@intutic/mcp-governance-proxy 1.10.0 → 2.0.0

package/dist/daemon/index.js

@@ -12,12 +12,19 @@
  *
  * @module
  */
+// Must be first: OTel instrumentation needs to monkey-patch before other
+// modules import the libraries it instruments. No-op unless
+// OTEL_EXPORTER_OTLP_ENDPOINT is set. Deliberately not imported by
+// src/index.ts (the stdio JSON-RPC proxy) -- see instrumentation.ts's
+// own doc comment for why.
+import './instrumentation.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { startBatcher, stopBatcher } from './telemetryBatcher.js';
 import { startHealthMonitor, stopHealthMonitor } from './healthMonitor.js';
+import { startStatusReporter, stopStatusReporter } from './statusReporter.js';
 import { createSocketServer, getSocketPath } from './socketServer.js';
 const logger = createLogger('intutic-mcp-daemon');
 const PID_FILE = path.join(os.homedir(), '.intutic', 'mcp-daemon.pid');
@@ -27,25 +34,58 @@ function ensureDir(dir) {
 async function main() {
     const socketPath = getSocketPath();
     logger.info({ pid: process.pid, socketPath }, 'mcp_daemon.starting');
-    // Ensure ~/.intutic directory exists with correct permissions
+    // Ensure the socket's own directory exists with correct permissions. This is
+    // ~/.intutic only by default: MCP_DAEMON_SOCKET (honoured by getSocketPath())
+    // can put the socket anywhere, so this call says nothing about where the PID
+    // file lives. The PID file's directory is ensured separately below.
     ensureDir(path.dirname(socketPath));
     // Remove stale socket file
     try {
         fs.unlinkSync(socketPath);
     }
-    catch { }
-    // Write PID file
+    catch {
+        // ENOENT — no socket left by a previous run. That is the normal clean
+        // start, so there is nothing to report. A removal failure for any other
+        // reason is not actually swallowed: listen() below then fails with
+        // EADDRINUSE and the server 'error' handler exits the process.
+    }
+    // Write PID file. PID_FILE always lives under ~/.intutic, which is a
+    // different directory from the socket's whenever MCP_DAEMON_SOCKET is set —
+    // so it needs its own ensureDir, or this write is an ENOENT out of main().
+    ensureDir(path.dirname(PID_FILE));
     fs.writeFileSync(PID_FILE, String(process.pid), { mode: 0o600 });
+    // Seed the policy cache from the local snapshot before accepting connections.
+    //
+    // Without it the first tool call after every daemon restart pays a blocking
+    // HTTP GET with a 5s socket timeout, on the agent's critical path. The sync
+    // daemon has already written the same policy locally.
+    //
+    // Awaited rather than fired-and-forgotten so the seed is in place before the
+    // socket accepts anything — a race here would just reintroduce the cold fetch
+    // it exists to remove. It never throws and never blocks on the network; a
+    // missing snapshot returns null and the cold path stands.
+    const { seedFromSnapshot } = await import('./policyCache.js');
+    const seeded = await seedFromSnapshot();
+    if (seeded)
+        logger.info({ workspaceId: seeded }, 'mcp_daemon.policy_seeded');
     // Start subsystems
     startBatcher();
     startHealthMonitor();
+    startStatusReporter();
     const server = createSocketServer();
     server.listen(socketPath, () => {
         // Restrict socket to owner only
         try {
             fs.chmodSync(socketPath, 0o600);
         }
-        catch { }
+        catch (err) {
+            // Platforms without unix-socket file permissions (Windows named pipes)
+            // fail here, so this must not be fatal. It is still worth surfacing:
+            // ensureDir() only applies mode 0o700 when it creates ~/.intutic, so on
+            // a pre-existing looser directory this chmod is the only thing keeping
+            // the control socket owner-only.
+            logger.warn({ err, socketPath }, 'mcp_daemon.socket_chmod_failed');
+        }
         logger.info({ socketPath, pid: process.pid }, 'mcp_daemon.running');
         process.stdout.write(JSON.stringify({ event: 'mcp_daemon.started', pid: process.pid }) + '\n');
     });
@@ -58,20 +98,49 @@ async function main() {
         logger.info({ signal }, 'mcp_daemon.stopping');
         server.close();
         stopHealthMonitor();
+        await stopStatusReporter();
         await stopBatcher();
+        // Best-effort cleanup: both files are routinely already gone (ENOENT) when
+        // an operator or a service manager removed them, or when listen() never
+        // got far enough to create the socket. The process is exiting either way,
+        // and a leftover file is handled by the stale-socket unlink on next start.
         try {
             fs.unlinkSync(socketPath);
         }
-        catch { }
+        catch {
+            // socket already removed or never created — nothing to clean up
+        }
         try {
             fs.unlinkSync(PID_FILE);
         }
-        catch { }
+        catch {
+            // pid file already removed or never written — nothing to clean up
+        }
         logger.info('mcp_daemon.stopped');
         process.exit(0);
     };
-    process.on('SIGTERM', () => { void shutdown('SIGTERM'); });
-    process.on('SIGINT', () => { void shutdown('SIGINT'); });
+    // Same reasoning as the main().catch below: shutdown() ends in process.exit,
+    // so a rejection on the way there leaves the daemon alive and unresponsive
+    // until the service manager escalates to SIGKILL. Exit non-zero instead.
+    const onSignal = (signal) => {
+        void shutdown(signal).catch((err) => {
+            logger.error({ err, signal }, 'mcp_daemon.shutdown_failed');
+            process.exit(1);
+        });
+    };
+    process.on('SIGTERM', () => { onSignal('SIGTERM'); });
+    process.on('SIGINT', () => { onSignal('SIGINT'); });
 }
-void main();
+// main() is the whole of startup, and everything it does before listen() —
+// ensureDir, the PID write, subsystem start — can throw. Without a handler
+// those were an unhandled rejection, which under Node's default mode prints a
+// raw V8 stack to stderr and exits 1: the exit status is fine, but nothing goes
+// through the structured logger, so the failure carries no mcp_daemon.* event
+// for a log pipeline to alert on and no socketPath to point at the cause. Under
+// --unhandled-rejections=warn it is worse — the process stays up as a daemon
+// that will never listen. Both become one logged event and a definite exit.
+main().catch((err) => {
+    logger.error({ err }, 'mcp_daemon.startup_failed');
+    process.exit(1);
+});
 //# sourceMappingURL=index.js.map

package/dist/daemon/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/daemon/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAErE,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AAEtE,SAAS,SAAS,CAAC,GAAW;IAC5B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAEpE,8DAA8D;IAC9D,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEnC,2BAA2B;IAC3B,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAE1C,iBAAiB;IACjB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,mBAAmB;IACnB,YAAY,EAAE,CAAA;IACd,kBAAkB,EAAE,CAAA;IAEpB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;QAC7B,gCAAgC;QAChC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAA;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,iBAAiB,EAAE,CAAA;QACnB,MAAM,WAAW,EAAE,CAAA;QACnB,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAC1C,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAAI,MAAM,CAAC,CAAA,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACzD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,IAAI,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/daemon/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,yEAAyE;AACzE,4DAA4D;AAC5D,mEAAmE;AACnE,sEAAsE;AACtE,2BAA2B;AAC3B,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAErE,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AAEtE,SAAS,SAAS,CAAC,GAAW;IAC5B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAEpE,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,oEAAoE;IACpE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEnC,2BAA2B;IAC3B,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,+DAA+D;IACjE,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,2EAA2E;IAC3E,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,8EAA8E;IAC9E,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACvC,IAAI,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAA;IAE5E,mBAAmB;IACnB,YAAY,EAAE,CAAA;IACd,kBAAkB,EAAE,CAAA;IACpB,mBAAmB,EAAE,CAAA;IAErB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;QAC7B,gCAAgC;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,iCAAiC;YACjC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,gCAAgC,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAA;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,iBAAiB,EAAE,CAAA;QACnB,MAAM,kBAAkB,EAAE,CAAA;QAC1B,MAAM,WAAW,EAAE,CAAA;QACnB,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAA;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACpD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/daemon/instrumentation.d.ts

@@ -0,0 +1,20 @@
+/**
+ * OpenTelemetry Code-Level Instrumentation — mcp-daemon only.
+ *
+ * Same pattern as gateway-daemon/src/instrumentation.ts and
+ * services/control-plane/src/instrumentation.ts. Deliberately NOT imported
+ * by src/index.ts (the `intutic-mcp-proxy` stdio JSON-RPC proxy) -- that
+ * process reserves stdout exclusively for protocol frames, and
+ * auto-instrumentations-node's console/process patching is not a risk worth
+ * taking on that channel. This file only instruments `intutic-mcp-daemon`
+ * (daemon/index.ts), the long-lived companion process that already owns its
+ * own telemetryBatcher.ts and talks to the control plane over a Unix socket,
+ * not stdio.
+ *
+ * Opt-in only -- off unless OTEL_EXPORTER_OTLP_ENDPOINT is set.
+ *
+ * Must be imported at the very top of daemon/index.ts, before other
+ * modules, to allow monkey-patching.
+ */
+export {};
+//# sourceMappingURL=instrumentation.d.ts.map

package/dist/daemon/instrumentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/daemon/instrumentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/daemon/instrumentation.js

@@ -0,0 +1,61 @@
+/**
+ * OpenTelemetry Code-Level Instrumentation — mcp-daemon only.
+ *
+ * Same pattern as gateway-daemon/src/instrumentation.ts and
+ * services/control-plane/src/instrumentation.ts. Deliberately NOT imported
+ * by src/index.ts (the `intutic-mcp-proxy` stdio JSON-RPC proxy) -- that
+ * process reserves stdout exclusively for protocol frames, and
+ * auto-instrumentations-node's console/process patching is not a risk worth
+ * taking on that channel. This file only instruments `intutic-mcp-daemon`
+ * (daemon/index.ts), the long-lived companion process that already owns its
+ * own telemetryBatcher.ts and talks to the control plane over a Unix socket,
+ * not stdio.
+ *
+ * Opt-in only -- off unless OTEL_EXPORTER_OTLP_ENDPOINT is set.
+ *
+ * Must be imported at the very top of daemon/index.ts, before other
+ * modules, to allow monkey-patching.
+ */
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
+import { OTLPMetricExporter } from '@opentelemetry/exporter-metrics-otlp-http';
+import { PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { ATTR_SERVICE_NAME } from '@opentelemetry/semantic-conventions';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('instrumentation');
+const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT ?? 'http://localhost:4318/v1/traces';
+const serviceName = process.env.OTEL_SERVICE_NAME ?? 'mcp-daemon';
+// The env var may name either the collector base or the full traces path;
+// derive the base once so traces and metrics land on their own signal paths.
+const base = endpoint.replace(/\/v1\/traces$/, '');
+const traceExporter = new OTLPTraceExporter({
+    url: `${base}/v1/traces`,
+});
+const sdk = new NodeSDK({
+    resource: resourceFromAttributes({
+        [ATTR_SERVICE_NAME]: serviceName,
+    }),
+    traceExporter,
+    metricReader: new PeriodicExportingMetricReader({
+        exporter: new OTLPMetricExporter({ url: `${base}/v1/metrics` }),
+    }),
+    instrumentations: [
+        getNodeAutoInstrumentations({
+            '@opentelemetry/instrumentation-fs': {
+                enabled: false,
+            },
+        }),
+    ],
+});
+if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+    sdk.start();
+    log.info({ action: 'otel_init', serviceName, endpoint }, 'Tracing SDK initialized');
+}
+process.on('SIGTERM', () => {
+    sdk.shutdown()
+        .then(() => log.info({ action: 'otel_shutdown' }, 'Tracing SDK terminated gracefully'))
+        .catch((err) => log.error({ err, action: 'otel_shutdown_failed' }, 'Error terminating Tracing SDK'));
+});
+//# sourceMappingURL=instrumentation.js.map

package/dist/daemon/instrumentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../src/daemon/instrumentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,iCAAiC,CAAA;AAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,YAAY,CAAA;AAEjE,0EAA0E;AAC1E,6EAA6E;AAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AAElD,MAAM,aAAa,GAAG,IAAI,iBAAiB,CAAC;IAC1C,GAAG,EAAE,GAAG,IAAI,YAAY;CACzB,CAAC,CAAA;AAEF,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;IACtB,QAAQ,EAAE,sBAAsB,CAAC;QAC/B,CAAC,iBAAiB,CAAC,EAAE,WAAW;KACjC,CAAC;IACF,aAAa;IACb,YAAY,EAAE,IAAI,6BAA6B,CAAC;QAC9C,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;KAChE,CAAC;IACF,gBAAgB,EAAE;QAChB,2BAA2B,CAAC;YAC1B,mCAAmC,EAAE;gBACnC,OAAO,EAAE,KAAK;aACf;SACF,CAAC;KACH;CACF,CAAC,CAAA;AAEF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAC5C,GAAG,CAAC,KAAK,EAAE,CAAA;IACX,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAA;AACrF,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,GAAG,CAAC,QAAQ,EAAE;SACX,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAC;SACtF,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAA;AACjH,CAAC,CAAC,CAAA"}

package/dist/daemon/policyCache.d.ts

@@ -3,8 +3,91 @@ export interface ResolvedPolicy {
     sopRules: Record<string, unknown>[];
     dlpPatterns: string[];
     interventionMode: string;
+    /**
+     * Additive MCP tool allowlist; empty means unrestricted. Was silently
+     * absent from `GET /api/v1/policy/resolve` (the daemon-mode source of this
+     * type) until `lib/mcpCuration.ts` on the control plane started serving it
+     * from the same place `GET /api/v1/sop/rules` (non-daemon mode) always
+     * has. Always normalized to `[]` rather than left `undefined` here — a
+     * stale Valkey/LRU entry or snapshot written before this field existed
+     * must not read as "curation absent" one layer up.
+     */
+    allowedTools: string[];
+    /** Operator-curated tool descriptions, applied to tools/list responses. */
+    toolDescriptionOverrides: Record<string, string>;
+    /** Additive MCP server allowlist; empty means unrestricted. Same source
+     *  and same backward-compat treatment as `allowedTools` above. */
+    allowedServers: string[];
+    /**
+     * Prompt-injection disposition override (`packages/mcp-proxy/src/injection.ts`).
+     * `undefined` when the control plane has not sent this field yet — read the
+     * same way as every other optional curation field here: absent must mean
+     * "no override, use the package's own env-derived default"
+     * (`PolicyClient.getInjectionAction`, `../policy.ts`), never "warn" by
+     * silent default at this layer, so an old snapshot/cache entry from before
+     * this field existed reads correctly as absent rather than as an explicit
+     * value.
+     */
+    mcpInjectionAction?: 'warn' | 'block';
+    /** Workspace injection-pattern sources (TD-436); normalized to `[]` like `allowedTools`. */
+    mcpInjectionPatterns: string[];
+    /**
+     * Anomaly-detection mode override (Phase 2, `packages/mcp-proxy/src/anomaly/`).
+     * `undefined` means absent — same convention as `mcpInjectionAction` above.
+     */
+    mcpAnomalyMode?: 'enforce' | 'warn' | 'off';
+    /**
+     * Per-detector disposition overrides. Always an object, never `undefined`
+     * — an absent field normalizes to `{}` (no overrides) the same way
+     * `toolDescriptionOverrides` above does, since "absent" and "explicitly
+     * empty" mean the same thing for an override map.
+     */
+    mcpAnomalyOverrides: Record<string, 'steer' | 'reask' | 'kill' | 'off'>;
     cachedAt: number;
+    /**
+     * The workspace's `v2:sync:config_version` at fetch time (TD-474 item 5).
+     * A guardrail promote/retire bumps it; a fresh LRU hit whose version no
+     * longer matches refetches instead of waiting out the TTL. Absent when
+     * Valkey could not be read — then the TTL is the floor, as before.
+     */
+    configVersion?: number;
 }
+/**
+ * Seeds the LRU from the policy snapshot the sync daemon writes locally.
+ *
+ * # What this removes
+ *
+ * `resolvePolicy`'s cold path is a blocking HTTP GET with a 5s socket timeout,
+ * taken on the daemon's first request for a workspace after every restart. The
+ * sync daemon already writes the same policy to
+ * `~/.intutic/hooks/policy-snapshot.json` every cycle, so on the machine's own
+ * workspace that round trip is avoidable.
+ *
+ * # Two things that make the obvious version wrong
+ *
+ * **It reads `sopRules`, not `rules`.** The snapshot carries both. `rules` is the
+ * *gate* projection — patterns rewritten as space-padded EREs, `{source,
+ * severity, subject}`, `warn` rules already dropped. Those pass this module's
+ * `parsePolicyResponse` (it only checks that entries are objects) and are then
+ * rejected wholesale by `isSopRule` in `../policy.ts`, which requires
+ * `toolPattern` and `action`. The result would be a cache that reports entries,
+ * logs nothing above `debug`, and enforces **nothing** — strictly worse than the
+ * blocking fetch, and invisible.
+ *
+ * **`cachedAt` comes from the snapshot, not from now.** Stamping `Date.now()` on
+ * a file written days ago (the sync daemon may be stopped — the snapshot writer
+ * anticipates exactly that) would present stale policy as fresh and suppress the
+ * refresh for a full TTL. Carrying the real write time means a stale snapshot
+ * seeds the cache *and* is immediately recognised as stale, so the first request
+ * returns instantly and triggers a background refresh — which is the actual goal.
+ *
+ * Never throws. This runs inside the daemon's `main()`, whose rejections become
+ * `process.exit(1)`, and the daemon is a KeepAlive LaunchAgent — so a throw here
+ * would be a restart loop rather than an error.
+ *
+ * @returns the workspaceId seeded, or null if nothing usable was found.
+ */
+export declare function seedFromSnapshot(snapshotPath?: string): Promise<string | null>;
 /**
  * Resolves policy for a workspace.
  * Order: LRU (fresh) → LRU (stale, triggers async refresh) → Valkey → HTTP fetch

package/dist/daemon/policyCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policyCache.d.ts","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAI,MAAM,CAAA;IACrB,QAAQ,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACxC,WAAW,EAAI,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAO,MAAM,CAAA;CACtB;AA0CD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA+CvF;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,gCAAgC;AAChC,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEpE"}
+{"version":3,"file":"policyCache.d.ts","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAI,MAAM,CAAA;IACrB,QAAQ,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACxC,WAAW,EAAI,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2EAA2E;IAC3E,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD;sEACkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,4FAA4F;IAC5F,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC3C;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAA;IACvE,QAAQ,EAAO,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAqMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgEpF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAmGvF;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,gCAAgC;AAChC,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEpE"}