@intutic/shared-types 2.4.0 → 2.5.1

package/dist/taskManagement.d.ts

@@ -1,14 +1,14 @@
 /**
- * Task Management Adapter — Generic interface for external task/issue trackers.
+ * Task Management Adapter — read-only interface over external task trackers
+ * and incident tools.
  *
- * Provides a unified abstraction over external task management tools
- * (Jira, Linear, GitHub Issues, etc.) so the control plane can
- * create/update tasks based on governance events.
+ * The control plane reads tickets (Jira, Linear) and incidents (PagerDuty) to
+ * attach task context to agent sessions. It does not create or update them.
  *
  * @module
  */
-/** Supported task management providers. */
-export type TaskProvider = 'jira' | 'linear' | 'github' | 'asana' | 'pagerduty';
+/** Providers with a registered adapter. */
+export type TaskProvider = 'jira' | 'pagerduty' | 'linear';
 /** Priority levels mapped across providers. */
 export type TaskPriority = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
 /** Task status (normalized across providers). */
@@ -20,62 +20,17 @@ export interface TaskProviderCredentials {
     baseUrl: string;
     /** Authentication token or API key. */
     authToken: string;
-    /** Project or board identifier within the provider. */
+    /** Project, team or routing key within the provider. */
     projectKey: string;
+    /**
+     * Jira Cloud only: the email of the Atlassian account the API token belongs
+     * to. Jira Cloud authenticates an API token as Basic `email:token`. A
+     * connection stores it as `metadata.accountEmail`.
+     */
+    accountEmail?: string;
     /** Additional provider-specific config. */
     metadata?: Record<string, unknown>;
 }
-/** Payload for creating a new task. */
-export interface CreateTaskPayload {
-    /** Human-readable task title. */
-    title: string;
-    /** Markdown description of the task. */
-    description: string;
-    /** Normalized priority. */
-    priority: TaskPriority;
-    /** Intutic-specific labels for categorization. */
-    labels?: string[];
-    /** Assignee identifier (provider-specific). */
-    assigneeId?: string;
-    /** Link back to the Intutic governance event. */
-    intuticLink?: {
-        /** Type of governance event that created this task. */
-        eventType: 'INCIDENT' | 'ANOMALY' | 'SOP_REVIEW' | 'COMPLIANCE';
-        /** ID of the governance event. */
-        eventId: string;
-        /** Workspace this event belongs to. */
-        workspaceId: string;
-    };
-}
-/** Result of creating a task in the external system. */
-export interface CreateTaskResult {
-    /** Whether the task was successfully created. */
-    success: boolean;
-    /** External task ID (e.g., Jira issue key like "PROJ-123"). */
-    externalTaskId?: string;
-    /** URL to the task in the external system. */
-    externalUrl?: string;
-    /** Error message if creation failed. */
-    error?: string;
-}
-/** Payload for updating an existing task. */
-export interface UpdateTaskPayload {
-    /** External task ID to update. */
-    externalTaskId: string;
-    /** New status (optional). */
-    status?: TaskStatus;
-    /** Comment to add (optional). */
-    comment?: string;
-    /** Updated priority (optional). */
-    priority?: TaskPriority;
-    /** Additional fields (provider-specific). */
-    fields?: Record<string, unknown>;
-}
-/** Result of updating a task. */
-export interface UpdateTaskResult {
-    success: boolean;
-    error?: string;
-}
 /** A task as retrieved from the external system. */
 export interface ExternalTask {
     externalTaskId: string;
@@ -90,13 +45,22 @@ export interface ExternalTask {
     sprint?: string;
     epic?: string;
 }
+/** Filters for `TaskManagementAdapter.searchTasks`. */
+export interface TaskSearchFilters {
+    status?: TaskStatus;
+    priority?: TaskPriority;
+    labels?: string[];
+    /**
+     * The provider's own id for the assignee. An adapter must apply it: a search
+     * for one person's work that comes back with everyone's is worse than none.
+     */
+    assigneeId?: string;
+}
 /**
  * Generic task management adapter interface.
  *
- * Implementations of this interface connect Intutic's governance engine
- * to external task management tools. The control plane calls these methods
- * when governance events (incidents, anomalies, SOP reviews) require
- * external task creation or updates.
+ * Implementations read from an external tracker so the control plane can
+ * resolve which ticket or incident an agent session is working on.
  */
 export interface TaskManagementAdapter {
     /** Provider name for this adapter. */
@@ -106,18 +70,6 @@ export interface TaskManagementAdapter {
      * @returns true if the connection is healthy
      */
     testConnection(): Promise<boolean>;
-    /**
-     * Create a new task in the external system.
-     * @param payload - Task creation payload
-     * @returns Result with external task ID and URL
-     */
-    createTask(payload: CreateTaskPayload): Promise<CreateTaskResult>;
-    /**
-     * Update an existing task in the external system.
-     * @param payload - Task update payload
-     * @returns Result indicating success/failure
-     */
-    updateTask(payload: UpdateTaskPayload): Promise<UpdateTaskResult>;
     /**
      * Retrieve a task by its external ID.
      * @param externalTaskId - The external system's task identifier
@@ -125,15 +77,15 @@ export interface TaskManagementAdapter {
      */
     getTask(externalTaskId: string): Promise<ExternalTask | null>;
     /**
-     * Search for tasks matching Intutic criteria.
-     * @param workspaceId - Intutic workspace ID to filter by
-     * @param filters - Optional filters (status, priority, labels)
+     * Search for open tasks.
+     *
+     * Rejects when the provider cannot be asked (unreachable, refused, timed
+     * out), so a caller can tell "nothing open" from "could not ask".
+     *
+     * @param workspaceId - Intutic workspace ID, for logging
+     * @param filters - Optional filters (status, priority, labels, assignee)
      * @returns List of matching external tasks
      */
-    searchTasks(workspaceId: string, filters?: {
-        status?: TaskStatus;
-        priority?: TaskPriority;
-        labels?: string[];
-    }): Promise<ExternalTask[]>;
+    searchTasks(workspaceId: string, filters?: TaskSearchFilters): Promise<ExternalTask[]>;
 }
 //# sourceMappingURL=taskManagement.d.ts.map

package/dist/taskManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE/E,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,QAAQ,EAAE,YAAY,CAAA;IACtB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE;QACZ,uDAAuD;QACvD,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAA;QAC/D,kCAAkC;QAClC,OAAO,EAAE,MAAM,CAAA;QACf,uCAAuC;QACvC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAEjE;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5E,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3B"}
+{"version":3,"file":"taskManagement.d.ts","sourceRoot":"","sources":["../src/taskManagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEvE,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAA;IACtB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAE/B;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAElC;;;;OAIG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAE7D;;;;;;;;;OASG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CACvF"}

package/dist/taskManagement.js

@@ -1,10 +1,10 @@
 "use strict";
 /**
- * Task Management Adapter — Generic interface for external task/issue trackers.
+ * Task Management Adapter — read-only interface over external task trackers
+ * and incident tools.
  *
- * Provides a unified abstraction over external task management tools
- * (Jira, Linear, GitHub Issues, etc.) so the control plane can
- * create/update tasks based on governance events.
+ * The control plane reads tickets (Jira, Linear) and incidents (PagerDuty) to
+ * attach task context to agent sessions. It does not create or update them.
  *
  * @module
  */

package/dist/toolPoison.d.ts

@@ -2,7 +2,7 @@
  * toolPoison.ts — Tool-description poisoning patterns.
  *
  * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
- * function and its seven named patterns. This is a SEPARATE pattern set from
+ * function and its named patterns. This is a SEPARATE pattern set from
  * the MCP proxy's `injection.ts`, on purpose: `tool_poison.rs`'s own module
  * doc records that it tried reusing `injection::scan` for this and measured
  * that its five patterns match ZERO of the tool-poisoning payloads — they are
@@ -21,10 +21,23 @@
  * module's own `gating_never_changes_a_verdict` test), and the volume of tool
  * descriptions scanned here is orders of magnitude below the Rust proxy's
  * request path. The pattern SOURCE TEXT below is unchanged from the Rust
- * `PATTERNS` array.
+ * `PATTERNS` array, `/` escaped as `\/` for a regex literal;
+ * `__tests__/toolPoison.test.ts` reads the Rust file and holds the two equal.
  *
  @module
  */
+export interface ToolPoisonPattern {
+    name: string;
+    regex: RegExp;
+}
+/**
+ * Ported verbatim from `tool_poison.rs`'s `PATTERNS` const. All bounded
+ * repetitions here are small fixed-width gaps (`{0,40}`, `{0,60}`, `{0,80}`)
+ * over a handful of alternations — the same "no wide bounded repetition, no
+ * RegexSet performance regression" shape the MCP proxy's `injection.ts` documents, not the
+ * `dlp.rs` shape that regressed.
+ */
+export declare const TOOL_POISON_PATTERNS: readonly ToolPoisonPattern[];
 /**
  * Pattern names matching this tool description, deduplicated, empty when it
  * looks like ordinary prose (the overwhelmingly common case).

package/dist/toolPoison.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolPoison.d.ts","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAkDH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE"}
+{"version":3,"file":"toolPoison.d.ts","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EA2C5D,CAAA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE"}

package/dist/toolPoison.js

@@ -3,7 +3,7 @@
  * toolPoison.ts — Tool-description poisoning patterns.
  *
  * Direct TypeScript port of `packages/proxy/src/tool_poison.rs`'s `scan`
- * function and its seven named patterns. This is a SEPARATE pattern set from
+ * function and its named patterns. This is a SEPARATE pattern set from
  * the MCP proxy's `injection.ts`, on purpose: `tool_poison.rs`'s own module
  * doc records that it tried reusing `injection::scan` for this and measured
  * that its five patterns match ZERO of the tool-poisoning payloads — they are
@@ -22,11 +22,13 @@
  * module's own `gating_never_changes_a_verdict` test), and the volume of tool
  * descriptions scanned here is orders of magnitude below the Rust proxy's
  * request path. The pattern SOURCE TEXT below is unchanged from the Rust
- * `PATTERNS` array.
+ * `PATTERNS` array, `/` escaped as `\/` for a regex literal;
+ * `__tests__/toolPoison.test.ts` reads the Rust file and holds the two equal.
  *
  @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOL_POISON_PATTERNS = void 0;
 exports.scanToolDescription = scanToolDescription;
 /**
  * Ported verbatim from `tool_poison.rs`'s `PATTERNS` const. All bounded
@@ -35,7 +37,7 @@ exports.scanToolDescription = scanToolDescription;
  * RegexSet performance regression" shape the MCP proxy's `injection.ts` documents, not the
  * `dlp.rs` shape that regressed.
  */
-const PATTERNS = [
+exports.TOOL_POISON_PATTERNS = [
     {
         name: 'hidden-instruction-block',
         regex: /<\s*(important|secret|system|hidden|instructions?)\s*>/i,
@@ -67,6 +69,14 @@ const PATTERNS = [
         name: 'tool-scoped-instruction-override',
         regex: /\b(ignore|disregard|override)\b[^.!?]{0,40}\b(other\s+tools?|previous\s+tools?|system\s+prompt)\b/i,
     },
+    {
+        // An order to run a command that destroys the machine or its data: a
+        // recursive delete of the filesystem root or the home directory (never a
+        // path below either), formatting or raw-writing a block device, dropping a
+        // database, piping a download into a shell, a fork bomb.
+        name: 'destructive-command-instruction',
+        regex: /\b(run|execute|exec|invoke|issue|type|enter|paste)\b[^.!?]{0,40}(\brm\s+-[a-z-]*[rf][a-z-]*\s+(-\S+\s+){0,4}["'`]?(\/\*?|~\/?\*?|\$\{?home\}?\/?\*?)(["'`;&|)\s]|$)|\bmkfs\b|\bdd\s[^.!?]{0,60}\bof=\/dev\/|\bdrop\s+(database|schema)\b|\b(curl|wget)\s[^|\n]{0,120}\|\s*(sudo\s+)?(ba|z|da|k)?sh\b|:\(\)\s*\{\s*:\s*\|\s*:)/i,
+    },
 ];
 /**
  * Pattern names matching this tool description, deduplicated, empty when it
@@ -76,7 +86,7 @@ function scanToolDescription(description) {
     if (!description)
         return [];
     const found = [];
-    for (const { name, regex } of PATTERNS) {
+    for (const { name, regex } of exports.TOOL_POISON_PATTERNS) {
         if (regex.test(description))
             found.push(name);
     }

package/dist/toolPoison.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolPoison.js","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAsDH,kDAOC;AAtDD;;;;;;GAMG;AACH,MAAM,QAAQ,GAAiC;IAC7C;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,kJAAkJ;KACrJ;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,oKAAoK;KACvK;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,qEAAqE;QACrE,iEAAiE;QACjE,sDAAsD;QACtD,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,kHAAkH;KAC1H;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,oGAAoG;KAC5G;CACF,CAAA;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"toolPoison.js","sourceRoot":"","sources":["../src/toolPoison.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AA+DH,kDAOC;AA/DD;;;;;;GAMG;AACU,QAAA,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,kJAAkJ;KACrJ;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,oKAAoK;KACvK;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,qEAAqE;QACrE,iEAAiE;QACjE,sDAAsD;QACtD,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,kHAAkH;KAC1H;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,oGAAoG;KAC5G;IACD;QACE,qEAAqE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,EAAE,iCAAiC;QACvC,KAAK,EACH,gUAAgU;KACnU;CACF,CAAA;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,4BAAoB,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/workspaceSettings.d.ts

@@ -14,6 +14,7 @@ import type { SsoGroupPolicy } from './attenuation.js';
 import type { McpBudgetSettings } from './mcpBudgets.js';
 import type { PiiDetectorSettings } from './piiDetectors.js';
 import type { UpstreamRetrySettings } from './upstreamRetry.js';
+import type { InterventionMode } from './policy.js';
 export type { McpProxyFailBehavior, McpProxyMode, BypassEnforcementTier };
 /**
  * The MCP governance proxy's anomaly detectors, by id. The proxy's own
@@ -93,6 +94,17 @@ export interface WorkspaceSettings {
      * in a settings write clears it, and is never stored.
      */
     piiDetectors?: PiiDetectorSettings | null;
+    /**
+     * Keep tool-call argument values in the sampled replay contexts the LLM
+     * proxy attaches to traces (`context_snapshot`, `WASM_CONTEXT_SNAPSHOT_RATE`).
+     * Absent or `false`, the default: each call keeps its name and its
+     * arguments' top-level keys and size, never their values. `true`: the
+     * values are kept, with secrets, card numbers, IBANs, SSNs, email addresses
+     * and phone numbers redacted, so `POST /api/v1/wasm-rules/:id/replay` can
+     * replay a rule that reads `tool_calls[].arguments`. The proxy reads it from
+     * `/api/v1/auth/key-context`.
+     */
+    storeToolArguments?: boolean;
     /**
      * How the LLM proxy retries a provider call that failed before any response
      * reached the client, and the ordered fallback targets it tries when those
@@ -171,20 +183,11 @@ export interface WorkspaceSettings {
          *
          * Declaring it here is not enough on its own — the PUT schema in
          * `routes/workspace.ts` must list it too, because that `z.object` strips
-         * unknown keys. `ff_metaclaw_evolution` above was declared here and omitted
-         * there, so it has never been settable either.
+         * unknown keys. This flag and `ff_metaclaw_evolution` above were both once
+         * declared here and omitted there, so neither could be stored until both
+         * were added to it.
          */
         ff_shadow_enforcement?: boolean;
-        /**
-         * Let a MetaClaw evolution proposal auto-apply instead of waiting for
-         * human review. Read directly off raw settings JSON by
-         * `promptEvolutionService.runEvolutionCycle` — no Valkey mirror, since
-         * nothing else needs a hot-path read of it.
-         *
-         * Also declared here without being settable until now — same "declared,
-         * never added to the PUT schema" bug as `ff_shadow_enforcement` above.
-         */
-        ff_metaclaw_auto_apply?: boolean;
         /**
          * Let a high-confidence SkillOpt config-edit suggestion auto-apply
          * instead of waiting for human review. Mirrored into Valkey
@@ -200,7 +203,7 @@ export interface WorkspaceSettings {
          * `buildSnapshotRules` (`services/sync-daemon/src/lib/policySnapshot.ts`)
          * applies it as a per-rule override on the next sync cycle — independent
          * of `DESTRUCTIVE_TIER_SEVERITY`, the evidence-gated promotion ramp that
-         * governs the OTHER six `DESTRUCTIVE_COMMAND_PATTERNS` entries.
+         * governs the eight block-severity `DESTRUCTIVE_COMMAND_PATTERNS` entries.
          * `destructive.sql_drop` was never part of that ramp (its own static
          * definition is `severity: 'warn'`, not `'block'`, so the ramp's ternary
          * never reaches it) — its rationale is a genuinely different one
@@ -210,7 +213,7 @@ export interface WorkspaceSettings {
          * MCP path anyway, accepting the dev-DSN false-positive risk explicitly.
          * `false` by default; `true` in the `strict` security posture preset
          * (`posturePresets.ts`) — never auto-promoted by traffic evidence the
-         * way the six-pattern ramp is.
+         * way the block-pattern ramp is.
          */
         ff_sql_drop_strict_block?: boolean;
     };
@@ -516,6 +519,22 @@ export interface WorkspaceSettings {
      * enforcement actually runs under.
      */
     trajectory_monitor_mode?: 'ACTIVE' | 'PASSIVE' | 'OFF';
+    /**
+     * What an agent is told when a call is refused on workspace policy, for the
+     * whole workspace: `TRANSPARENT` names the rule and its reason, `OPAQUE`
+     * refuses the same calls with one generic sentence while audit records keep
+     * the rule, and `SILENT_LOG` lets the local hook gates run a call a workspace
+     * rule would block and report it as `tool_would_block`.
+     *
+     * Every surface resolves it through
+     * `services/control-plane/src/lib/interventionMode.ts`: the stored value
+     * when there is one. Until 2.6.0, a workspace that has not stored it falls
+     * back to the deprecated rule — the mode of its active enforcement policy
+     * with the lowest priority — and migration 234 wrote that mode here for
+     * every workspace that had an active policy. The default matches what the
+     * fallback gives a workspace with no policy.
+     */
+    interventionMode?: InterventionMode;
     /**
      * Additive MCP tool allowlist, enforced by the MCP governance proxy
      * (`packages/mcp-proxy`) and served to it by

package/dist/workspaceSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceSettings.d.ts","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAG/D,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,uJAQ3B,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5E;;;;;;GAMG;AACH,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,GAAG,IAAI,GAAG,UAAU,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,sBAAsB,EAAE,OAAO,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IAExC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEzC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAA;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;;;;;;;;;;;;;OAcG;IACH,YAAY,EAAE,YAAY,CAAA;IAE1B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B;;;;WAIG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAA;QACjC,0BAA0B,CAAC,EAAE,OAAO,CAAA;QACpC,mEAAmE;QACnE,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;;;;WAQG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;;;;WAQG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;;WAKG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;;;;;;;;;;;;;;;;WAmBG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;KACnC,CAAA;IAGD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;;;;;;;OAkBG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAElC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;KACrB,CAAA;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,2DAA2D;QAC3D,aAAa,CAAC,EAAE,OAAO,CAAA;QACvB,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC5B,kFAAkF;QAClF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1C,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;KAChD,CAAA;IAED;;;;;;;;;;;;;;OAcG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAEnC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE;QACZ,uBAAuB,CAAC,EAAE,OAAO,CAAA;KAClC,CAAA;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;IAE1C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAEnC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAErC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAA;IAE/F;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAE9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAClC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAEpC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IAEzC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAErF;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,mBAAmB,CAAC,EAAE;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;QAC1B,yEAAyE;QACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KACtB,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,uBAAuB,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;IAEtD;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B;;;;;;;;;;;;;;;;OAgBG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,OAAO,CAAA;CACvC;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAuFxC,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,iBAAiB,CAKnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAIlF"}
+{"version":3,"file":"workspaceSettings.d.ts","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGnD,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,uJAQ3B,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5E;;;;;;GAMG;AACH,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,GAAG,IAAI,GAAG,UAAU,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,sBAAsB,EAAE,OAAO,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;IAExC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAEzC;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAA;IAE5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;;;;;;;;;;;;;OAcG;IACH,YAAY,EAAE,YAAY,CAAA;IAE1B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B;;;;WAIG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAA;QACjC,0BAA0B,CAAC,EAAE,OAAO,CAAA;QACpC,mEAAmE;QACnE,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;;;;;WASG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;WAKG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;;;;;;;;;;;;;;;;WAmBG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;KACnC,CAAA;IAGD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;;;;;;;OAkBG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAElC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;KACrB,CAAA;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,2DAA2D;QAC3D,aAAa,CAAC,EAAE,OAAO,CAAA;QACvB,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC5B,kFAAkF;QAClF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1C,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;KAChD,CAAA;IAED;;;;;;;;;;;;;;OAcG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAEnC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE;QACZ,uBAAuB,CAAC,EAAE,OAAO,CAAA;KAClC,CAAA;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;IAE1C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAEnC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAErC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAA;IAE/F;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAE9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAClC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAEpC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IAEzC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAErF;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,mBAAmB,CAAC,EAAE;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;QAC1B,yEAAyE;QACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KACtB,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,uBAAuB,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;IAEtD;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B;;;;;;;;;;;;;;;;OAgBG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,OAAO,CAAA;CACvC;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAyFxC,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,iBAAiB,CAKnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAIlF"}

package/dist/workspaceSettings.js

@@ -56,7 +56,6 @@ exports.DEFAULT_WORKSPACE_SETTINGS = {
         // Off by default, and the proxy resolves an absent flag to false as well —
         // an unreachable flag service must never silently disable enforcement.
         ff_shadow_enforcement: false,
-        ff_metaclaw_auto_apply: false,
         ff_skillopt_auto_apply: false,
         // Off by default — see the field doc. The `strict` security posture
         // preset turns it on; nothing else does.
@@ -101,6 +100,9 @@ exports.DEFAULT_WORKSPACE_SETTINGS = {
     // resolution only — a different value here would make the UI show a mode
     // enforcement does not actually run under. See the field doc.
     trajectory_monitor_mode: 'PASSIVE',
+    // What the resolver gives a workspace that has neither the setting nor an
+    // active enforcement policy. See the field doc.
+    interventionMode: 'TRANSPARENT',
     // Off by default — mirrors anomalyEnforcementService.ts's own DISABLED
     // default exactly, so a workspace that never configures this sees the
     // identical values whether resolved here or read directly from the DB.

package/dist/workspaceSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceSettings.js","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA4xBH,4DAOC;AAWD,wEAIC;AAvyBD;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,oBAAoB;IACpB,iBAAiB;IACjB,gBAAgB;IAChB,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACR,CAAA;AAgqBV;;;;GAIG;AACU,QAAA,0BAA0B,GAAsB;IAC3D,oBAAoB,EAAE,MAAM;IAC5B,sBAAsB,EAAE,IAAI;IAC5B,iFAAiF;IACjF,iFAAiF;IACjF,+EAA+E;IAC/E,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAU,aAAa;IACnC,qBAAqB,EAAE,SAAS;IAChC,YAAY,EAAE;QACZ,iBAAiB,EAAE,KAAK;QACxB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,KAAK;QACjC,qBAAqB,EAAE,KAAK;QAC5B,2EAA2E;QAC3E,uEAAuE;QACvE,qBAAqB,EAAE,KAAK;QAC5B,sBAAsB,EAAE,KAAK;QAC7B,sBAAsB,EAAE,KAAK;QAC7B,oEAAoE;QACpE,yCAAyC;QACzC,wBAAwB,EAAE,KAAK;KAChC;IACD,2BAA2B,EAAE,KAAK;IAClC,wEAAwE;IACxE,qEAAqE;IACrE,wBAAwB,EAAE,KAAK;IAC/B,uEAAuE;IACvE,wEAAwE;IACxE,4BAA4B,EAAE,KAAK;IACnC,cAAc,EAAE;QACd,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;QACjE,UAAU,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;QACrF,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACnD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;KAC9D;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,eAAe,EAAE;QACf,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,kBAAkB,EAAE,OAAO;KAC5B;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,uBAAuB,EAAE,KAAK;IAC9B,4EAA4E;IAC5E,wCAAwC;IACxC,0BAA0B,EAAE,EAAE;IAC9B,kEAAkE;IAClE,WAAW,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE;IAC/C,oEAAoE;IACpE,+BAA+B;IAC/B,mBAAmB,EAAE,KAAK;IAC1B,8DAA8D;IAC9D,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,8DAA8D;IAC9D,uBAAuB,EAAE,SAAS;IAClC,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE;QACnB,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,CAAC;QACb,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,EAAE;KACf;IACD,wEAAwE;IACxE,oEAAoE;IACpE,4BAA4B,EAAE,KAAK;IACnC,gEAAgE;IAChE,gBAAgB,EAAE,KAAK;IACvB,0EAA0E;IAC1E,6DAA6D;IAC7D,6BAA6B,EAAE,IAAI;IACnC,mEAAmE;IACnE,oEAAoE;IACpE,uBAAuB,EAAE,GAAG;CAC7B,CAAA;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CACtC,MAAqD;IAErD,OAAO;QACL,GAAG,kCAA0B;QAC7B,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;KAClB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,8BAA8B,CAAC,QAA2B;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,uBAAuB,CAAA;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC1F,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"workspaceSettings.js","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAmzBH,4DAOC;AAWD,wEAIC;AA7zBD;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,oBAAoB;IACpB,iBAAiB;IACjB,gBAAgB;IAChB,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACR,CAAA;AAorBV;;;;GAIG;AACU,QAAA,0BAA0B,GAAsB;IAC3D,oBAAoB,EAAE,MAAM;IAC5B,sBAAsB,EAAE,IAAI;IAC5B,iFAAiF;IACjF,iFAAiF;IACjF,+EAA+E;IAC/E,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAU,aAAa;IACnC,qBAAqB,EAAE,SAAS;IAChC,YAAY,EAAE;QACZ,iBAAiB,EAAE,KAAK;QACxB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,KAAK;QACjC,qBAAqB,EAAE,KAAK;QAC5B,2EAA2E;QAC3E,uEAAuE;QACvE,qBAAqB,EAAE,KAAK;QAC5B,sBAAsB,EAAE,KAAK;QAC7B,oEAAoE;QACpE,yCAAyC;QACzC,wBAAwB,EAAE,KAAK;KAChC;IACD,2BAA2B,EAAE,KAAK;IAClC,wEAAwE;IACxE,qEAAqE;IACrE,wBAAwB,EAAE,KAAK;IAC/B,uEAAuE;IACvE,wEAAwE;IACxE,4BAA4B,EAAE,KAAK;IACnC,cAAc,EAAE;QACd,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;QACjE,UAAU,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;QACrF,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QACnD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;KAC9D;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,eAAe,EAAE;QACf,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,kBAAkB,EAAE,OAAO;KAC5B;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,uBAAuB,EAAE,KAAK;IAC9B,4EAA4E;IAC5E,wCAAwC;IACxC,0BAA0B,EAAE,EAAE;IAC9B,kEAAkE;IAClE,WAAW,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE;IAC/C,oEAAoE;IACpE,+BAA+B;IAC/B,mBAAmB,EAAE,KAAK;IAC1B,8DAA8D;IAC9D,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,8DAA8D;IAC9D,uBAAuB,EAAE,SAAS;IAClC,0EAA0E;IAC1E,gDAAgD;IAChD,gBAAgB,EAAE,aAAa;IAC/B,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE;QACnB,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,CAAC;QACb,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,EAAE;KACf;IACD,wEAAwE;IACxE,oEAAoE;IACpE,4BAA4B,EAAE,KAAK;IACnC,gEAAgE;IAChE,gBAAgB,EAAE,KAAK;IACvB,0EAA0E;IAC1E,6DAA6D;IAC7D,6BAA6B,EAAE,IAAI;IACnC,mEAAmE;IACnE,oEAAoE;IACpE,uBAAuB,EAAE,GAAG;CAC7B,CAAA;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CACtC,MAAqD;IAErD,OAAO;QACL,GAAG,kCAA0B;QAC7B,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;KAClB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,8BAA8B,CAAC,QAA2B;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,uBAAuB,CAAA;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC1F,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/shared-types",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Shared TypeScript types for the Intutic control plane, CLI, and sync daemon",
   "license": "MIT",
   "repository": {
@@ -18,7 +18,7 @@
   ],
   "dependencies": {
     "zod": "^3.23",
-    "@intutic/anomaly-taxonomy": "2.4.0"
+    "@intutic/anomaly-taxonomy": "2.5.1"
   },
   "devDependencies": {
     "typescript": "^5.5",