms, collect 1.25s, tests 989ms, environment 1ms, prepare 1.18s)
+

package/.turbo/turbo-typecheck.log

@@ -0,0 +1 @@
+$ tsc --noEmit

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Intutic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPORTED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# @intutic/mcp-governance-proxy
+
+> Transparent stdio proxy that intercepts MCP `tools/call` JSON-RPC messages and applies workspace SOP policy before forwarding to real MCP servers.
+
+## Overview
+
+The MCP Governance Proxy sits between an AI coding agent and its MCP tool servers. It intercepts every `tools/call` JSON-RPC message on stdin/stdout, evaluates the call against workspace governance policies, and either forwards, blocks, redacts, or flags for approval — all without requiring changes to the agent or the tool server.
+
+## Modes
+
+### Proxy Mode
+
+Intercepts stdio between the agent and an existing MCP server process:
+
+```
+Agent ↔ intutic-mcp-proxy ↔ Real MCP Server (stdio)
+```
+
+The proxy spawns the real MCP server as a child process and relays JSON-RPC messages bidirectionally, applying policy checks on every `tools/call` request.
+
+### Standalone Mode
+
+Runs as its own MCP server that exposes governance-aware tool wrappers:
+
+```
+Agent ↔ intutic-mcp-daemon (MCP server)
+```
+
+## Features
+
+### DLP Scanning
+
+14 regex patterns detect and block sensitive data in tool arguments and responses:
+
+- API keys and tokens (AWS, GCP, GitHub, Stripe, etc.)
+- Secrets and passwords
+- Private keys and certificates
+- SQL injection patterns
+- PII indicators
+
+### Policy Enforcement
+
+- **SOP rule matching**: Maps tool names and argument patterns to workspace SOP rules
+- **Enforcement actions**: `allow`, `block`, `redact`, `require_approval`
+- **Audit logging**: Every intercepted call is logged with policy evaluation results
+
+## Binaries
+
+| Binary | Description |
+|--------|-------------|
+| `intutic-mcp-proxy` | Stdio proxy — wraps an existing MCP server |
+| `intutic-mcp-daemon` | Standalone MCP server with governance built in |
+
+## Installation
+
+```bash
+npm install @intutic/mcp-governance-proxy
+```
+
+## Usage
+
+### Proxy Mode
+
+```json
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "intutic-mcp-proxy",
+      "args": ["--", "npx", "@modelcontextprotocol/server-filesystem", "/path"]
+    }
+  }
+}
+```
+
+### Standalone Mode
+
+```bash
+intutic-mcp-daemon --port 3100
+```
+
+## Part of Intutic
+
+This package is part of the [Intutic](https://github.com/intutic/intutic) monorepo — an open-core AI governance control plane for developer teams.
+
+## License
+
+MIT — see [LICENSE](../../LICENSE) for details.

package/dist/config.d.ts

@@ -0,0 +1,40 @@
+/**
+ * config.ts — MCP Governance Proxy configuration.
+ *
+ * Reads from ~/.intutic/env/runtime.env (written by sync-daemon runtimeEnv.ts)
+ * and from CLI arguments passed after `--`.
+ *
+ * @module
+ */
+export interface ProxyConfig {
+    /** Workspace ID for policy lookups and event attribution */
+    workspaceId: string;
+    /** Control plane base URL (e.g. http://localhost:3001) */
+    controlPlaneUrl: string;
+    /** API key for control plane requests */
+    apiKey: string;
+    /** Real MCP server command + args (everything after --). Empty = standalone mode. */
+    realServerCommand: string[];
+    /** Path to write hook-events JSONL (Path B) */
+    eventsFilePath: string;
+    /** Policy cache TTL in milliseconds (default: 60_000) */
+    policyTtlMs: number;
+    /** Whether to fail-open when control plane is unreachable (default: true) */
+    failOpen: boolean;
+    /**
+     * MCP proxy deployment model ('per-session' | 'daemon').
+     * WS-5 Q2 — stored and propagated but 'daemon' is not yet active in Phase 4.
+     */
+    mcpProxyMode: string;
+    /**
+     * Standalone mode — when true, the proxy acts as the Intutic MCP server
+     * directly (no downstream server to proxy). Used for the `intutic` harness
+     * entry that exposes Intutic governance tools to the harness.
+     */
+    standalone: boolean;
+}
+/**
+ * Load the proxy configuration from runtime.env + CLI args + environment.
+ */
+export declare function loadConfig(argv?: string[]): Promise<ProxyConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;CACpB;AAqDD;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAiD7F"}

package/dist/config.js

@@ -0,0 +1,100 @@
+/**
+ * config.ts — MCP Governance Proxy configuration.
+ *
+ * Reads from ~/.intutic/env/runtime.env (written by sync-daemon runtimeEnv.ts)
+ * and from CLI arguments passed after `--`.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_os from 'node:os';
+import * as node_path from 'node:path';
+const DEFAULT_EVENTS_PATH = node_path.join(node_os.homedir(), '.intutic', 'events', 'hook-events.jsonl');
+const RUNTIME_ENV_PATH = node_path.join(node_os.homedir(), '.intutic', 'env', 'runtime.env');
+/**
+ * Parse a .env-format file into a key→value record.
+ * Lines starting with # are comments; blank lines are skipped.
+ */
+async function parseEnvFile(filePath) {
+    const result = {};
+    try {
+        const content = await node_fs.readFile(filePath, 'utf-8');
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const eq = trimmed.indexOf('=');
+            if (eq === -1)
+                continue;
+            const key = trimmed.slice(0, eq).trim();
+            // Strip surrounding quotes from value
+            let value = trimmed.slice(eq + 1).trim();
+            if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+                value = value.slice(1, -1);
+            }
+            result[key] = value;
+        }
+    }
+    catch {
+        // File may not exist — return empty record
+    }
+    return result;
+}
+/**
+ * Parse CLI arguments for --workspace-id and the real server command (after --).
+ */
+function parseCliArgs(argv) {
+    let workspaceId;
+    let separatorIndex = -1;
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--workspace-id' && i + 1 < argv.length) {
+            workspaceId = argv[i + 1];
+            i++; // skip value
+        }
+        else if (argv[i] === '--') {
+            separatorIndex = i;
+            break;
+        }
+    }
+    const realServerCommand = separatorIndex !== -1 ? argv.slice(separatorIndex + 1) : [];
+    return { workspaceId, realServerCommand };
+}
+/**
+ * Load the proxy configuration from runtime.env + CLI args + environment.
+ */
+export async function loadConfig(argv = process.argv.slice(2)) {
+    const runtimeEnv = await parseEnvFile(RUNTIME_ENV_PATH);
+    const cli = parseCliArgs(argv);
+    const controlPlaneUrl = process.env['INTUTIC_CONTROL_PLANE_URL'] ??
+        runtimeEnv['INTUTIC_CONTROL_PLANE_URL'] ??
+        'http://localhost:3001';
+    const apiKey = process.env['INTUTIC_API_KEY'] ??
+        runtimeEnv['INTUTIC_API_KEY'] ??
+        '';
+    const workspaceId = cli.workspaceId ??
+        process.env['INTUTIC_WORKSPACE_ID'] ??
+        runtimeEnv['INTUTIC_WORKSPACE_ID'] ??
+        'unknown';
+    const eventsFilePath = process.env['INTUTIC_EVENTS_FILE'] ??
+        runtimeEnv['INTUTIC_EVENTS_FILE'] ??
+        DEFAULT_EVENTS_PATH;
+    const failOpen = (runtimeEnv['INTUTIC_MCP_FAIL_OPEN'] ?? 'true').toLowerCase() !== 'false';
+    const mcpProxyMode = runtimeEnv['INTUTIC_MCP_PROXY_MODE'] ?? 'per-session';
+    if (mcpProxyMode === 'daemon') {
+        console.warn('[mcp-proxy] INTUTIC_MCP_PROXY_MODE=daemon is stored but not yet active — '
+            + 'running in per-session mode (Phase 4). Will be activated in Phase 5.');
+    }
+    const standalone = cli.realServerCommand.length === 0;
+    return {
+        workspaceId,
+        controlPlaneUrl,
+        apiKey,
+        realServerCommand: cli.realServerCommand,
+        eventsFilePath,
+        policyTtlMs: 60_000,
+        failOpen,
+        mcpProxyMode,
+        standalone,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AA8BtC,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;AACxG,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAE5F;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAQ;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,sCAAsC;YACtC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAAc;IAClC,IAAI,WAA+B,CAAA;IACnC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,GAAG,CAAC,CAAA;YAClB,MAAK;QACP,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAA;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAE9B,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACxC,UAAU,CAAC,2BAA2B,CAAC;QACvC,uBAAuB,CAAA;IAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9B,UAAU,CAAC,iBAAiB,CAAC;QAC7B,EAAE,CAAA;IAEJ,MAAM,WAAW,GACf,GAAG,CAAC,WAAW;QACf,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACnC,UAAU,CAAC,sBAAsB,CAAC;QAClC,SAAS,CAAA;IAEX,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAClC,UAAU,CAAC,qBAAqB,CAAC;QACjC,mBAAmB,CAAA;IAErB,MAAM,QAAQ,GACZ,CAAC,UAAU,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;IAE3E,MAAM,YAAY,GAAG,UAAU,CAAC,wBAAwB,CAAC,IAAI,aAAa,CAAA;IAC1E,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CACV,2EAA2E;cACzE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAA;IAErD,OAAO;QACL,WAAW;QACX,eAAe;QACf,MAAM;QACN,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,cAAc;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ;QACR,YAAY;QACZ,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/daemon/healthMonitor.d.ts

@@ -0,0 +1,18 @@
+export interface McpServerConfig {
+    name: string;
+    url: string;
+    credentialExpiryAt?: Date;
+}
+export interface McpServerHealth {
+    serverName: string;
+    status: 'healthy' | 'degraded' | 'unreachable';
+    p95LatencyMs?: number;
+    errorRatePct?: number;
+    credentialExpiryAt?: string;
+    checkedAt: string;
+}
+export declare function registerServer(server: McpServerConfig): void;
+export declare function startHealthMonitor(): void;
+export declare function stopHealthMonitor(): void;
+export declare function getHealthSnapshot(): McpServerHealth[];
+//# sourceMappingURL=healthMonitor.d.ts.map

package/dist/daemon/healthMonitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthMonitor.d.ts","sourceRoot":"","sources":["../../src/daemon/healthMonitor.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAM,MAAM,CAAA;IAChB,GAAG,EAAO,MAAM,CAAA;IAChB,kBAAkB,CAAC,EAAE,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAW,MAAM,CAAA;IAC3B,MAAM,EAAe,SAAS,GAAG,UAAU,GAAG,aAAa,CAAA;IAC3D,YAAY,CAAC,EAAQ,MAAM,CAAA;IAC3B,YAAY,CAAC,EAAQ,MAAM,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAY,MAAM,CAAA;CAC5B;AAuID,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAE5D;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAuBzC;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,iBAAiB,IAAI,eAAe,EAAE,CAErD"}

package/dist/daemon/healthMonitor.js

@@ -0,0 +1,185 @@
+/**
+ * MCP Server Health Monitor
+ *
+ * Probes MCP servers every 30s and records health snapshots.
+ * Emits mcp_daemon.mcp_server_down when a server becomes unreachable.
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import https from 'node:https';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execSync } from 'node:child_process';
+import { createLogger } from '@intutic/logger';
+const logger = createLogger('mcp-proxy.healthMonitor');
+const HEARTBEAT_MS = 30_000;
+const PROBE_TIMEOUT = 5_000;
+const CP_URL = process.env['CONTROL_PLANE_URL'] ?? 'http://localhost:3001';
+const DAEMON_API_KEY = process.env['INTUTIC_API_KEY'] ?? '';
+const WORKSPACE_ID = process.env['INTUTIC_WORKSPACE_ID'] ?? '';
+const servers = [];
+const latestHealth = new Map();
+let timer = null;
+function discoverServers() {
+    const discovered = [];
+    const homedir = os.homedir();
+    const configPaths = [
+        path.join(homedir, '.claude', 'mcp.json'),
+        process.platform === 'darwin'
+            ? path.join(homedir, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json')
+            : process.platform === 'win32'
+                ? path.join(process.env['APPDATA'] ?? '', 'Claude', 'claude_desktop_config.json')
+                : path.join(homedir, '.config', 'Claude', 'claude_desktop_config.json'),
+        process.platform === 'darwin'
+            ? path.join(homedir, 'Library', 'Application Support', 'Cursor', 'User', 'globalSettings.json')
+            : process.platform === 'win32'
+                ? path.join(process.env['APPDATA'] ?? '', 'Cursor', 'User', 'globalSettings.json')
+                : path.join(homedir, '.config', 'Cursor', 'User', 'globalSettings.json'),
+    ];
+    for (const configPath of configPaths) {
+        try {
+            if (!fs.existsSync(configPath))
+                continue;
+            const raw = fs.readFileSync(configPath, 'utf8');
+            const parsed = JSON.parse(raw);
+            const mcpServers = parsed.mcpServers ?? parsed.mcp ?? {};
+            for (const [name, entry] of Object.entries(mcpServers)) {
+                if (name === 'intutic')
+                    continue; // Skip self
+                const serverEntry = entry;
+                let url = '';
+                if (serverEntry.url) {
+                    url = serverEntry.url;
+                }
+                else if (serverEntry.command) {
+                    url = `stdio://${serverEntry.command}`;
+                }
+                if (url && !discovered.some(s => s.name === name)) {
+                    discovered.push({
+                        name,
+                        url,
+                        credentialExpiryAt: undefined
+                    });
+                }
+            }
+        }
+        catch { }
+    }
+    return discovered;
+}
+async function probeServer(server) {
+    const start = Date.now();
+    if (server.url.startsWith('stdio://')) {
+        const cmd = server.url.replace('stdio://', '');
+        let status = 'healthy';
+        try {
+            const whichCmd = process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`;
+            execSync(whichCmd, { stdio: 'ignore' });
+        }
+        catch {
+            status = 'unreachable';
+        }
+        return {
+            serverName: server.name,
+            status,
+            p95LatencyMs: Date.now() - start,
+            credentialExpiryAt: server.credentialExpiryAt?.toISOString(),
+            checkedAt: new Date().toISOString()
+        };
+    }
+    return new Promise((resolve) => {
+        try {
+            const url = new URL(server.url);
+            const isHttps = url.protocol === 'https:';
+            const lib = isHttps ? https : http;
+            const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname + url.search, method: 'GET' }, (res) => {
+                res.resume();
+                const latency = Date.now() - start;
+                const status = res.statusCode && res.statusCode < 500 ? 'healthy' : 'degraded';
+                resolve({ serverName: server.name, status, p95LatencyMs: latency,
+                    credentialExpiryAt: server.credentialExpiryAt?.toISOString(),
+                    checkedAt: new Date().toISOString() });
+            });
+            req.on('error', () => resolve({ serverName: server.name, status: 'unreachable',
+                checkedAt: new Date().toISOString() }));
+            req.setTimeout(PROBE_TIMEOUT, () => {
+                req.destroy();
+                resolve({
+                    serverName: server.name, status: 'unreachable', checkedAt: new Date().toISOString()
+                });
+            });
+            req.end();
+        }
+        catch {
+            resolve({ serverName: server.name, status: 'unreachable', checkedAt: new Date().toISOString() });
+        }
+    });
+}
+async function uploadSnapshots(snapshots) {
+    if (snapshots.length === 0 || !WORKSPACE_ID)
+        return;
+    const body = JSON.stringify({ mcpServers: snapshots });
+    const url = new URL('/api/v1/mcp-daemon/health-snapshot', CP_URL);
+    const isHttps = url.protocol === 'https:';
+    const lib = isHttps ? https : http;
+    return new Promise((resolve) => {
+        const req = lib.request({
+            hostname: url.hostname,
+            port: url.port,
+            path: url.pathname,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(body),
+                'Authorization': `Bearer ${DAEMON_API_KEY}`,
+                'x-workspace-id': WORKSPACE_ID
+            }
+        }, (res) => {
+            res.resume();
+            resolve();
+        });
+        req.on('error', () => resolve());
+        req.setTimeout(5000, () => { req.destroy(); resolve(); });
+        req.write(body);
+        req.end();
+    });
+}
+export function registerServer(server) {
+    servers.push(server);
+}
+export function startHealthMonitor() {
+    // Run config discovery
+    const discovered = discoverServers();
+    for (const s of discovered) {
+        registerServer(s);
+    }
+    timer = setInterval(async () => {
+        const snapshots = [];
+        for (const server of servers) {
+            const health = await probeServer(server);
+            const prev = latestHealth.get(server.name);
+            latestHealth.set(server.name, health);
+            snapshots.push(health);
+            if (health.status === 'unreachable' && prev?.status !== 'unreachable') {
+                logger.warn({ serverName: server.name }, 'mcp_daemon.mcp_server_down');
+            }
+        }
+        if (snapshots.length > 0) {
+            await uploadSnapshots(snapshots);
+        }
+    }, HEARTBEAT_MS);
+    timer.unref();
+}
+export function stopHealthMonitor() {
+    if (timer) {
+        clearInterval(timer);
+        timer = null;
+    }
+}
+export function getHealthSnapshot() {
+    return Array.from(latestHealth.values());
+}
+//# sourceMappingURL=healthMonitor.js.map

package/dist/daemon/healthMonitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthMonitor.js","sourceRoot":"","sources":["../../src/daemon/healthMonitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAA;AAEtD,MAAM,YAAY,GAAG,MAAM,CAAA;AAC3B,MAAM,aAAa,GAAG,KAAK,CAAA;AAE3B,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AACnF,MAAM,cAAc,GAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAC9D,MAAM,YAAY,GAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;AAiBjE,MAAM,OAAO,GAAsB,EAAE,CAAA;AACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAA;AACvD,IAAI,KAAK,GAA0C,IAAI,CAAA;AAEvD,SAAS,eAAe;IACtB,MAAM,UAAU,GAAsB,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IAE5B,MAAM,WAAW,GAAG;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;QACzC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC;YAC9F,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC;QACzE,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC;YAC/F,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC;gBAClF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC;KAC3E,CAAA;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAQ;YACxC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvD,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAQ,CAAC,YAAY;gBAC7C,MAAM,WAAW,GAAG,KAAY,CAAA;gBAEhC,IAAI,GAAG,GAAG,EAAE,CAAA;gBACZ,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;oBACpB,GAAG,GAAG,WAAW,CAAC,GAAG,CAAA;gBACvB,CAAC;qBAAM,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;oBAC/B,GAAG,GAAG,WAAW,WAAW,CAAC,OAAO,EAAE,CAAA;gBACxC,CAAC;gBAED,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBAClD,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI;wBACJ,GAAG;wBACH,kBAAkB,EAAE,SAAS;qBAC9B,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC9C,IAAI,MAAM,GAA8B,SAAS,CAAA;QACjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAA;YAC/E,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,aAAa,CAAA;QACxB,CAAC;QACD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAChC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,EAAE;YAC5D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;IACH,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAK,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;YACzC,MAAM,GAAG,GAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;YACpC,MAAM,GAAG,GAAK,GAAG,CAAC,OAAO,CACvB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAC1F,CAAC,GAAG,EAAE,EAAE;gBACN,GAAG,CAAC,MAAM,EAAE,CAAA;gBACZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAA;gBAClC,MAAM,MAAM,GAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;gBAC/E,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;oBAC9D,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,EAAE;oBAC5D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;YAC1C,CAAC,CACF,CAAA;YACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa;gBAC5E,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;YACzC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,EAAE;gBAAG,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC;oBAC3D,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAAE,CAAC,CAAA;YAAC,CAAC,CAAC,CAAA;YAC3F,GAAG,CAAC,GAAG,EAAE,CAAA;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAClG,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAA4B;IACzD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY;QAAE,OAAM;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAElC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACzC,eAAe,EAAE,UAAU,cAAc,EAAE;gBAC3C,gBAAgB,EAAE,YAAY;aAC/B;SACF,EACD,CAAC,GAAQ,EAAE,EAAE;YACX,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,OAAO,EAAE,CAAA;QACX,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAChC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACxD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,uBAAuB;IACvB,MAAM,UAAU,GAAG,eAAe,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,cAAc,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IAED,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,SAAS,GAAsB,EAAE,CAAA;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;YACxC,MAAM,IAAI,GAAK,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5C,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACrC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,IAAI,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAA;YACxE,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,SAAS,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,EAAE,YAAY,CAAC,CAAA;IAChB,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,IAAI,CAAA;IAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/daemon/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/daemon/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/daemon/index.ts"],"names":[],"mappings":""}

package/dist/daemon/index.js

@@ -0,0 +1,77 @@
+/**
+ * intutic-mcp-daemon entry point
+ *
+ * Long-lived process listening on ~/.intutic/mcp-proxy.sock.
+ * Manages policy cache, telemetry batching, and MCP server health monitoring.
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ *
+ * Usage:
+ *   node dist/daemon/index.js
+ *   (managed by LaunchAgent / systemd via `intutic daemon mcp start`)
+ *
+ * @module
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { startBatcher, stopBatcher } from './telemetryBatcher.js';
+import { startHealthMonitor, stopHealthMonitor } from './healthMonitor.js';
+import { createSocketServer, getSocketPath } from './socketServer.js';
+const logger = createLogger('intutic-mcp-daemon');
+const PID_FILE = path.join(os.homedir(), '.intutic', 'mcp-daemon.pid');
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+async function main() {
+    const socketPath = getSocketPath();
+    logger.info({ pid: process.pid, socketPath }, 'mcp_daemon.starting');
+    // Ensure ~/.intutic directory exists with correct permissions
+    ensureDir(path.dirname(socketPath));
+    // Remove stale socket file
+    try {
+        fs.unlinkSync(socketPath);
+    }
+    catch { }
+    // Write PID file
+    fs.writeFileSync(PID_FILE, String(process.pid), { mode: 0o600 });
+    // Start subsystems
+    startBatcher();
+    startHealthMonitor();
+    const server = createSocketServer();
+    server.listen(socketPath, () => {
+        // Restrict socket to owner only
+        try {
+            fs.chmodSync(socketPath, 0o600);
+        }
+        catch { }
+        logger.info({ socketPath, pid: process.pid }, 'mcp_daemon.running');
+        process.stdout.write(JSON.stringify({ event: 'mcp_daemon.started', pid: process.pid }) + '\n');
+    });
+    server.on('error', (err) => {
+        logger.error({ err }, 'mcp_daemon.socket_error');
+        process.exit(1);
+    });
+    // Graceful shutdown
+    const shutdown = async (signal) => {
+        logger.info({ signal }, 'mcp_daemon.stopping');
+        server.close();
+        stopHealthMonitor();
+        await stopBatcher();
+        try {
+            fs.unlinkSync(socketPath);
+        }
+        catch { }
+        try {
+            fs.unlinkSync(PID_FILE);
+        }
+        catch { }
+        logger.info('mcp_daemon.stopped');
+        process.exit(0);
+    };
+    process.on('SIGTERM', () => { void shutdown('SIGTERM'); });
+    process.on('SIGINT', () => { void shutdown('SIGINT'); });
+}
+void main();
+//# sourceMappingURL=index.js.map

package/dist/daemon/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/daemon/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAErE,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AAEtE,SAAS,SAAS,CAAC,GAAW;IAC5B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAEpE,8DAA8D;IAC9D,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEnC,2BAA2B;IAC3B,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAE1C,iBAAiB;IACjB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,mBAAmB;IACnB,YAAY,EAAE,CAAA;IACd,kBAAkB,EAAE,CAAA;IAEpB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;QAC7B,gCAAgC;QAChC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAA;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,iBAAiB,EAAE,CAAA;QACnB,MAAM,WAAW,EAAE,CAAA;QACnB,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAC1C,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAAI,MAAM,CAAC,CAAA,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,IAAI,EAAE,CAAA"}