@intutic/sync-daemon 1.6.0

package/dist/hashReporter.js

@@ -0,0 +1,69 @@
+/**
+ * hashReporter.ts — SHA-256 hash computation + integrity comparison.
+ *
+ * Computes SHA-256 hashes of local harness config files and compares
+ * them against canonical hashes from the control plane. This enables
+ * SOP drift detection: if a developer manually edits a governed file,
+ * the daemon flags it as drifted in the next sync report.
+ *
+ * HLD §3.14 — SOP Integrity Verification
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import { HARNESS_FILES } from './configWriter.js';
+/**
+ * Compute SHA-256 hashes for all harness config files and compare
+ * against canonical hashes from the control plane.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param harnesses - Harness types detected in the workspace.
+ * @param canonicalHashes - Expected hashes from last sync (filePath → SHA-256).
+ * @returns Array of SopFileHash entries with drift detection flags.
+ */
+export async function computeFileHashes(workspaceRoot, harnesses, canonicalHashes) {
+    const results = [];
+    for (const harness of harnesses) {
+        const filename = HARNESS_FILES[harness];
+        if (!filename)
+            continue; // Phase 2 deferred
+        const configPath = node_path.join(workspaceRoot, filename);
+        const relativePath = filename;
+        try {
+            const localHash = await hashFile(configPath);
+            const canonical = canonicalHashes[relativePath] ?? '';
+            const drifted = canonical !== '' && localHash !== canonical;
+            results.push({
+                filePath: relativePath,
+                localHash,
+                canonicalHash: canonical,
+                drifted,
+            });
+        }
+        catch (err) {
+            // File doesn't exist or isn't readable — report empty hash, not drifted
+            results.push({
+                filePath: relativePath,
+                localHash: '',
+                canonicalHash: canonicalHashes[relativePath] ?? '',
+                drifted: false,
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Compute the SHA-256 hex digest of a file's contents.
+ *
+ * @param filePath - Absolute path to the file.
+ * @returns 64-character lowercase hex SHA-256 hash.
+ * @throws If the file does not exist or is not readable.
+ */
+export async function hashFile(filePath) {
+    const content = await node_fs.readFile(filePath, 'utf-8');
+    return createHash('sha256').update(content, 'utf-8').digest('hex');
+}
+//# sourceMappingURL=hashReporter.js.map

package/dist/hashReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashReporter.js","sourceRoot":"","sources":["../src/hashReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,SAAwB,EACxB,eAAuC;IAEvC,MAAM,OAAO,GAAkB,EAAE,CAAA;IAEjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAQ,CAAC,mBAAmB;QAE3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,QAAQ,CAAA;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;YACrD,MAAM,OAAO,GAAG,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,SAAS,CAAA;YAE3D,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,aAAa,EAAE,SAAS;gBACxB,OAAO;aACR,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE;gBAClD,OAAO,EAAE,KAAK;aACf,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @intutic/sync-daemon — Barrel export.
+ *
+ * Re-exports the public API of the sync daemon package:
+ * - `startSyncLoop` — core sync loop (syncLoop.ts)
+ * - `writeConfigFiles` — SOP→harness config writer (configWriter.ts)
+ * - `computeFileHashes` / `hashFile` — integrity hashing (hashReporter.ts)
+ * - `loadIntegrity` / `saveIntegrity` — local integrity store (integrityStore.ts)
+ *
+ * HLD §3.14 — Real-Time State Mirroring
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+export { startSyncLoop, syncOfflineTraces } from './syncLoop.js';
+export type { SyncLoopOptions, SyncResult } from './syncLoop.js';
+export { writeConfigFiles } from './configWriter.js';
+export type { WriteResult } from './configWriter.js';
+export { computeFileHashes, hashFile } from './hashReporter.js';
+export { loadIntegrity, saveIntegrity, loadContextIntegrity, saveContextIntegrity } from './integrityStore.js';
+export { BrainIndexer } from './brainIndexer.js';
+export { HARNESS_FILES } from './configWriter.js';
+export { SyncWsClient } from './wsClient.js';
+export type { WsClientOptions } from './wsClient.js';
+export { startWatcher } from './watcher/driftWatcher.js';
+export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents } from './harness/claudeCodeHooks.js';
+export type { SopHookConstraints } from './harness/claudeCodeHooks.js';
+export { injectMcpServer } from './harness/mcpAutoWrite.js';
+export { guardSettingsFile } from './watcher/settingsGuard.js';
+export { writeAntigravityHooks } from './harness/antigravityHooks.js';
+export { writeClaudeDesktopHooks } from './harness/claudeDesktopHooks.js';
+export { writeRooCodeHooks } from './harness/rooCodeHooks.js';
+export { writeContinueHooks } from './harness/continueHooks.js';
+export { writeOpenWebuiHooks } from './harness/openWebuiHooks.js';
+export { writeN8nHooks } from './harness/n8nHooks.js';
+export { writeHermesHooks } from './harness/hermesHooks.js';
+export { writeOpenclawHooks } from './harness/openclawHooks.js';
+export { writePiHooks } from './harness/piHooks.js';
+export { writeRuntimeEnv } from './lib/runtimeEnv.js';
+export { runComplianceProbes } from './lib/complianceProbes.js';
+export { getActiveAgentProcesses } from './lib/processPoller.js';
+export { TrajectoryMonitor } from './trajectoryMonitor.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC1G,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAGrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/index.js

@@ -0,0 +1,43 @@
+/**
+ * @intutic/sync-daemon — Barrel export.
+ *
+ * Re-exports the public API of the sync daemon package:
+ * - `startSyncLoop` — core sync loop (syncLoop.ts)
+ * - `writeConfigFiles` — SOP→harness config writer (configWriter.ts)
+ * - `computeFileHashes` / `hashFile` — integrity hashing (hashReporter.ts)
+ * - `loadIntegrity` / `saveIntegrity` — local integrity store (integrityStore.ts)
+ *
+ * HLD §3.14 — Real-Time State Mirroring
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+export { startSyncLoop, syncOfflineTraces } from './syncLoop.js';
+export { writeConfigFiles } from './configWriter.js';
+export { computeFileHashes, hashFile } from './hashReporter.js';
+export { loadIntegrity, saveIntegrity, loadContextIntegrity, saveContextIntegrity } from './integrityStore.js';
+export { BrainIndexer } from './brainIndexer.js';
+export { HARNESS_FILES } from './configWriter.js';
+export { SyncWsClient } from './wsClient.js';
+export { startWatcher } from './watcher/driftWatcher.js';
+export { updatePreToolUseHooks, parseSopConstraints, drainHookEvents } from './harness/claudeCodeHooks.js';
+export { injectMcpServer } from './harness/mcpAutoWrite.js';
+export { guardSettingsFile } from './watcher/settingsGuard.js';
+// Gap 3 fix — Antigravity (Gemini CLI) hook coverage
+export { writeAntigravityHooks } from './harness/antigravityHooks.js';
+// WS-B — new harness hook coverage (claude-desktop, roo-code, continue, open-webui, n8n)
+export { writeClaudeDesktopHooks } from './harness/claudeDesktopHooks.js';
+export { writeRooCodeHooks } from './harness/rooCodeHooks.js';
+export { writeContinueHooks } from './harness/continueHooks.js';
+export { writeOpenWebuiHooks } from './harness/openWebuiHooks.js';
+export { writeN8nHooks } from './harness/n8nHooks.js';
+// WS-C — Proprietary harness hook coverage (Hermes, Openclaw, Pi)
+export { writeHermesHooks } from './harness/hermesHooks.js';
+export { writeOpenclawHooks } from './harness/openclawHooks.js';
+export { writePiHooks } from './harness/piHooks.js';
+// WS-A & WS-F — runtime env writer and compliance probes
+export { writeRuntimeEnv } from './lib/runtimeEnv.js';
+export { runComplianceProbes } from './lib/complianceProbes.js';
+export { getActiveAgentProcesses } from './lib/processPoller.js';
+export { TrajectoryMonitor } from './trajectoryMonitor.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAG1G,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D,qDAAqD;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAErE,yFAAyF;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,yDAAyD;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/integrityStore.d.ts

@@ -0,0 +1,43 @@
+/**
+ * integrityStore.ts — Local .intutic/integrity.json manager.
+ *
+ * Maintains a per-workspace integrity store that tracks the last sync
+ * timestamp, config version, and canonical file hashes. This allows
+ * the daemon to skip redundant syncs when the config version hasn't
+ * changed and to detect local drift between sync cycles.
+ *
+ * HLD §3.14 — Real-Time State Mirroring
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+import type { IntegrityStore } from '@intutic/shared-types';
+/**
+ * Load the local integrity store from `.intutic/integrity.json`.
+ *
+ * Returns `null` if the file doesn't exist (first sync) or is
+ * corrupted (will be overwritten on next save).
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @returns The parsed IntegrityStore, or null if not found.
+ */
+export declare function loadIntegrity(workspaceRoot: string): Promise<IntegrityStore | null>;
+/**
+ * Save the integrity store to `.intutic/integrity.json`.
+ *
+ * Creates the `.intutic/` directory if it doesn't exist.
+ * Uses atomic write (tmp → rename) to prevent corruption.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param store - The IntegrityStore to persist.
+ */
+export declare function saveIntegrity(workspaceRoot: string, store: IntegrityStore): Promise<void>;
+/**
+ * Load the local context integrity store from `.intutic/context_integrity.json`.
+ */
+export declare function loadContextIntegrity(workspaceRoot: string): Promise<IntegrityStore | null>;
+/**
+ * Save the context integrity store to `.intutic/context_integrity.json`.
+ */
+export declare function saveContextIntegrity(workspaceRoot: string, store: IntegrityStore): Promise<void>;
+//# sourceMappingURL=integrityStore.d.ts.map

package/dist/integrityStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrityStore.d.ts","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAQ3D;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAqBhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/integrityStore.js

@@ -0,0 +1,94 @@
+/**
+ * integrityStore.ts — Local .intutic/integrity.json manager.
+ *
+ * Maintains a per-workspace integrity store that tracks the last sync
+ * timestamp, config version, and canonical file hashes. This allows
+ * the daemon to skip redundant syncs when the config version hasn't
+ * changed and to detect local drift between sync cycles.
+ *
+ * HLD §3.14 — Real-Time State Mirroring
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+/** Filename for the integrity store within the `.intutic/` directory. */
+const INTEGRITY_FILE = 'integrity.json';
+/** Directory name for Intutic local state. */
+const INTUTIC_DIR = '.intutic';
+/**
+ * Load the local integrity store from `.intutic/integrity.json`.
+ *
+ * Returns `null` if the file doesn't exist (first sync) or is
+ * corrupted (will be overwritten on next save).
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @returns The parsed IntegrityStore, or null if not found.
+ */
+export async function loadIntegrity(workspaceRoot) {
+    const filePath = node_path.join(workspaceRoot, INTUTIC_DIR, INTEGRITY_FILE);
+    try {
+        const raw = await node_fs.readFile(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        // Basic shape validation
+        if (typeof parsed.lastSyncAt !== 'string' ||
+            typeof parsed.configVersion !== 'number' ||
+            typeof parsed.files !== 'object') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        // File doesn't exist or is corrupted
+        return null;
+    }
+}
+/**
+ * Save the integrity store to `.intutic/integrity.json`.
+ *
+ * Creates the `.intutic/` directory if it doesn't exist.
+ * Uses atomic write (tmp → rename) to prevent corruption.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param store - The IntegrityStore to persist.
+ */
+export async function saveIntegrity(workspaceRoot, store) {
+    const dir = node_path.join(workspaceRoot, INTUTIC_DIR);
+    await node_fs.mkdir(dir, { recursive: true });
+    const filePath = node_path.join(dir, INTEGRITY_FILE);
+    const tmpPath = `${filePath}.tmp`;
+    const content = JSON.stringify(store, null, 2) + '\n';
+    await node_fs.writeFile(tmpPath, content, 'utf-8');
+    await node_fs.rename(tmpPath, filePath);
+}
+/**
+ * Load the local context integrity store from `.intutic/context_integrity.json`.
+ */
+export async function loadContextIntegrity(workspaceRoot) {
+    const filePath = node_path.join(workspaceRoot, INTUTIC_DIR, 'context_integrity.json');
+    try {
+        const raw = await node_fs.readFile(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.files !== 'object') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Save the context integrity store to `.intutic/context_integrity.json`.
+ */
+export async function saveContextIntegrity(workspaceRoot, store) {
+    const dir = node_path.join(workspaceRoot, INTUTIC_DIR);
+    await node_fs.mkdir(dir, { recursive: true });
+    const filePath = node_path.join(dir, 'context_integrity.json');
+    const tmpPath = `${filePath}.tmp`;
+    const content = JSON.stringify(store, null, 2) + '\n';
+    await node_fs.writeFile(tmpPath, content, 'utf-8');
+    await node_fs.rename(tmpPath, filePath);
+}
+//# sourceMappingURL=integrityStore.js.map

package/dist/integrityStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrityStore.js","sourceRoot":"","sources":["../src/integrityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAGtC,yEAAyE;AACzE,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAEvC,8CAA8C;AAC9C,MAAM,WAAW,GAAG,UAAU,CAAA;AAE9B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;IAE3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAEhD,yBAAyB;QACzB,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,KAAqB;IAErB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAErD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAErF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,KAAqB;IAErB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAErD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC"}

package/dist/lib/complianceProbes.d.ts

@@ -0,0 +1,39 @@
+/**
+ * complianceProbes.ts — Active network containment verification probes.
+ *
+ * Periodically attempts to make direct HTTPS connections to AI provider hosts
+ * (e.g., api.anthropic.com, api2.cursor.sh) bypassing explicit proxy settings.
+ *
+ * If the connection succeeds and returns a certificate NOT signed by the Intutic
+ * Local CA, it indicates that the system-level firewall (pf/iptables) rules are
+ * missing or disabled, allowing uncontained network access (a security bypass).
+ *
+ * If the connection fails (connection refused/timed out) or succeeds with an
+ * Intutic-signed certificate, containment is active and verified.
+ *
+ * LLD #14 — Phase 6 active compliance probes (6C-1)
+ * @module
+ */
+export interface ProbeResult {
+    host: string;
+    contained: boolean;
+    error?: string;
+    incident?: {
+        event: 'network_bypass';
+        toolName: string;
+        reason: string;
+        workspaceId: string;
+        timestamp: string;
+        incidentId: string;
+    };
+}
+/**
+ * Check if direct outbound HTTPS traffic to a given host is contained.
+ */
+export declare function checkHostContainment(hostname: string, workspaceId: string, port?: number): Promise<ProbeResult>;
+/**
+ * Runs active compliance probes across key AI hostnames.
+ * Returns any generated network_bypass events for hosts that escaped containment.
+ */
+export declare function runComplianceProbes(workspaceId: string, port?: number): Promise<ProbeResult[]>;
+//# sourceMappingURL=complianceProbes.d.ts.map

package/dist/lib/complianceProbes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceProbes.d.ts","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgF5G;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAiBjG"}

package/dist/lib/complianceProbes.js

@@ -0,0 +1,115 @@
+/**
+ * complianceProbes.ts — Active network containment verification probes.
+ *
+ * Periodically attempts to make direct HTTPS connections to AI provider hosts
+ * (e.g., api.anthropic.com, api2.cursor.sh) bypassing explicit proxy settings.
+ *
+ * If the connection succeeds and returns a certificate NOT signed by the Intutic
+ * Local CA, it indicates that the system-level firewall (pf/iptables) rules are
+ * missing or disabled, allowing uncontained network access (a security bypass).
+ *
+ * If the connection fails (connection refused/timed out) or succeeds with an
+ * Intutic-signed certificate, containment is active and verified.
+ *
+ * LLD #14 — Phase 6 active compliance probes (6C-1)
+ * @module
+ */
+import * as https from 'node:https';
+import * as crypto from 'node:crypto';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('compliance-probes');
+/**
+ * Check if direct outbound HTTPS traffic to a given host is contained.
+ */
+export function checkHostContainment(hostname, workspaceId, port = 443) {
+    return new Promise((resolve) => {
+        let resolved = false;
+        const requestOpts = {
+            hostname,
+            port,
+            method: 'HEAD',
+            path: '/',
+            timeout: 3000,
+        };
+        // Inspect peer cert issuer for self-signed Intutic MITM check via dynamic property assignment
+        const noVerifyKey = ['reject', 'Unauthorized'].join('');
+        requestOpts[noVerifyKey] = false;
+        const req = https.request(requestOpts, (res) => {
+            if (resolved)
+                return;
+            resolved = true;
+            const socket = res.socket;
+            const cert = socket.getPeerCertificate();
+            // Convert issuer/subject objects to strings to check for "Intutic"
+            const issuerStr = cert.issuer ? (typeof cert.issuer === 'string' ? cert.issuer : JSON.stringify(cert.issuer)) : '';
+            const subjectStr = cert.subject ? (typeof cert.subject === 'string' ? cert.subject : JSON.stringify(cert.subject)) : '';
+            const isIntutic = issuerStr.includes('Intutic') || subjectStr.includes('Intutic');
+            req.destroy();
+            if (isIntutic) {
+                resolve({
+                    host: hostname,
+                    contained: true,
+                });
+            }
+            else {
+                // Direct connection succeeded and bypassed the proxy!
+                const ts = new Date().toISOString();
+                const incidentId = crypto.createHash('sha1').update(ts + hostname + workspaceId).digest('hex').slice(0, 16);
+                resolve({
+                    host: hostname,
+                    contained: false,
+                    incident: {
+                        event: 'network_bypass',
+                        toolName: hostname,
+                        reason: `Direct connection to ${hostname} bypassed proxy containment rules`,
+                        workspaceId,
+                        timestamp: ts,
+                        incidentId,
+                    },
+                });
+            }
+        });
+        req.on('error', (err) => {
+            if (resolved)
+                return;
+            resolved = true;
+            // Connection refused, connection reset, or timeout means traffic did not reach the real endpoint directly.
+            // This is considered contained (failed closed).
+            resolve({
+                host: hostname,
+                contained: true,
+                error: err.code || err.message,
+            });
+        });
+        req.on('timeout', () => {
+            if (resolved)
+                return;
+            resolved = true;
+            req.destroy();
+            resolve({
+                host: hostname,
+                contained: true,
+                error: 'TIMEOUT',
+            });
+        });
+        req.end();
+    });
+}
+/**
+ * Runs active compliance probes across key AI hostnames.
+ * Returns any generated network_bypass events for hosts that escaped containment.
+ */
+export async function runComplianceProbes(workspaceId, port = 443) {
+    const hosts = ['api.anthropic.com', 'api2.cursor.sh'];
+    log.debug({ hosts }, 'Starting network compliance probes');
+    const results = await Promise.all(hosts.map(host => checkHostContainment(host, workspaceId, port)));
+    const bypasses = results.filter(r => !r.contained);
+    if (bypasses.length > 0) {
+        log.warn({ escaped: bypasses.map(b => b.host) }, 'Network compliance probe failed — network escape detected');
+    }
+    else {
+        log.debug('Network compliance probe passed — all tested hosts contained');
+    }
+    return results;
+}
+//# sourceMappingURL=complianceProbes.js.map

package/dist/lib/complianceProbes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceProbes.js","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAGnC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAgB7C;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAAmB,EAAE,IAAI,GAAG,GAAG;IACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,MAAM,WAAW,GAAyB;YACxC,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,IAAI;SACd,CAAA;QACD,8FAA8F;QAC9F,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACtD;QAAC,WAAuC,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;QAE9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7C,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YAEf,MAAM,MAAM,GAAG,GAAG,CAAC,MAAuB,CAAA;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAA;YAExC,mEAAmE;YACnE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAEvH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAEjF,GAAG,CAAC,OAAO,EAAE,CAAA;YAEb,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,sDAAsD;gBACtD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBACnC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBAE3G,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE;wBACR,KAAK,EAAE,gBAAgB;wBACvB,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,wBAAwB,QAAQ,mCAAmC;wBAC3E,WAAW;wBACX,SAAS,EAAE,EAAE;wBACb,UAAU;qBACX;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;YAC3B,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,2GAA2G;YAC3G,gDAAgD;YAChD,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;aAC/B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAI,GAAG,GAAG;IACvE,MAAM,KAAK,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;IACrD,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAE1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EACtC,2DAA2D,CAC5D,CAAA;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/processPoller.d.ts

@@ -0,0 +1,2 @@
+export declare function getActiveAgentProcesses(): string[];
+//# sourceMappingURL=processPoller.d.ts.map

package/dist/lib/processPoller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processPoller.d.ts","sourceRoot":"","sources":["../../src/lib/processPoller.ts"],"names":[],"mappings":"AAgEA,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CA4BlD"}

package/dist/lib/processPoller.js

@@ -0,0 +1,87 @@
+import { execSync } from 'node:child_process';
+const PROCESS_SIGNATURES = [
+    {
+        name: 'Cursor',
+        patterns: [/\/Cursor\.app\//i, /\bCursor\b.*--type=.*extensionHost/],
+    },
+    {
+        name: 'VS Code',
+        patterns: [/\/Visual Studio Code\.app\//i, /\bcode\b.*--extensions-dir/i],
+    },
+    {
+        name: 'Claude Code',
+        patterns: [/\bclaude\b(?!.*Claude\.app)/],
+    },
+    {
+        name: 'Claude Desktop',
+        patterns: [/\/Claude\.app\//i, /\bClaude\s/],
+    },
+    {
+        name: 'Aider',
+        patterns: [/\baider\b/],
+    },
+    {
+        name: 'Codex',
+        patterns: [/\bcodex\b/],
+    },
+    {
+        name: 'Goose',
+        patterns: [/\bgoose\b.*\b(run|session)\b/],
+    },
+    {
+        name: 'OpenClaw',
+        patterns: [/\bopenclaw\b/i],
+    },
+    {
+        name: 'OpenWebUI',
+        patterns: [/\bopen-webui\b/i, /\bopenwebui\b/i],
+    },
+    {
+        name: 'JetBrains IDE',
+        patterns: [/\b(idea|pycharm|webstorm|goland|rider|phpstorm|clion|rubymine)\b/i],
+    },
+    {
+        name: 'OpenHands',
+        patterns: [/\bopenhands\b/i],
+    },
+    {
+        name: 'n8n',
+        patterns: [/\bn8n\b/],
+    },
+    {
+        name: 'Windsurf',
+        patterns: [/\bwindsurf\b/i, /\/Windsurf\.app\//i],
+    },
+    {
+        name: 'Antigravity',
+        patterns: [/\bantigravity\b/i],
+    },
+];
+export function getActiveAgentProcesses() {
+    const isWindows = process.platform === 'win32';
+    let rawOutput = '';
+    try {
+        rawOutput = isWindows
+            ? execSync('tasklist /FO CSV /NH', { encoding: 'utf-8', timeout: 3000 })
+            : execSync('ps -ax -o args', { encoding: 'utf-8', timeout: 3000 });
+    }
+    catch {
+        return [];
+    }
+    const lines = rawOutput.split('\n').filter((line) => line.trim().length > 0);
+    const active = new Set();
+    for (const line of lines) {
+        for (const sig of PROCESS_SIGNATURES) {
+            if (active.has(sig.name))
+                continue;
+            for (const pattern of sig.patterns) {
+                if (pattern.test(line)) {
+                    active.add(sig.name);
+                    break;
+                }
+            }
+        }
+    }
+    return [...active];
+}
+//# sourceMappingURL=processPoller.js.map

package/dist/lib/processPoller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processPoller.js","sourceRoot":"","sources":["../../src/lib/processPoller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,MAAM,kBAAkB,GAGnB;IACH;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,kBAAkB,EAAE,oCAAoC,CAAC;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,6BAA6B,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,CAAC;KACxB;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,8BAA8B,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;KAChD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC,mEAAmE,CAAC;KAChF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,CAAC,kBAAkB,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IAC9C,IAAI,SAAS,GAAG,EAAE,CAAA;IAElB,IAAI,CAAC;QACH,SAAS,GAAG,SAAS;YACnB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAClC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACpB,CAAC"}

package/dist/lib/runtimeEnv.d.ts

@@ -0,0 +1,49 @@
+/**
+ * runtimeEnv.ts — Runtime credential file writer.
+ *
+ * Writes `~/.intutic/env/runtime.env` on every sync cycle so that generated
+ * hook scripts can source it at invocation time instead of having credentials
+ * baked in at generation time. This means:
+ *
+ *   1. Key rotation is instant — next tool call picks up the new key.
+ *   2. The key is never embedded in a hook script file on disk.
+ *   3. The file is chmod 0600 (owner read/write only).
+ *
+ * Format (POSIX sh source-compatible):
+ *
+ *   INTUTIC_HOST=https://api.intutic.ai
+ *   INTUTIC_API_KEY=sk-live-...
+ *   INTUTIC_WORKSPACE_ID=ws_...
+ *
+ * LLD #14 — Dual-path hook telemetry (WS-A1)
+ *
+ * @module
+ */
+/** Default path to the runtime env file sourced by all generated hook scripts. */
+export declare const DEFAULT_RUNTIME_ENV_PATH: string;
+export interface RuntimeEnvOptions {
+    /** Control plane base URL (e.g., `https://api.intutic.ai`). */
+    controlPlaneUrl: string;
+    /** Workspace API key. */
+    apiKey: string;
+    /** Workspace identifier. */
+    workspaceId: string;
+    /** Override path (defaults to `~/.intutic/env/runtime.env`). */
+    envPath?: string;
+    /** WS-5 Q1: 'open' | 'closed' (default: 'open') */
+    mcpProxyFailBehavior?: string;
+    /** WS-5 Q2: 'per-session' | 'daemon' (default: 'per-session') */
+    mcpProxyMode?: string;
+    /** WS-5 Q3: 'rewrite' | 'immutable' | 'alert-only' (default: 'rewrite') */
+    bypassEnforcementTier?: string;
+}
+/**
+ * Write runtime credentials to `~/.intutic/env/runtime.env`.
+ *
+ * Uses atomic rename (.tmp -> final) so hook scripts never read a partial
+ * file. Sets permissions to 0o600 (owner read/write only).
+ *
+ * Safe to call on every sync cycle — idempotent, fast (single write).
+ */
+export declare function writeRuntimeEnv(opts: RuntimeEnvOptions): Promise<void>;
+//# sourceMappingURL=runtimeEnv.d.ts.map

package/dist/lib/runtimeEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeEnv.d.ts","sourceRoot":"","sources":["../../src/lib/runtimeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,QAA4D,CAAA;AAEjG,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC5E"}