@intutic/sync-daemon 1.6.0

package/dist/trajectoryMonitor.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Trajectory Monitor — Daemon-side session watcher (Worker Thread).
+ *
+ * Runs inside the sync-daemon as a Node.js Worker thread. Subscribes to
+ * Valkey pub/sub `trace:live:{sessionId}` channels, buffers events in a
+ * sliding window, and submits trajectory summaries to the control plane
+ * for analysis.
+ *
+ * Key guarantees:
+ * - Non-blocking: Worker thread isolation, fire-and-forget analysis
+ * - No LLM calls on developer machine (all judgment is server-side)
+ * - Cooldown rate limiter: 1 analysis request per minute per session
+ *
+ * LLD #52 §4.1 — Daemon-side trajectory buffer
+ *
+ * @module
+ */
+/** Individual trace event from the proxy pub/sub stream. */
+export interface TraceEvent {
+    sessionId: string;
+    workspaceId: string;
+    toolName: string;
+    model: string;
+    inputTokens: number;
+    outputTokens: number;
+    reasoningTokens?: number;
+    status: 'success' | 'error';
+    timestamp: string;
+}
+/** Configuration for the trajectory monitor. */
+export interface TrajectoryMonitorConfig {
+    /** Valkey connection URL. */
+    valkeyUrl: string;
+    /** Control plane base URL for submitting summaries. */
+    controlPlaneUrl: string;
+    /** API key for control plane authentication. */
+    apiKey: string;
+    /** Sliding window size in milliseconds. Default: 300_000 (5 minutes). */
+    windowMs?: number;
+    /** Maximum events per buffer. Default: 500. */
+    maxBufferSize?: number;
+    /** Summary submission interval in ms. Default: 60_000 (1 minute). */
+    submitIntervalMs?: number;
+    /** Session IDs to monitor. Empty = monitor all. */
+    sessionFilter?: string[];
+}
+/**
+ * Per-session sliding window buffer for trace events.
+ */
+export declare class TrajectoryBuffer {
+    readonly sessionId: string;
+    readonly workspaceId: string;
+    private events;
+    private readonly maxSize;
+    private readonly windowMs;
+    private lastSubmitTime;
+    constructor(sessionId: string, workspaceId: string, maxSize?: number, windowMs?: number);
+    /** Add an event to the buffer. Trims old events and enforces size cap. */
+    push(event: TraceEvent): void;
+    /** Check if cooldown has elapsed since last submission. */
+    canSubmit(cooldownMs: number): boolean;
+    /** Mark that a submission was made. */
+    markSubmitted(): void;
+    /** Get the current buffer size. */
+    get size(): number;
+    /**
+     * Compute a trajectory summary from the current buffer.
+     */
+    toSummary(activeSopIds: string[], budgetUtilization: number): TrajectorySummaryPayload;
+}
+/** Payload sent to the control plane for analysis. */
+export interface TrajectorySummaryPayload {
+    sessionId: string;
+    workspaceId: string;
+    windowStartedAt: string;
+    windowEndedAt: string;
+    toolCallCount: number;
+    uniqueTools: string[];
+    totalTokens: number;
+    modelSwitches: number;
+    errorCount: number;
+    tokenVelocity: number;
+    toolCallVelocity: number;
+    maxConsecutiveIdenticalCalls: number;
+    activeSopIds: string[];
+    budgetUtilization: number;
+}
+/**
+ * Trajectory Monitor controller.
+ *
+ * Manages per-session buffers, subscribes to trace events via Valkey pub/sub,
+ * and periodically submits summaries to the control plane for analysis.
+ */
+export declare class TrajectoryMonitor {
+    private readonly config;
+    private buffers;
+    private submitTimer;
+    private running;
+    constructor(config: TrajectoryMonitorConfig);
+    /**
+     * Start the monitor — subscribe to Valkey and begin periodic submission.
+     */
+    start(): Promise<void>;
+    /**
+     * Stop the monitor and clean up resources.
+     */
+    stop(): void;
+    /**
+     * Process an incoming trace event from the Valkey pub/sub stream.
+     * Called by the sync-daemon when a trace:live event is received.
+     */
+    handleTraceEvent(event: TraceEvent): void;
+    /**
+     * Submit summaries for all active session buffers.
+     */
+    private submitAllSummaries;
+    /**
+     * Submit a single session's trajectory summary to the control plane.
+     */
+    private submitSummary;
+    private saveOffline;
+    private drainOfflineTrajectories;
+    /** Get the number of active session buffers. */
+    get activeSessionCount(): number;
+}
+//# sourceMappingURL=trajectoryMonitor.d.ts.map

package/dist/trajectoryMonitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trajectoryMonitor.d.ts","sourceRoot":"","sources":["../src/trajectoryMonitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAID;;GAEG;AACH,qBAAa,gBAAgB;IAOzB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAP9B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,cAAc,CAAI;gBAGf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EAC5B,OAAO,SAAM,EACb,QAAQ,SAAU;IAMpB,0EAA0E;IAC1E,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAe7B,2DAA2D;IAC3D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAItC,uCAAuC;IACvC,aAAa,IAAI,IAAI;IAIrB,mCAAmC;IACnC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,MAAM,GAAG,wBAAwB;CAyDvF;AAED,sDAAsD;AACtD,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,4BAA4B,EAAE,MAAM,CAAA;IACpC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAID;;;;;GAKG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,OAAO,CAAQ;gBAEM,MAAM,EAAE,uBAAuB;IAE5D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB5B;;OAEG;IACH,IAAI,IAAI,IAAI;IAUZ;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IA4BzC;;OAEG;YACW,kBAAkB;IAmBhC;;OAEG;YACW,aAAa;IAyC3B,OAAO,CAAC,WAAW;YASL,wBAAwB;IA6CtC,gDAAgD;IAChD,IAAI,kBAAkB,IAAI,MAAM,CAE/B;CACF"}

package/dist/trajectoryMonitor.js

@@ -0,0 +1,291 @@
+/**
+ * Trajectory Monitor — Daemon-side session watcher (Worker Thread).
+ *
+ * Runs inside the sync-daemon as a Node.js Worker thread. Subscribes to
+ * Valkey pub/sub `trace:live:{sessionId}` channels, buffers events in a
+ * sliding window, and submits trajectory summaries to the control plane
+ * for analysis.
+ *
+ * Key guarantees:
+ * - Non-blocking: Worker thread isolation, fire-and-forget analysis
+ * - No LLM calls on developer machine (all judgment is server-side)
+ * - Cooldown rate limiter: 1 analysis request per minute per session
+ *
+ * LLD #52 §4.1 — Daemon-side trajectory buffer
+ *
+ * @module
+ */
+import { createLogger } from '@intutic/logger';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+const log = createLogger('trajectory-monitor');
+// ─── Sliding Window Buffer ──────────────────────────────────────────
+/**
+ * Per-session sliding window buffer for trace events.
+ */
+export class TrajectoryBuffer {
+    sessionId;
+    workspaceId;
+    events = [];
+    maxSize;
+    windowMs;
+    lastSubmitTime = 0;
+    constructor(sessionId, workspaceId, maxSize = 500, windowMs = 300_000) {
+        this.sessionId = sessionId;
+        this.workspaceId = workspaceId;
+        this.maxSize = maxSize;
+        this.windowMs = windowMs;
+    }
+    /** Add an event to the buffer. Trims old events and enforces size cap. */
+    push(event) {
+        this.events.push(event);
+        // Enforce size cap
+        if (this.events.length > this.maxSize) {
+            this.events = this.events.slice(-this.maxSize);
+        }
+        // Trim events outside the sliding window
+        const cutoff = Date.now() - this.windowMs;
+        this.events = this.events.filter((e) => new Date(e.timestamp).getTime() >= cutoff);
+    }
+    /** Check if cooldown has elapsed since last submission. */
+    canSubmit(cooldownMs) {
+        return Date.now() - this.lastSubmitTime >= cooldownMs;
+    }
+    /** Mark that a submission was made. */
+    markSubmitted() {
+        this.lastSubmitTime = Date.now();
+    }
+    /** Get the current buffer size. */
+    get size() {
+        return this.events.length;
+    }
+    /**
+     * Compute a trajectory summary from the current buffer.
+     */
+    toSummary(activeSopIds, budgetUtilization) {
+        const tools = this.events.map((e) => e.toolName);
+        const uniqueTools = [...new Set(tools)];
+        const totalTokens = this.events.reduce((sum, e) => sum + e.inputTokens + e.outputTokens + (e.reasoningTokens ?? 0), 0);
+        const errorCount = this.events.filter((e) => e.status === 'error').length;
+        // Calculate velocities
+        const windowStartMs = this.events.length > 0
+            ? new Date(this.events[0].timestamp).getTime()
+            : Date.now();
+        const windowEndMs = this.events.length > 0
+            ? new Date(this.events[this.events.length - 1].timestamp).getTime()
+            : Date.now();
+        const windowMinutes = Math.max(1, (windowEndMs - windowStartMs) / 60_000);
+        const tokenVelocity = totalTokens / windowMinutes;
+        const toolCallVelocity = this.events.length / windowMinutes;
+        // Detect consecutive identical calls
+        let maxConsecutive = 0;
+        let currentConsecutive = 1;
+        for (let i = 1; i < tools.length; i++) {
+            if (tools[i] === tools[i - 1]) {
+                currentConsecutive++;
+                maxConsecutive = Math.max(maxConsecutive, currentConsecutive);
+            }
+            else {
+                currentConsecutive = 1;
+            }
+        }
+        // Detect model switches
+        const models = this.events.map((e) => e.model);
+        let modelSwitches = 0;
+        for (let i = 1; i < models.length; i++) {
+            if (models[i] !== models[i - 1])
+                modelSwitches++;
+        }
+        return {
+            sessionId: this.sessionId,
+            workspaceId: this.workspaceId,
+            windowStartedAt: this.events[0]?.timestamp ?? new Date().toISOString(),
+            windowEndedAt: this.events[this.events.length - 1]?.timestamp ?? new Date().toISOString(),
+            toolCallCount: this.events.length,
+            uniqueTools,
+            totalTokens,
+            modelSwitches,
+            errorCount,
+            tokenVelocity,
+            toolCallVelocity,
+            maxConsecutiveIdenticalCalls: maxConsecutive,
+            activeSopIds,
+            budgetUtilization,
+        };
+    }
+}
+// ─── Monitor Controller ─────────────────────────────────────────────
+/**
+ * Trajectory Monitor controller.
+ *
+ * Manages per-session buffers, subscribes to trace events via Valkey pub/sub,
+ * and periodically submits summaries to the control plane for analysis.
+ */
+export class TrajectoryMonitor {
+    config;
+    buffers = new Map();
+    submitTimer = null;
+    running = false;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Start the monitor — subscribe to Valkey and begin periodic submission.
+     */
+    async start() {
+        if (this.running) {
+            log.warn('trajectory_monitor already running');
+            return;
+        }
+        this.running = true;
+        const submitIntervalMs = this.config.submitIntervalMs ?? 60_000;
+        log.info({ submitIntervalMs, windowMs: this.config.windowMs ?? 300_000 }, 'Starting trajectory monitor');
+        // Start periodic summary submission
+        this.submitTimer = setInterval(() => {
+            void this.submitAllSummaries();
+        }, submitIntervalMs);
+        // Note: Valkey subscription is handled by the sync-daemon's existing
+        // Redis subscriber. Events are forwarded to this worker via postMessage.
+        // See LLD #52 §4.1 for the worker thread lifecycle.
+    }
+    /**
+     * Stop the monitor and clean up resources.
+     */
+    stop() {
+        if (this.submitTimer) {
+            clearInterval(this.submitTimer);
+            this.submitTimer = null;
+        }
+        this.buffers.clear();
+        this.running = false;
+        log.info('Trajectory monitor stopped');
+    }
+    /**
+     * Process an incoming trace event from the Valkey pub/sub stream.
+     * Called by the sync-daemon when a trace:live event is received.
+     */
+    handleTraceEvent(event) {
+        // Apply session filter if configured
+        if (this.config.sessionFilter?.length &&
+            !this.config.sessionFilter.includes(event.sessionId)) {
+            return;
+        }
+        let buffer = this.buffers.get(event.sessionId);
+        if (!buffer) {
+            buffer = new TrajectoryBuffer(event.sessionId, event.workspaceId, this.config.maxBufferSize ?? 500, this.config.windowMs ?? 300_000);
+            this.buffers.set(event.sessionId, buffer);
+        }
+        buffer.push(event);
+        // Immediate submission for critical signals
+        if (event.status === 'error' && buffer.size > 3) {
+            void this.submitSummary(buffer);
+        }
+    }
+    /**
+     * Submit summaries for all active session buffers.
+     */
+    async submitAllSummaries() {
+        const cooldownMs = this.config.submitIntervalMs ?? 60_000;
+        // Drain any cached offline trajectories first
+        await this.drainOfflineTrajectories();
+        for (const buffer of this.buffers.values()) {
+            if (buffer.size === 0 || !buffer.canSubmit(cooldownMs))
+                continue;
+            await this.submitSummary(buffer);
+        }
+        // Clean up empty/stale buffers
+        for (const [sessionId, buffer] of this.buffers.entries()) {
+            if (buffer.size === 0) {
+                this.buffers.delete(sessionId);
+            }
+        }
+    }
+    /**
+     * Submit a single session's trajectory summary to the control plane.
+     */
+    async submitSummary(buffer) {
+        const summary = buffer.toSummary([], 0); // SOPs and budget filled by CP
+        const offlineFile = path.join(os.homedir(), '.intutic', 'events', 'offline-trajectories.jsonl');
+        try {
+            const res = await fetch(`${this.config.controlPlaneUrl}/api/v1/trajectory/analyze`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${this.config.apiKey}`,
+                },
+                body: JSON.stringify(summary),
+                signal: AbortSignal.timeout(10_000), // 10s timeout
+            });
+            buffer.markSubmitted();
+            if (!res.ok) {
+                log.warn({ sessionId: buffer.sessionId, status: res.status }, `Trajectory submission failed: ${res.status}, buffering offline`);
+                this.saveOffline(summary, offlineFile);
+                return;
+            }
+            const verdict = (await res.json());
+            log.debug({ sessionId: buffer.sessionId, state: verdict.state, verdict: verdict.verdict }, `Trajectory verdict: ${verdict.verdict}`);
+        }
+        catch (err) {
+            log.debug({ err, sessionId: buffer.sessionId }, 'Trajectory submission error (buffering offline)');
+            buffer.markSubmitted();
+            this.saveOffline(summary, offlineFile);
+        }
+    }
+    saveOffline(summary, filePath) {
+        try {
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.appendFileSync(filePath, JSON.stringify(summary) + '\n', 'utf-8');
+        }
+        catch (err) {
+            log.error({ err }, 'Failed to write offline trajectory');
+        }
+    }
+    async drainOfflineTrajectories() {
+        const offlineFile = path.join(os.homedir(), '.intutic', 'events', 'offline-trajectories.jsonl');
+        if (!fs.existsSync(offlineFile))
+            return;
+        try {
+            const raw = fs.readFileSync(offlineFile, 'utf-8');
+            const lines = raw.split('\n').map(l => l.trim()).filter(Boolean);
+            if (lines.length === 0)
+                return;
+            log.info({ count: lines.length }, 'Attempting to drain offline trajectories');
+            const remaining = [];
+            for (const line of lines) {
+                try {
+                    const summary = JSON.parse(line);
+                    const res = await fetch(`${this.config.controlPlaneUrl}/api/v1/trajectory/analyze`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            Authorization: `Bearer ${this.config.apiKey}`,
+                        },
+                        body: JSON.stringify(summary),
+                        signal: AbortSignal.timeout(5000),
+                    });
+                    if (!res.ok) {
+                        remaining.push(line);
+                    }
+                }
+                catch {
+                    remaining.push(line);
+                }
+            }
+            if (remaining.length > 0) {
+                fs.writeFileSync(offlineFile, remaining.join('\n') + '\n', 'utf-8');
+            }
+            else {
+                fs.unlinkSync(offlineFile);
+            }
+        }
+        catch (err) {
+            log.error({ err }, 'Failed to drain offline trajectories');
+        }
+    }
+    /** Get the number of active session buffers. */
+    get activeSessionCount() {
+        return this.buffers.size;
+    }
+}
+//# sourceMappingURL=trajectoryMonitor.js.map

package/dist/trajectoryMonitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trajectoryMonitor.js","sourceRoot":"","sources":["../src/trajectoryMonitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAmC9C,uEAAuE;AAEvE;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAOhB;IACA;IAPH,MAAM,GAAiB,EAAE,CAAA;IAChB,OAAO,CAAQ;IACf,QAAQ,CAAQ;IACzB,cAAc,GAAG,CAAC,CAAA;IAE1B,YACW,SAAiB,EACjB,WAAmB,EAC5B,OAAO,GAAG,GAAG,EACb,QAAQ,GAAG,OAAO;QAHT,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QAI5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,KAAiB;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEvB,mBAAmB;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChD,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,CACjD,CAAA;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,UAAU,CAAA;IACvD,CAAC;IAED,uCAAuC;IACvC,aAAa;QACX,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAClC,CAAC;IAED,mCAAmC;IACnC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,YAAsB,EAAE,iBAAyB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,EAC3E,CAAC,CACF,CAAA;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;QAEzE,uBAAuB;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1C,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;YAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;YACnE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACd,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,GAAG,aAAa,CAAC,GAAG,MAAM,CAAC,CAAA;QAEzE,MAAM,aAAa,GAAG,WAAW,GAAG,aAAa,CAAA;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,aAAa,CAAA;QAE3D,qCAAqC;QACrC,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9B,kBAAkB,EAAE,CAAA;gBACpB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;YAC/D,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,aAAa,GAAG,CAAC,CAAA;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,aAAa,EAAE,CAAA;QAClD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACjC,WAAW;YACX,WAAW;YACX,aAAa;YACb,UAAU;YACV,aAAa;YACb,gBAAgB;YAChB,4BAA4B,EAAE,cAAc;YAC5C,YAAY;YACZ,iBAAiB;SAClB,CAAA;IACH,CAAC;CACF;AAoBD,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAKC;IAJrB,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC7C,WAAW,GAA0C,IAAI,CAAA;IACzD,OAAO,GAAG,KAAK,CAAA;IAEvB,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;IAAG,CAAC;IAEhE;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YAC9C,OAAM;QACR,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAA;QAE/D,GAAG,CAAC,IAAI,CACN,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,EAAE,EAC/D,6BAA6B,CAC9B,CAAA;QAED,oCAAoC;QACpC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAChC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAEpB,qEAAqE;QACrE,yEAAyE;QACzE,oDAAoD;IACtD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACxC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,KAAiB;QAChC,qCAAqC;QACrC,IACE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM;YACjC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EACpD,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,gBAAgB,CAC3B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,EAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAChC,CAAA;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAElB,4CAA4C;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAA;QAEzD,8CAA8C;QAC9C,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAA;QAErC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,SAAQ;YAChE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;QAED,+BAA+B;QAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAwB;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,+BAA+B;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QAE/F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,4BAA4B,EAC1D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc;aACpD,CACF,CAAA;YAED,MAAM,CAAC,aAAa,EAAE,CAAA;YAEtB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CACN,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACnD,iCAAiC,GAAG,CAAC,MAAM,qBAAqB,CACjE,CAAA;gBACD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAA;YACxE,GAAG,CAAC,KAAK,CACP,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC/E,uBAAuB,OAAO,CAAC,OAAO,EAAE,CACzC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,iDAAiD,CAAC,CAAA;YAClG,MAAM,CAAC,aAAa,EAAE,CAAA;YACtB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAiC,EAAE,QAAgB;QACrE,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACzD,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QAC/F,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAM;QAEvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACjD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAE9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAA;YAC7E,MAAM,SAAS,GAAa,EAAE,CAAA;YAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,4BAA4B,EAC1D;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;yBAC9C;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;qBAClC,CACF,CAAA;oBACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACtB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;YACrE,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF"}

package/dist/watcher/driftWatcher.d.ts

@@ -0,0 +1,25 @@
+/**
+ * driftWatcher.ts — Filesystem watcher for detecting config file drift.
+ *
+ * Uses chokidar to monitor active harness configuration files in real time.
+ * When changes are detected, it notifies the daemon via a callback to trigger
+ * validation against the integrity baseline.
+ *
+ * LLD #14 — driftWatcher.ts
+ * HLD §3.14 — Real-Time State Mirroring (Filesystem integrity checks)
+ *
+ * @module
+ */
+import type { HarnessType } from '@intutic/shared-types';
+/**
+ * Initializes file watches on harness configurations.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param harnesses - Harness types to watch.
+ * @param onChange - Callback triggered when a watched file is modified or deleted.
+ * @returns An object with a `stop` function to close the watcher.
+ */
+export declare function startWatcher(workspaceRoot: string, harnesses: HarnessType[], onChange: (filePath: string) => Promise<void>): {
+    stop: () => void;
+};
+//# sourceMappingURL=driftWatcher.d.ts.map

package/dist/watcher/driftWatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driftWatcher.d.ts","sourceRoot":"","sources":["../../src/watcher/driftWatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAMxD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,EACxB,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAC5C;IAAE,IAAI,EAAE,MAAM,IAAI,CAAA;CAAE,CAmDtB"}

package/dist/watcher/driftWatcher.js

@@ -0,0 +1,72 @@
+/**
+ * driftWatcher.ts — Filesystem watcher for detecting config file drift.
+ *
+ * Uses chokidar to monitor active harness configuration files in real time.
+ * When changes are detected, it notifies the daemon via a callback to trigger
+ * validation against the integrity baseline.
+ *
+ * LLD #14 — driftWatcher.ts
+ * HLD §3.14 — Real-Time State Mirroring (Filesystem integrity checks)
+ *
+ * @module
+ */
+import chokidar from 'chokidar';
+import * as node_path from 'node:path';
+import { HARNESS_FILES } from '../configWriter.js';
+import { createLogger } from '@intutic/logger';
+import { buildProtectedPaths } from './settingsGuard.js';
+const log = createLogger('sync-drift-watcher');
+/**
+ * Initializes file watches on harness configurations.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param harnesses - Harness types to watch.
+ * @param onChange - Callback triggered when a watched file is modified or deleted.
+ * @returns An object with a `stop` function to close the watcher.
+ */
+export function startWatcher(workspaceRoot, harnesses, onChange) {
+    const filePaths = harnesses
+        .map((h) => HARNESS_FILES[h])
+        .filter((f) => !!f)
+        .map((f) => node_path.join(workspaceRoot, f));
+    // Also watch git-context.json for real-time Git metadata updates
+    filePaths.push(node_path.join(workspaceRoot, '.intutic', 'git-context.json'));
+    // Also watch session-context.json for real-time active sops/judging updates
+    filePaths.push(node_path.join(workspaceRoot, '.intutic', 'session-context.json'));
+    // Watch .intutic/sops directory itself (and child directories/files) for real-time rules updates
+    filePaths.push(node_path.join(workspaceRoot, '.intutic', 'sops'));
+    // Watch ALL governance config paths across all 18 supported harnesses.
+    // Any change (edit or delete) triggers the settingsGuard pipeline which
+    // validates and restores the file within one poll cycle.
+    const protectedPaths = buildProtectedPaths(workspaceRoot);
+    for (const p of protectedPaths) {
+        if (!filePaths.includes(p))
+            filePaths.push(p);
+    }
+    log.info({ action: 'start_watcher', fileCount: filePaths.length }, `Starting filesystem watcher for ${filePaths.length} governed paths across all harnesses`);
+    const watcher = chokidar.watch(filePaths, {
+        persistent: true,
+        ignoreInitial: true, // Only care about modifications post-start
+        awaitWriteFinish: {
+            stabilityThreshold: 200,
+            pollInterval: 100,
+        },
+    });
+    watcher.on('all', (event, path) => {
+        if (event === 'change' || event === 'unlink') {
+            log.debug({ action: 'watcher_change_detected', event, path }, 'Governed file change detected');
+            onChange(path).catch((err) => {
+                log.error({ action: 'watcher_on_change_error', err, path }, 'Error in watcher onChange handler');
+            });
+        }
+    });
+    return {
+        stop: () => {
+            log.info({ action: 'stop_watcher' }, 'Stopping filesystem watcher');
+            watcher.close().catch((err) => {
+                log.warn({ action: 'watcher_close_error', err }, 'Error closing filesystem watcher');
+            });
+        },
+    };
+}
+//# sourceMappingURL=driftWatcher.js.map

package/dist/watcher/driftWatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driftWatcher.js","sourceRoot":"","sources":["../../src/watcher/driftWatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,SAAwB,EACxB,QAA6C;IAE7C,MAAM,SAAS,GAAG,SAAS;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/C,iEAAiE;IACjE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAE7E,4EAA4E;IAC5E,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAA;IAEjF,iGAAiG;IACjG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IAEjE,uEAAuE;IACvE,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,cAAc,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,mCAAmC,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAA;IAE7J,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE;QACxC,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI,EAAE,2CAA2C;QAChE,gBAAgB,EAAE;YAChB,kBAAkB,EAAE,GAAG;YACvB,YAAY,EAAE,GAAG;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC9F,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAA;YAClG,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,6BAA6B,CAAC,CAAA;YACnE,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,kCAAkC,CAAC,CAAA;YACtF,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/watcher/settingsGuard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * settingsGuard.ts — Multi-harness governance config tamper detection & restoration.
+ *
+ * Expanded from Claude Code-only to cover all 18 Intutic-supported harnesses.
+ * Called by the drift watcher whenever any protected governance config file changes.
+ *
+ * Behaviour per path type:
+ *   - JSON hook files (Cursor, Cline, OpenHands, Goose): validate marker presence, restore.
+ *   - Immutable files (Goose plugin): log governance_override_attempt incident instead of restoring.
+ *   - Text rules (.roorules, .clinerules): restore from last-written hash.
+ *   - Settings files (VS Code, Aider, claude_desktop_config.json): detect drift, restore.
+ *
+ * LLD #14 — settingsGuard.ts
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import type { SyncSopEntry } from '@intutic/shared-types';
+/** Returns the full list of protected paths to watch. */
+export declare function buildProtectedPaths(workspaceRoot: string): string[];
+/**
+ * Inspect any protected governance config file and restore if tampered.
+ *
+ * @param changedPath  - Absolute path of the file that changed.
+ * @param workspaceRoot - Workspace root for restoration helpers.
+ * @param sops          - Current SOP list.
+ * @param proxyUrl      - Current proxy URL.
+ * @param settings      - Optional passthrough settings.
+ * @returns true if tampering was detected.
+ */
+export declare function guardSettingsFile(changedPath: string, workspaceRoot: string, sops: SyncSopEntry[], proxyUrl?: string, settings?: Record<string, unknown>): Promise<boolean>;
+//# sourceMappingURL=settingsGuard.d.ts.map

package/dist/watcher/settingsGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settingsGuard.d.ts","sourceRoot":"","sources":["../../src/watcher/settingsGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAkBzD,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BnE;AAID;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,SAAK,EACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,OAAO,CAAC,CA2FlB"}