@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/harness/windsurfJetBrainsProxy.d.ts

@@ -0,0 +1,78 @@
+/**
+ * windsurfJetBrainsProxy.ts — routes the Windsurf JetBrains plugin's
+ * Cascade AI traffic through Intutic's TLS MITM proxy, for every installed
+ * JetBrains product.
+ *
+ * # What this configures, and why it takes two files per IDE
+ *
+ * Unlike Desktop (one fixed `~/.codeium/windsurf/settings.json`), the
+ * JetBrains plugin has no config surface of its own for a manual proxy
+ * endpoint — confirmed by extracting the plugin's own compiled settings
+ * class (`com.codeium.intellij.settings.AppSettingsState`, decompiled from
+ * the real `codeium-2.12.27.jar` published on the JetBrains Marketplace,
+ * 2026-08-18): its only proxy-related field is `detectProxy` (boolean —
+ * exactly the "Detect proxy" toggle
+ * docs.devin.ai/desktop/troubleshooting/plugins-enterprise/jetbrains-proxy
+ * describes), persisted via `@State(name =
+ * "com.codeium.intellij.settings.AppSettingsState", storages =
+ * @Storage("CodeiumSettings.xml"))`. There is no `customProxyUrl`-shaped
+ * field alongside the plugin's OTHER custom-endpoint fields
+ * (`customApiServerUrl`/`customInferenceApiServerUrl`/`customWebsiteUrl`)
+ * — those exist, but redirecting to a custom API server is a materially
+ * different mechanism (a different backend, not transparent interception
+ * of the same traffic) than the TLS-MITM-via-system-proxy model this
+ * codebase already uses for every other harness, so this module does not
+ * use them.
+ *
+ * "Detect proxy" makes the plugin use the IDE PLATFORM's own HTTP proxy
+ * setting — a SEPARATE file, `proxy.settings.xml`, backing JetBrains
+ * Platform's `HttpConfigurable` state (`@Storage("proxy.settings.xml")`,
+ * still live in current `intellij-community` source despite being
+ * `@Deprecated(forRemoval = true)` in favor of a newer `ProxySettings`
+ * API — the deprecated class still persists to this same file today; see
+ * the module doc comment in `jetbrainsXmlConfig.ts` for why this module
+ * merges rather than overwrites it). So configuring the plugin needs
+ * BOTH: `detectProxy=true` in `CodeiumSettings.xml`, and a manual HTTP
+ * proxy pointed at Intutic's local port in `proxy.settings.xml`.
+ *
+ * # Discovery: no fixed path, unlike Desktop
+ *
+ * The JetBrains plugin ships for every JetBrains product (IntelliJ IDEA,
+ * PyCharm, WebStorm, GoLand, CLion, RubyMine, PhpStorm, RustRover,
+ * DataSpell, Rider, DataGrip, Android Studio, ...), each with its own
+ * `<Product><Version>` config directory under a shared JetBrains root
+ * (`~/Library/Application Support/JetBrains` on macOS, `~/.config/
+ * JetBrains` on Linux, `%APPDATA%\JetBrains` on Windows — confirmed
+ * against JetBrains' own support KB). This module does not enumerate
+ * product names; it lists that root's subdirectories and configures ONLY
+ * ones that already have an `options/` directory — the signal that this
+ * is a real, already-initialized IDE install, not a guess at a product
+ * name or version number this codebase should never invent.
+ *
+ * @module
+ */
+/** The shared JetBrains config root for this OS, or `null` on a platform
+ *  this module has no confirmed path for (anything but darwin/linux/
+ *  win32) — callers treat `null` as "nothing to configure," never guess a
+ *  path. */
+export declare function jetbrainsConfigRoot(): string | null;
+/**
+ * Every `<Product><Version>/options` directory under the JetBrains config
+ * root that ALREADY EXISTS — never a guessed or newly-created product/
+ * version directory. Returns `[]` when the root itself is absent (no
+ * JetBrains product ever installed for this user) rather than treating
+ * that as an error.
+ */
+export declare function discoverJetBrainsOptionsDirs(): Promise<string[]>;
+/**
+ * Configures every installed JetBrains product's HTTP proxy + the
+ * Windsurf plugin's `detectProxy` toggle to route through Intutic's local
+ * TLS MITM proxy. Never throws: a product whose settings files don't
+ * match the shape `jetbrainsXmlConfig.ts` understands is skipped and
+ * logged, not corrupted; a system with no JetBrains products installed at
+ * all is a normal, silent no-op (this integration is opt-in by
+ * installation, the same way the Cisco skill-scanner integration degrades
+ * when its binary is absent).
+ */
+export declare function configureJetBrainsWindsurfProxy(proxyPort: number): Promise<void>;
+//# sourceMappingURL=windsurfJetBrainsProxy.d.ts.map

package/dist/harness/windsurfJetBrainsProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windsurfJetBrainsProxy.d.ts","sourceRoot":"","sources":["../../src/harness/windsurfJetBrainsProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAkBH;;;YAGY;AACZ,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAWnD;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBtE;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCtF"}

package/dist/harness/windsurfJetBrainsProxy.js

@@ -0,0 +1,159 @@
+/**
+ * windsurfJetBrainsProxy.ts — routes the Windsurf JetBrains plugin's
+ * Cascade AI traffic through Intutic's TLS MITM proxy, for every installed
+ * JetBrains product.
+ *
+ * # What this configures, and why it takes two files per IDE
+ *
+ * Unlike Desktop (one fixed `~/.codeium/windsurf/settings.json`), the
+ * JetBrains plugin has no config surface of its own for a manual proxy
+ * endpoint — confirmed by extracting the plugin's own compiled settings
+ * class (`com.codeium.intellij.settings.AppSettingsState`, decompiled from
+ * the real `codeium-2.12.27.jar` published on the JetBrains Marketplace,
+ * 2026-08-18): its only proxy-related field is `detectProxy` (boolean —
+ * exactly the "Detect proxy" toggle
+ * docs.devin.ai/desktop/troubleshooting/plugins-enterprise/jetbrains-proxy
+ * describes), persisted via `@State(name =
+ * "com.codeium.intellij.settings.AppSettingsState", storages =
+ * @Storage("CodeiumSettings.xml"))`. There is no `customProxyUrl`-shaped
+ * field alongside the plugin's OTHER custom-endpoint fields
+ * (`customApiServerUrl`/`customInferenceApiServerUrl`/`customWebsiteUrl`)
+ * — those exist, but redirecting to a custom API server is a materially
+ * different mechanism (a different backend, not transparent interception
+ * of the same traffic) than the TLS-MITM-via-system-proxy model this
+ * codebase already uses for every other harness, so this module does not
+ * use them.
+ *
+ * "Detect proxy" makes the plugin use the IDE PLATFORM's own HTTP proxy
+ * setting — a SEPARATE file, `proxy.settings.xml`, backing JetBrains
+ * Platform's `HttpConfigurable` state (`@Storage("proxy.settings.xml")`,
+ * still live in current `intellij-community` source despite being
+ * `@Deprecated(forRemoval = true)` in favor of a newer `ProxySettings`
+ * API — the deprecated class still persists to this same file today; see
+ * the module doc comment in `jetbrainsXmlConfig.ts` for why this module
+ * merges rather than overwrites it). So configuring the plugin needs
+ * BOTH: `detectProxy=true` in `CodeiumSettings.xml`, and a manual HTTP
+ * proxy pointed at Intutic's local port in `proxy.settings.xml`.
+ *
+ * # Discovery: no fixed path, unlike Desktop
+ *
+ * The JetBrains plugin ships for every JetBrains product (IntelliJ IDEA,
+ * PyCharm, WebStorm, GoLand, CLion, RubyMine, PhpStorm, RustRover,
+ * DataSpell, Rider, DataGrip, Android Studio, ...), each with its own
+ * `<Product><Version>` config directory under a shared JetBrains root
+ * (`~/Library/Application Support/JetBrains` on macOS, `~/.config/
+ * JetBrains` on Linux, `%APPDATA%\JetBrains` on Windows — confirmed
+ * against JetBrains' own support KB). This module does not enumerate
+ * product names; it lists that root's subdirectories and configures ONLY
+ * ones that already have an `options/` directory — the signal that this
+ * is a real, already-initialized IDE install, not a guess at a product
+ * name or version number this codebase should never invent.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { mergeXmlComponentOptions } from './jetbrainsXmlConfig.js';
+const log = createLogger('sync-windsurf-jetbrains-proxy');
+/** The Windsurf plugin's own settings component — see module doc comment. */
+const CODEIUM_SETTINGS_COMPONENT = 'com.codeium.intellij.settings.AppSettingsState';
+const CODEIUM_SETTINGS_FILE = 'CodeiumSettings.xml';
+/** JetBrains Platform's own HTTP proxy state — see module doc comment. */
+const HTTP_CONFIGURABLE_COMPONENT = 'HttpConfigurable';
+const PROXY_SETTINGS_FILE = 'proxy.settings.xml';
+/** The shared JetBrains config root for this OS, or `null` on a platform
+ *  this module has no confirmed path for (anything but darwin/linux/
+ *  win32) — callers treat `null` as "nothing to configure," never guess a
+ *  path. */
+export function jetbrainsConfigRoot() {
+    switch (process.platform) {
+        case 'darwin':
+            return path.join(os.homedir(), 'Library', 'Application Support', 'JetBrains');
+        case 'linux':
+            return path.join(os.homedir(), '.config', 'JetBrains');
+        case 'win32':
+            return process.env.APPDATA ? path.join(process.env.APPDATA, 'JetBrains') : null;
+        default:
+            return null;
+    }
+}
+/**
+ * Every `<Product><Version>/options` directory under the JetBrains config
+ * root that ALREADY EXISTS — never a guessed or newly-created product/
+ * version directory. Returns `[]` when the root itself is absent (no
+ * JetBrains product ever installed for this user) rather than treating
+ * that as an error.
+ */
+export async function discoverJetBrainsOptionsDirs() {
+    const root = jetbrainsConfigRoot();
+    if (!root)
+        return [];
+    let entries;
+    try {
+        entries = await fs.readdir(root);
+    }
+    catch {
+        return [];
+    }
+    const dirs = [];
+    for (const entry of entries) {
+        const optionsDir = path.join(root, entry, 'options');
+        try {
+            const stat = await fs.stat(optionsDir);
+            if (stat.isDirectory())
+                dirs.push(optionsDir);
+        }
+        catch {
+            // Not a real IDE install (no options/ dir yet) — skip, don't create it.
+        }
+    }
+    return dirs;
+}
+async function readFileOrNull(filePath) {
+    try {
+        return await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+async function writeFileAtomic(filePath, content) {
+    const tmp = filePath + '.intutic-tmp';
+    await fs.writeFile(tmp, content, 'utf-8');
+    await fs.rename(tmp, filePath);
+}
+/**
+ * Configures every installed JetBrains product's HTTP proxy + the
+ * Windsurf plugin's `detectProxy` toggle to route through Intutic's local
+ * TLS MITM proxy. Never throws: a product whose settings files don't
+ * match the shape `jetbrainsXmlConfig.ts` understands is skipped and
+ * logged, not corrupted; a system with no JetBrains products installed at
+ * all is a normal, silent no-op (this integration is opt-in by
+ * installation, the same way the Cisco skill-scanner integration degrades
+ * when its binary is absent).
+ */
+export async function configureJetBrainsWindsurfProxy(proxyPort) {
+    const optionsDirs = await discoverJetBrainsOptionsDirs();
+    if (optionsDirs.length === 0)
+        return;
+    for (const optionsDir of optionsDirs) {
+        const product = path.basename(path.dirname(optionsDir));
+        const proxyOk = await mergeXmlComponentOptions(path.join(optionsDir, PROXY_SETTINGS_FILE), HTTP_CONFIGURABLE_COMPONENT, {
+            USE_HTTP_PROXY: true,
+            USE_PROXY_PAC: false,
+            PROXY_TYPE_IS_SOCKS: false,
+            PROXY_HOST: '127.0.0.1',
+            PROXY_PORT: String(proxyPort),
+        }, readFileOrNull, writeFileAtomic);
+        const settingsOk = await mergeXmlComponentOptions(path.join(optionsDir, CODEIUM_SETTINGS_FILE), CODEIUM_SETTINGS_COMPONENT, { detectProxy: true }, readFileOrNull, writeFileAtomic);
+        if (proxyOk && settingsOk) {
+            log.info({ action: 'jetbrains_windsurf_proxy_configured', product, port: proxyPort }, 'Configured JetBrains platform proxy + Windsurf plugin detectProxy');
+        }
+        else {
+            log.warn({ action: 'jetbrains_windsurf_proxy_skipped', product, proxyOk, settingsOk }, 'One or both JetBrains settings files did not match the expected shape — left untouched');
+        }
+    }
+}
+//# sourceMappingURL=windsurfJetBrainsProxy.js.map

package/dist/harness/windsurfJetBrainsProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windsurfJetBrainsProxy.js","sourceRoot":"","sources":["../../src/harness/windsurfJetBrainsProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAElE,MAAM,GAAG,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAA;AAEzD,6EAA6E;AAC7E,MAAM,0BAA0B,GAAG,gDAAgD,CAAA;AACnF,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAEnD,0EAA0E;AAC1E,MAAM,2BAA2B,GAAG,kBAAkB,CAAA;AACtD,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEhD;;;YAGY;AACZ,MAAM,UAAU,mBAAmB;IACjC,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAA;QAC/E,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACxD,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACjF;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,SAAiB;IACrE,MAAM,WAAW,GAAG,MAAM,4BAA4B,EAAE,CAAA;IACxD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEpC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAC1C,2BAA2B,EAC3B;YACE,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;YACpB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;SAC9B,EACD,cAAc,EACd,eAAe,CAChB,CAAA;QAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC5C,0BAA0B,EAC1B,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,cAAc,EACd,eAAe,CAChB,CAAA;QAED,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAC3E,mEAAmE,CACpE,CAAA;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAC5E,wFAAwF,CACzF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/hashReporter.js

@@ -43,7 +43,7 @@ export async function computeFileHashes(workspaceRoot, harnesses, canonicalHashe
                 drifted,
             });
         }
-        catch (err) {
+        catch {
             // File doesn't exist or isn't readable — report empty hash, not drifted
             results.push({
                 filePath: relativePath,

package/dist/hashReporter.js.map

@@ -1 +1 @@
-{"version":3,"file":"hashReporter.js","sourceRoot":"","sources":["../src/hashReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,SAAwB,EACxB,eAAuC;IAEvC,MAAM,OAAO,GAAkB,EAAE,CAAA;IAEjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAQ,CAAC,mBAAmB;QAE3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,QAAQ,CAAA;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;YACrD,MAAM,OAAO,GAAG,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,SAAS,CAAA;YAE3D,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,aAAa,EAAE,SAAS;gBACxB,OAAO;aACR,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE;gBAClD,OAAO,EAAE,KAAK;aACf,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC"}
+{"version":3,"file":"hashReporter.js","sourceRoot":"","sources":["../src/hashReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,SAAwB,EACxB,eAAuC;IAEvC,MAAM,OAAO,GAAkB,EAAE,CAAA;IAEjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAQ,CAAC,mBAAmB;QAE3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,QAAQ,CAAA;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;YACrD,MAAM,OAAO,GAAG,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,SAAS,CAAA;YAE3D,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,aAAa,EAAE,SAAS;gBACxB,OAAO;aACR,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE;gBAClD,OAAO,EAAE,KAAK;aACf,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC"}

package/dist/index.d.ts

@@ -12,21 +12,22 @@
  *
  * @module
  */
-export { startSyncLoop, syncOfflineTraces } from './syncLoop.js';
+export { startSyncLoop, syncOfflineTraces, refreshGateCaches, localHoldTokensFor } from './syncLoop.js';
+export { collectAgentReport, reportAgent, fetchLocalProxyInstanceId } from './agentReporter.js';
+export { startHarnessSession, endAllOpenSessions, readGitInfo } from './sessionReporter.js';
 export type { SyncLoopOptions, SyncResult } from './syncLoop.js';
-export { writeConfigFiles } from './configWriter.js';
+export { writeConfigFiles, loadLocalSopEntries } from './configWriter.js';
 export type { WriteResult } from './configWriter.js';
 export { computeFileHashes, hashFile } from './hashReporter.js';
-export { loadIntegrity, saveIntegrity, loadContextIntegrity, saveContextIntegrity } from './integrityStore.js';
-export { BrainIndexer } from './brainIndexer.js';
+export { loadIntegrity, saveIntegrity } from './integrityStore.js';
 export { HARNESS_FILES } from './configWriter.js';
 export { SyncWsClient } from './wsClient.js';
 export type { WsClientOptions } from './wsClient.js';
 export { startWatcher } from './watcher/driftWatcher.js';
-export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents } from './harness/claudeCodeHooks.js';
+export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents, drainReviewRequests, REVIEW_REQUESTS_LOG, REVIEW_REQUESTS_BASENAME, REVIEW_REQUEST_VERSION, } from './harness/claudeCodeHooks.js';
 export type { SopHookConstraints } from './harness/claudeCodeHooks.js';
 export { injectMcpServer } from './harness/mcpAutoWrite.js';
-export { guardSettingsFile } from './watcher/settingsGuard.js';
+export { guardSettingsFile, warnIfDshCoverageGap } from './watcher/settingsGuard.js';
 export { writeAntigravityHooks } from './harness/antigravityHooks.js';
 export { writeClaudeDesktopHooks } from './harness/claudeDesktopHooks.js';
 export { writeRooCodeHooks } from './harness/rooCodeHooks.js';
@@ -36,8 +37,13 @@ export { writeN8nHooks } from './harness/n8nHooks.js';
 export { writeHermesHooks } from './harness/hermesHooks.js';
 export { writeOpenclawHooks } from './harness/openclawHooks.js';
 export { writePiHooks } from './harness/piHooks.js';
+export { writeCodexHooks } from './harness/codexHooks.js';
+export { writeGithubCopilotHooks } from './harness/githubCopilotHooks.js';
 export { writeRuntimeEnv } from './lib/runtimeEnv.js';
+export { refreshPolicySnapshot, writePolicySnapshot, fetchResolvedPolicy, buildSnapshotRules, validateRule, DEFAULT_SNAPSHOT_DIR, DESTRUCTIVE_TIER_SEVERITY, } from './lib/policySnapshot.js';
 export { runComplianceProbes } from './lib/complianceProbes.js';
 export { getActiveAgentProcesses } from './lib/processPoller.js';
 export { TrajectoryMonitor } from './trajectoryMonitor.js';
+export { refreshDecisionsDigest, fetchDecisionsDigest, renderDecisionsMarkdown, renderBoundedSection, injectBoundedSection, DECISIONS_LOG_RELATIVE_PATH, } from './lib/decisionsDigest.js';
+export type { DecisionsDigestEntry, DecisionsDigestResponse, DecisionsDigestOptions, } from './lib/decisionsDigest.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC1G,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAGrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvG,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAC3F,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACzE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAGrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAInD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG1D,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,0BAA0B,CAAA"}

package/dist/index.js

@@ -12,17 +12,18 @@
  *
  * @module
  */
-export { startSyncLoop, syncOfflineTraces } from './syncLoop.js';
-export { writeConfigFiles } from './configWriter.js';
+export { startSyncLoop, syncOfflineTraces, refreshGateCaches, localHoldTokensFor } from './syncLoop.js';
+export { collectAgentReport, reportAgent, fetchLocalProxyInstanceId } from './agentReporter.js';
+export { startHarnessSession, endAllOpenSessions, readGitInfo } from './sessionReporter.js';
+export { writeConfigFiles, loadLocalSopEntries } from './configWriter.js';
 export { computeFileHashes, hashFile } from './hashReporter.js';
-export { loadIntegrity, saveIntegrity, loadContextIntegrity, saveContextIntegrity } from './integrityStore.js';
-export { BrainIndexer } from './brainIndexer.js';
+export { loadIntegrity, saveIntegrity } from './integrityStore.js';
 export { HARNESS_FILES } from './configWriter.js';
 export { SyncWsClient } from './wsClient.js';
 export { startWatcher } from './watcher/driftWatcher.js';
-export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents } from './harness/claudeCodeHooks.js';
+export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents, drainReviewRequests, REVIEW_REQUESTS_LOG, REVIEW_REQUESTS_BASENAME, REVIEW_REQUEST_VERSION, } from './harness/claudeCodeHooks.js';
 export { injectMcpServer } from './harness/mcpAutoWrite.js';
-export { guardSettingsFile } from './watcher/settingsGuard.js';
+export { guardSettingsFile, warnIfDshCoverageGap } from './watcher/settingsGuard.js';
 // Gap 3 fix — Antigravity (Gemini CLI) hook coverage
 export { writeAntigravityHooks } from './harness/antigravityHooks.js';
 // WS-B — new harness hook coverage (claude-desktop, roo-code, continue, open-webui, n8n)
@@ -35,9 +36,16 @@ export { writeN8nHooks } from './harness/n8nHooks.js';
 export { writeHermesHooks } from './harness/hermesHooks.js';
 export { writeOpenclawHooks } from './harness/openclawHooks.js';
 export { writePiHooks } from './harness/piHooks.js';
+// Formerly ungated harnesses with verified native mechanisms
+// (codex: ~/.codex/hooks.json; github-copilot: VS Code agent hooks, Preview)
+export { writeCodexHooks } from './harness/codexHooks.js';
+export { writeGithubCopilotHooks } from './harness/githubCopilotHooks.js';
 // WS-A & WS-F — runtime env writer and compliance probes
 export { writeRuntimeEnv } from './lib/runtimeEnv.js';
+export { refreshPolicySnapshot, writePolicySnapshot, fetchResolvedPolicy, buildSnapshotRules, validateRule, DEFAULT_SNAPSHOT_DIR, DESTRUCTIVE_TIER_SEVERITY, } from './lib/policySnapshot.js';
 export { runComplianceProbes } from './lib/complianceProbes.js';
 export { getActiveAgentProcesses } from './lib/processPoller.js';
 export { TrajectoryMonitor } from './trajectoryMonitor.js';
+// Phase 6 — governed decisions log
+export { refreshDecisionsDigest, fetchDecisionsDigest, renderDecisionsMarkdown, renderBoundedSection, injectBoundedSection, DECISIONS_LOG_RELATIVE_PATH, } from './lib/decisionsDigest.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAG1G,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D,qDAAqD;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAErE,yFAAyF;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,yDAAyD;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvG,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAG3F,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGzE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEpF,qDAAqD;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAErE,yFAAyF;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,6DAA6D;AAC7D,6EAA6E;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAEzE,yDAAyD;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAA"}

package/dist/integrityStore.d.ts

@@ -32,12 +32,4 @@ export declare function loadIntegrity(workspaceRoot: string): Promise<IntegrityS
  * @param store - The IntegrityStore to persist.
  */
 export declare function saveIntegrity(workspaceRoot: string, store: IntegrityStore): Promise<void>;
-/**
- * Load the local context integrity store from `.intutic/context_integrity.json`.
- */
-export declare function loadContextIntegrity(workspaceRoot: string): Promise<IntegrityStore | null>;
-/**
- * Save the context integrity store to `.intutic/context_integrity.json`.
- */
-export declare function saveContextIntegrity(workspaceRoot: string, store: IntegrityStore): Promise<void>;
 //# sourceMappingURL=integrityStore.d.ts.map

package/dist/integrityStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrityStore.d.ts","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAqBhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"integrityStore.d.ts","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAqBhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/integrityStore.js

@@ -62,33 +62,10 @@ export async function saveIntegrity(workspaceRoot, store) {
     await node_fs.writeFile(tmpPath, content, 'utf-8');
     await node_fs.rename(tmpPath, filePath);
 }
-/**
- * Load the local context integrity store from `.intutic/context_integrity.json`.
- */
-export async function loadContextIntegrity(workspaceRoot) {
-    const filePath = node_path.join(workspaceRoot, INTUTIC_DIR, 'context_integrity.json');
-    try {
-        const raw = await node_fs.readFile(filePath, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed.files !== 'object') {
-            return null;
-        }
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Save the context integrity store to `.intutic/context_integrity.json`.
- */
-export async function saveContextIntegrity(workspaceRoot, store) {
-    const dir = node_path.join(workspaceRoot, INTUTIC_DIR);
-    await node_fs.mkdir(dir, { recursive: true });
-    const filePath = node_path.join(dir, 'context_integrity.json');
-    const tmpPath = `${filePath}.tmp`;
-    const content = JSON.stringify(store, null, 2) + '\n';
-    await node_fs.writeFile(tmpPath, content, 'utf-8');
-    await node_fs.rename(tmpPath, filePath);
-}
+// `loadContextIntegrity` / `saveContextIntegrity` were removed on 2026-07-30. They
+// had no callers in either repo — not even tests — while
+// `.intutic/context_integrity.json` sat in three harness hook denylists as a
+// protected path. The file was never created, so those hooks guarded nothing. The
+// config integrity store above already hashes every governed file `syncLoop` writes,
+// which is what the second store would have duplicated.
 //# sourceMappingURL=integrityStore.js.map

package/dist/integrityStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrityStore.js","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAGtC,yEAAyE;AACzE,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAEvC,8CAA8C;AAC9C,MAAM,WAAW,GAAG,UAAU,CAAA;AAE9B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;IAE3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAEhD,yBAAyB;QACzB,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,KAAqB;IAErB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAErD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAErF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,KAAqB;IAErB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAErD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC"}
+{"version":3,"file":"integrityStore.js","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAGtC,yEAAyE;AACzE,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAEvC,8CAA8C;AAC9C,MAAM,WAAW,GAAG,UAAU,CAAA;AAE9B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;IAE3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAEhD,yBAAyB;QACzB,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,KAAqB;IAErB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAErD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAGD,mFAAmF;AACnF,yDAAyD;AACzD,6EAA6E;AAC7E,kFAAkF;AAClF,qFAAqF;AACrF,wDAAwD"}

package/dist/lib/approvedBypasses.d.ts

@@ -0,0 +1,76 @@
+/**
+ * approvedBypasses.ts — ships approved `review_before` bypasses *to* the
+ * machine, mirroring how `policySnapshot.ts` ships policy.
+ *
+ * # Why a separate file from policySnapshot.ts
+ *
+ * A bypass entry is not a rule: it is a one-time, per-call approval keyed on
+ * (workspace, SOP rule id, normalised tool name, hashed command/target), with
+ * its own TTL, and it is additive in the *opposite* direction from a policy
+ * rule — a policy snapshot can only turn an allow into a block, this cache can
+ * only turn one already-held call into an allow, for the one caller who
+ * already approved it. Folding the two into one artifact would make either
+ * "what does this line do" or "is this additive in the safe direction"
+ * dependent on which column you are looking at.
+ *
+ * # The contract with the gate
+ *
+ * `.intutic/hooks/approved-bypasses.jsonl` — same directory as the policy
+ * snapshot, and for the same reason: `.intutic/hooks` is already in
+ * `UNIVERSAL_PROTECTED_PATHS`, so every gate already refuses an agent's own
+ * attempt to write here. Two header lines carry integrity, exactly like the
+ * `.rules` projection: `#digest` (sha256 of the JSONL body, first 32 hex
+ * chars) and `#workspace` (refused if it does not match the gate's own
+ * workspace id). Unlike the policy snapshot there is no `#generated` age
+ * check — each line carries its own `expiresAt`, and the gate compares that
+ * against wall-clock time on every read. A stale FILE degrades to "fewer
+ * valid bypasses" (fail closed toward the hold); it can never resurrect an
+ * entry whose own TTL has passed.
+ *
+ * Only `review_before` gates read this today (claudeCodeHooks.ts's
+ * `_intuticApprovedBypass`) — see that module's docstring for why the other
+ * harness writers are not wired to it: none of them implement `review_before`
+ * holds at all, so there is nothing for a bypass to apply to there yet.
+ *
+ * @module
+ */
+export declare const DEFAULT_BYPASS_CACHE_DIR: string;
+export declare const APPROVED_BYPASSES_FILE = "approved-bypasses.jsonl";
+/** One approved bypass, as `GET /api/v1/decisions/approved-bypasses` returns it. */
+export interface ApprovedBypassEntry {
+    workspaceId: string;
+    sopRuleId: string;
+    toolNameNormalized: string;
+    targetHash: string;
+    holdId: string;
+    decidedBy: string;
+    decidedAt: string;
+    expiresAt: string;
+}
+export interface ApprovedBypassOptions {
+    controlPlaneUrl: string;
+    apiKey: string;
+    workspaceId: string;
+    /** Override the directory (tests). */
+    cacheDir?: string;
+}
+/** Fetches the workspace's currently-approved bypasses. Returns null on any
+ *  failure — the caller keeps the previous cache file rather than replacing
+ *  it with nothing, same rule `fetchResolvedPolicy` follows. */
+export declare function fetchApprovedBypasses(opts: ApprovedBypassOptions): Promise<ApprovedBypassEntry[] | null>;
+/** Writes the cache file atomically, digest and workspace header included —
+ *  same convention as `writePolicySnapshot`. Exported so a test can assert
+ *  the on-disk shape directly. */
+export declare function writeApprovedBypasses(entries: ApprovedBypassEntry[], workspaceId: string, cacheDir?: string): Promise<{
+    digest: string;
+    count: number;
+}>;
+/** Fetch and write in one call. Safe to run on every sync cycle. Never
+ *  throws — a failed poll must not take down the sync loop, and leaves the
+ *  previous cache in place (stale bypasses still expire on their own TTL,
+ *  which is what makes that safe). */
+export declare function refreshApprovedBypasses(opts: ApprovedBypassOptions): Promise<{
+    digest: string;
+    count: number;
+} | null>;
+//# sourceMappingURL=approvedBypasses.d.ts.map

package/dist/lib/approvedBypasses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvedBypasses.d.ts","sourceRoot":"","sources":["../../src/lib/approvedBypasses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,eAAO,MAAM,wBAAwB,QAA+C,CAAA;AACpF,eAAO,MAAM,sBAAsB,4BAA4B,CAAA;AAE/D,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAmBD;;gEAEgE;AAChE,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAmCvC;AAED;;kCAEkC;AAClC,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,mBAAmB,EAAE,EAC9B,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,MAAiC,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB5C;AAED;;;sCAGsC;AACtC,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASnD"}