@intutic/sync-daemon 1.9.0 → 1.10.1

package/dist/sessionReporter.js

@@ -0,0 +1,140 @@
+/**
+ * sessionReporter.ts — turn harness detection into real control-plane
+ * sessions.
+ *
+ * The full-fidelity session path (POST /api/v1/sessions — branch/commit
+ * capture and the Jira/Linear/GitHub task-context cascade) had no production
+ * caller: sessions only ever existed as synthetic `ssp_` rows minted
+ * server-side. The daemon knows everything the route wants — workspace root,
+ * harness, git branch and commit — so it reports them once per harness per
+ * daemon run when the harness is first detected.
+ *
+ * WHICH row it reports them onto (TD-231, Wave 5.6): when a local proxy is
+ * reachable, the caller passes that process's `proxyInstanceId` and the
+ * control plane puts the context on the proxy's OWN row — the
+ * `ssp_<ws>_<harness>_<instance>` session it derives for that process's
+ * traces, so the branch, the task and the cost sit on one row (AI intensity
+ * reads them together) and the hook gate's blocks resolve to the same row.
+ * That row's lifecycle stays the control plane's 30-minute idle rule; the
+ * daemon never ends it, because an externally started proxy keeps serving
+ * after the daemon stops and an ended row would vanish from Active Sessions
+ * and from the hook gate's resolver while traces still attach to it. A
+ * respawned proxy has a new instance id, so it gets a new row on the next
+ * iteration. Without an instance id (no local proxy, or a shared gateway —
+ * `fetchLocalProxyInstanceId` refuses a `gw_` id) the daemon opens a `ses_`
+ * STANDARD row as before and ends it on shutdown
+ * (PATCH /api/v1/sessions/:id/end).
+ *
+ * Dedupe lives here (module state keyed workspace+harness+instance), so
+ * callers — `startSyncLoop`'s iteration as well as the CLI's inline connect
+ * loop — can call `startHarnessSession` every iteration and only the first
+ * one POSTs. Git context is captured once per key, not on a branch switch.
+ * Everything is best-effort: a dead control plane costs a warning, never the
+ * sync loop.
+ *
+ * @module
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { newIso } from '@intutic/id';
+const execFileP = promisify(execFile);
+/**
+ * sessionIds this daemon run opened AND owns the lifecycle of — the `ses_`
+ * rows `endAllOpenSessions` ends. Keyed `${workspaceId}:${harness}:`.
+ */
+const openSessions = new Map();
+/**
+ * Proxy rows this run registered context onto, keyed
+ * `${workspaceId}:${harness}:${proxyInstanceId}`. Dedupe only — never ended.
+ */
+const registeredProxyRows = new Map();
+/** Keys with a POST in flight or already attempted (success or not) — one try per run. */
+const attempted = new Set();
+/** Best-effort git context from the workspace root. */
+export async function readGitInfo(workspaceRoot) {
+    const git = async (...args) => {
+        try {
+            const { stdout } = await execFileP('git', args, { cwd: workspaceRoot, timeout: 3_000 });
+            const out = stdout.trim();
+            return out.length > 0 ? out : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const [branchName, commitHash, commitMessage] = await Promise.all([
+        git('rev-parse', '--abbrev-ref', 'HEAD'),
+        git('rev-parse', 'HEAD'),
+        git('log', '-1', '--format=%s'),
+    ]);
+    return { branchName, commitHash, commitMessage };
+}
+/**
+ * Report a harness session once per run — onto the local proxy's own row when
+ * `proxyInstanceId` is given (see the module doc), else as a new `ses_` row.
+ * Returns the sessionId when one is known (new or previously created).
+ */
+export async function startHarnessSession(opts) {
+    const key = `${opts.workspaceId}:${opts.harnessType}:${opts.proxyInstanceId ?? ''}`;
+    const existing = opts.proxyInstanceId ? registeredProxyRows.get(key) : openSessions.get(key);
+    if (existing)
+        return existing;
+    if (attempted.has(key))
+        return null;
+    attempted.add(key);
+    try {
+        const git = await readGitInfo(opts.workspaceRoot);
+        const res = await fetch(`${opts.controlPlaneUrl}/api/v1/sessions`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${opts.apiKey}` },
+            body: JSON.stringify({
+                workspaceId: opts.workspaceId,
+                harnessType: opts.harnessType,
+                ...(opts.agentRole ? { agentRole: opts.agentRole } : {}),
+                ...(opts.proxyInstanceId ? { proxyInstanceId: opts.proxyInstanceId } : {}),
+                ...git,
+                reportedAt: newIso(),
+            }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok) {
+            console.warn(`[sync-daemon] startHarnessSession failed for ${opts.harnessType}: ${res.status}`);
+            return null;
+        }
+        const body = (await res.json());
+        if (body.sessionId) {
+            ;
+            (opts.proxyInstanceId ? registeredProxyRows : openSessions).set(key, body.sessionId);
+            return body.sessionId;
+        }
+        return null;
+    }
+    catch (err) {
+        console.warn(`[sync-daemon] startHarnessSession error for ${opts.harnessType}:`, err instanceof Error ? err.message : err);
+        return null;
+    }
+}
+/**
+ * End every `ses_` session this run opened. Called from shutdown paths. Proxy
+ * rows registered through `proxyInstanceId` are forgotten, not ended — the
+ * module doc says why.
+ */
+export async function endAllOpenSessions(controlPlaneUrl, apiKey) {
+    const entries = [...openSessions.entries()];
+    openSessions.clear();
+    registeredProxyRows.clear();
+    attempted.clear();
+    await Promise.allSettled(entries.map(async ([, sessionId]) => {
+        try {
+            await fetch(`${controlPlaneUrl}/api/v1/sessions/${sessionId}/end`, {
+                method: 'PATCH',
+                headers: { Authorization: `Bearer ${apiKey}` },
+                signal: AbortSignal.timeout(5_000),
+            });
+        }
+        catch {
+            // shutdown is not the time to retry
+        }
+    }));
+}
+//# sourceMappingURL=sessionReporter.js.map

package/dist/sessionReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionReporter.js","sourceRoot":"","sources":["../src/sessionReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAErC;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAC9C;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;AACrD,0FAA0F;AAC1F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;AAQnC,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,aAAqB;IACrD,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,IAAc,EAA+B,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;YACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;QACxC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC;QACxB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC;KAChC,CAAC,CAAA;IACF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAazC;IACC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAA;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5F,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,kBAAkB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;YACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,GAAG;gBACN,UAAU,EAAE,MAAM,EAAE;aACrB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;QACzD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,CAAC;YAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACrF,OAAO,IAAI,CAAC,SAAS,CAAA;QACvB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,+CAA+C,IAAI,CAAC,WAAW,GAAG,EAClE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,eAAuB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3C,YAAY,CAAC,KAAK,EAAE,CAAA;IACpB,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAC3B,SAAS,CAAC,KAAK,EAAE,CAAA;IACjB,MAAM,OAAO,CAAC,UAAU,CACtB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,eAAe,oBAAoB,SAAS,MAAM,EAAE;gBACjE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;gBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/skillWriter.d.ts

@@ -15,7 +15,7 @@
 /** Workspace-relative path the rule-author skill is written to. */
 export declare const RULE_AUTHOR_SKILL_PATH: string;
 /** Embedded copy of .agents/skills/intutic-rule-author/SKILL.md (canonical). */
-export declare const RULE_AUTHOR_SKILL = "---\nname: intutic-rule-author\ndescription: Convert natural-language business rules into compiled WASM governance policies enforced by the local Intutic proxy \u2014 author, compile, dry-run, and install rules without a control plane.\n---\n\n# \uD83D\uDCDC Rule Author \u2014 Business Rules as Enforced WASM Policies\n\nUse this skill whenever the user states a rule that AI agent traffic must obey \u2014 \"block any agent call that touches the prod database\", \"kill requests once the session budget drops below $1\", \"never allow shell tool calls containing rm -rf\". You convert the rule into an AssemblyScript policy, compile it to WebAssembly, dry-run it against mock contexts, and install it into the local Intutic proxy. The proxy hot-loads it within ~5 seconds and enforces it on every intercepted LLM request.\n\n## 1. The contract your rule sees\n\nThe proxy calls `evaluate(offset, len)` with a JSON-serialized `RequestContext`:\n\n```jsonc\n{\n  \"session_id\": \"sess_x\", \"workspace_id\": \"ws_x\", \"virtual_key_prefix\": \"vk_x\",\n  \"model\": \"claude-3-5-sonnet\",\n  \"tools\": [{ \"name\": \"bash\", \"description\": \"run shell commands\" }],\n  \"tool_calls\": [{ \"id\": \"t1\", \"name\": \"bash\", \"arguments\": {} }],\n  \"estimated_input_tokens\": 1200,\n  \"budget_remaining_usd\": 4.25,\n  \"risk_tier\": \"Low\",\n  \"dlp_findings\": [{ \"category\": \"secret\", \"pattern_name\": \"aws_key\", \"action\": \"block\", \"offset\": 0, \"length\": 20 }],\n  \"tool_sequence\": [\"read_file\", \"bash\"]\n}\n```\n\n`risk_tier` is one of `Low | Medium | High | Critical`. Return an `i32` verdict: `0` = ALLOW, `1` = BLOCK, `2` = REDACT (treated as block).\n\n## 2. Author\n\nStart from the `@intutic/wasm-sdk` template (`packages/wasm-sdk/` in the open-core repo). Add one function per business rule and call it from `runRules()` in `assembly/index.ts`.\n\nSandbox constraints \u2014 violating them silently disables the rule (the proxy **fails open**):\n\n- 5 ms wall-clock budget, 1,000,000 fuel, 16 MB memory.\n- Keep logic simple: no unbounded loops over `arguments`, no recursion, no I/O (none exists in the sandbox).\n- Host imports are limited to `env.log_info`, `env.trace`, `env.abort`, `env.seed`, and the `onnx_rules.runOnnxInference` stub.\n\n## 3. Compile\n\n```bash\nintutic policy compile --src assembly/index.ts --out build/rule.wasm\n```\n\nRequires AssemblyScript in the project: `pnpm add -D assemblyscript assemblyscript-json`.\n\n## 4. Dry-run \u2014 required before install\n\nAuthor BOTH mock contexts and verify both outcomes before installing:\n\n```bash\nintutic policy test --wasm build/rule.wasm --mock should-block.json\nintutic policy test --wasm build/rule.wasm --mock should-allow.json\n```\n\nThe first must report BLOCK, the second ALLOW. A rule that blocks everything is as broken as one that blocks nothing.\n\n## 5. Install\n\n```bash\nintutic policy install --wasm build/rule.wasm --name block-prod-db --priority 50\nintutic policy list-local\n```\n\nRules install to `~/.intutic/wasm/` as `NN_name.wasm` (lower `NN` runs first; default 100). The proxy picks up changes within ~5 s on the next request \u2014 no restart needed.\n\n## 6. Guardrails\n\n- **Never embed secrets** (API keys, tokens, passwords) in rule sources or mock contexts \u2014 `intutic skill audit` flags them.\n- **Local rules cannot weaken central rules.** Verdicts merge most-restrictive-wins: a KILL from any rule \u2014 local or centrally synced \u2014 ends the request. \"Allow-override\" rules are no-ops by design; do not author them.\n- Keep rule sources (`assembly/*.ts`, mock JSON files) in version control alongside the workspace.\n";
+export declare const RULE_AUTHOR_SKILL = "---\nname: intutic-rule-author\ndescription: Convert natural-language business rules into compiled WASM governance policies enforced by the local Intutic proxy \u2014 author, compile, dry-run, and install rules without a control plane.\n---\n\n# \uD83D\uDCDC Rule Author \u2014 Business Rules as Enforced WASM Policies\n\nUse this skill whenever the user states a rule that AI agent traffic must obey \u2014 \"block any agent call that touches the prod database\", \"kill requests once the session budget drops below $1\", \"never allow shell tool calls containing rm -rf\". You convert the rule into an AssemblyScript policy, compile it to WebAssembly, dry-run it against mock contexts, and install it into the local Intutic proxy. The proxy hot-loads it within ~5 seconds and enforces it on every intercepted LLM request.\n\n**The other way you get here is `/fix`.** That proxy command scores the workspace's governance posture and, when it finds no custom policy, recommends: *\"Add a WASM rule under `~/.intutic/wasm` to codify a custom guardrail.\"* When that recommendation is the prompt, the rule to author is the gap `/fix` found \u2014 ask the user which specific behaviour they want blocked rather than writing a generic rule, then run `/fix` again after installing to confirm the posture score moved. If it did not, the rule is not loading: check `intutic policy list-local` and the sandbox constraints in \u00A72, since a rule that violates them is silently disabled.\n\n## 1. The contract your rule sees\n\nThe proxy calls `evaluate(offset, len)` with a JSON-serialized `RequestContext`:\n\n```jsonc\n{\n  \"session_id\": \"sess_x\", \"workspace_id\": \"ws_x\", \"virtual_key_prefix\": \"vk_x\",\n  \"model\": \"claude-3-5-sonnet\",\n  \"tools\": [{ \"name\": \"bash\", \"description\": \"run shell commands\" }],\n  \"tool_calls\": [{ \"id\": \"t1\", \"name\": \"bash\", \"arguments\": {} }],\n  \"estimated_input_tokens\": 1200,\n  \"budget_remaining_usd\": 4.25,\n  \"risk_tier\": \"Low\",\n  \"dlp_findings\": [{ \"category\": \"secret\", \"pattern_name\": \"aws_access_key\", \"action\": \"redact\", \"offset\": 0, \"length\": 20 }],\n  \"tool_sequence\": [\"read_file\", \"bash\"]\n}\n```\n\n`risk_tier` is one of `Low | Medium | High | Critical`. Return an `i32` verdict: `0` = ALLOW, `1` = BLOCK, `3` = REASK (refuse this attempt, tell the agent why, let it retry). `2` is deprecated \u2014 the guest never receives the request body, so redaction was never expressible; the proxy maps it to a block. Prefer `3` over `1` for any finding that is a pattern match, because pattern matches produce false positives.\n\n## 2. Author\n\nStart from the `@intutic/wasm-sdk` template (`packages/wasm-sdk/` in the open-core repo). Add one function per business rule and call it from `runRules()` in `assembly/index.ts`.\n\nSandbox constraints \u2014 violating them silently disables the rule (the proxy **fails open**):\n\n- 5 ms wall-clock budget, 1,000,000 fuel, 16 MB memory.\n- Keep logic simple: no unbounded loops over `arguments`, no recursion, no I/O (none exists in the sandbox).\n- Host imports are limited to `env.log_info`, `env.trace`, `env.abort` and `env.read_referenced_file` (reads the bytes of a file the host already resolved before the sandbox existed \u2014 not a filesystem import, and it cannot be used to browse). A rule importing anything else cannot link, so it is refused at `intutic policy install` and refused again when the proxy loads it.\n- **`Math.random()` is unavailable.** AssemblyScript compiles it to an `env.seed` import the proxy does not provide. This list previously named `env.seed`, and a rule using randomness installed clean and then failed to link on every request \u2014 enforcing nothing, silently. Beyond the missing import, a verdict that samples is not a verdict: the same request would get different answers, and the audit trail would not explain either.\n\n## 3. Compile\n\n```bash\nintutic policy compile --src assembly/index.ts --out build/rule.wasm\n```\n\nRequires AssemblyScript in the project: `pnpm add -D assemblyscript assemblyscript-json`.\n\n## 4. Dry-run \u2014 required before install\n\nAuthor BOTH mock contexts and verify both outcomes before installing:\n\n```bash\nintutic policy test --wasm build/rule.wasm --mock should-block.json\nintutic policy test --wasm build/rule.wasm --mock should-allow.json\n```\n\nThe first must report BLOCK, the second ALLOW. A rule that blocks everything is as broken as one that blocks nothing.\n\n## 5. Install\n\n```bash\nintutic policy install --wasm build/rule.wasm --name block-prod-db --priority 50\nintutic policy list-local\n```\n\nRules install to `~/.intutic/wasm/` as `NN_name.wasm` (lower `NN` runs first; default 100). The proxy picks up changes within ~5 s on the next request \u2014 no restart needed.\n\n## 6. Guardrails\n\n- **Never embed secrets** (API keys, tokens, passwords) in rule sources or mock contexts \u2014 `intutic skill audit` flags them.\n- **Local rules cannot weaken central rules.** Verdicts merge most-restrictive-wins: a KILL from any rule \u2014 local or centrally synced \u2014 ends the request. \"Allow-override\" rules are no-ops by design; do not author them.\n- Keep rule sources (`assembly/*.ts`, mock JSON files) in version control alongside the workspace.\n";
 /**
  * Write bundled skills into the workspace, skipping any that already exist.
  * Returns the paths written (empty when everything was already present).

package/dist/skillWriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skillWriter.d.ts","sourceRoot":"","sources":["../src/skillWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,QAKlC,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,wmHAwE7B,CAAA;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAejF"}
+{"version":3,"file":"skillWriter.d.ts","sourceRoot":"","sources":["../src/skillWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,QAKlC,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,0sKA2E7B,CAAA;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAejF"}

package/dist/skillWriter.js

@@ -26,6 +26,8 @@ description: Convert natural-language business rules into compiled WASM governan
 
 Use this skill whenever the user states a rule that AI agent traffic must obey — "block any agent call that touches the prod database", "kill requests once the session budget drops below $1", "never allow shell tool calls containing rm -rf". You convert the rule into an AssemblyScript policy, compile it to WebAssembly, dry-run it against mock contexts, and install it into the local Intutic proxy. The proxy hot-loads it within ~5 seconds and enforces it on every intercepted LLM request.
 
+**The other way you get here is \`/fix\`.** That proxy command scores the workspace's governance posture and, when it finds no custom policy, recommends: *"Add a WASM rule under \`~/.intutic/wasm\` to codify a custom guardrail."* When that recommendation is the prompt, the rule to author is the gap \`/fix\` found — ask the user which specific behaviour they want blocked rather than writing a generic rule, then run \`/fix\` again after installing to confirm the posture score moved. If it did not, the rule is not loading: check \`intutic policy list-local\` and the sandbox constraints in §2, since a rule that violates them is silently disabled.
+
 ## 1. The contract your rule sees
 
 The proxy calls \`evaluate(offset, len)\` with a JSON-serialized \`RequestContext\`:
@@ -39,12 +41,12 @@ The proxy calls \`evaluate(offset, len)\` with a JSON-serialized \`RequestContex
   "estimated_input_tokens": 1200,
   "budget_remaining_usd": 4.25,
   "risk_tier": "Low",
-  "dlp_findings": [{ "category": "secret", "pattern_name": "aws_key", "action": "block", "offset": 0, "length": 20 }],
+  "dlp_findings": [{ "category": "secret", "pattern_name": "aws_access_key", "action": "redact", "offset": 0, "length": 20 }],
   "tool_sequence": ["read_file", "bash"]
 }
 \`\`\`
 
-\`risk_tier\` is one of \`Low | Medium | High | Critical\`. Return an \`i32\` verdict: \`0\` = ALLOW, \`1\` = BLOCK, \`2\` = REDACT (treated as block).
+\`risk_tier\` is one of \`Low | Medium | High | Critical\`. Return an \`i32\` verdict: \`0\` = ALLOW, \`1\` = BLOCK, \`3\` = REASK (refuse this attempt, tell the agent why, let it retry). \`2\` is deprecated — the guest never receives the request body, so redaction was never expressible; the proxy maps it to a block. Prefer \`3\` over \`1\` for any finding that is a pattern match, because pattern matches produce false positives.
 
 ## 2. Author
 
@@ -54,7 +56,8 @@ Sandbox constraints — violating them silently disables the rule (the proxy **f
 
 - 5 ms wall-clock budget, 1,000,000 fuel, 16 MB memory.
 - Keep logic simple: no unbounded loops over \`arguments\`, no recursion, no I/O (none exists in the sandbox).
-- Host imports are limited to \`env.log_info\`, \`env.trace\`, \`env.abort\`, \`env.seed\`, and the \`onnx_rules.runOnnxInference\` stub.
+- Host imports are limited to \`env.log_info\`, \`env.trace\`, \`env.abort\` and \`env.read_referenced_file\` (reads the bytes of a file the host already resolved before the sandbox existed — not a filesystem import, and it cannot be used to browse). A rule importing anything else cannot link, so it is refused at \`intutic policy install\` and refused again when the proxy loads it.
+- **\`Math.random()\` is unavailable.** AssemblyScript compiles it to an \`env.seed\` import the proxy does not provide. This list previously named \`env.seed\`, and a rule using randomness installed clean and then failed to link on every request — enforcing nothing, silently. Beyond the missing import, a verdict that samples is not a verdict: the same request would get different answers, and the audit trail would not explain either.
 
 ## 3. Compile
 

package/dist/skillWriter.js.map

@@ -1 +1 @@
-{"version":3,"file":"skillWriter.js","sourceRoot":"","sources":["../src/skillWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,IAAI,CAClD,SAAS,EACT,QAAQ,EACR,qBAAqB,EACrB,UAAU,CACX,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwEhC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IAElE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAA,CAAC,uCAAuC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"skillWriter.js","sourceRoot":"","sources":["../src/skillWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,IAAI,CAClD,SAAS,EACT,QAAQ,EACR,qBAAqB,EACrB,UAAU,CACX,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2EhC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IAElE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAA,CAAC,uCAAuC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/syncLoop.d.ts

@@ -18,7 +18,47 @@
  *
  * @module
  */
-import type { HarnessType, SyncConfigPayload, WorkspaceSettings } from '@intutic/shared-types';
+import type { HarnessType, SyncConfigPayload, WorkspaceSettings, SyncSopEntry } from '@intutic/shared-types';
+import { type GovernanceCoverageInputs } from './configReader.js';
+import { type AgentReport } from './agentReporter.js';
+/**
+ * Turns a non-clean `scanSkillContent` result — already computed as part of
+ * `collectAgentReport`'s `facets.skills` — into a `skill_flagged` hook event
+ * (TD-358).
+ *
+ * Deliberately reuses the report the daemon already built for this cycle
+ * rather than re-scanning: `agentReporter.ts`'s `collectSkills` runs
+ * `scanSkillContent` on every `.agents/skills/**\/SKILL.md` as part of
+ * building `facets.skills` already, so this only turns a result the daemon
+ * already has into a visible signal — it does not add a second scan pass.
+ *
+ * Appends directly to `.intutic/events/hook-events.jsonl`, the SAME file
+ * every emitted PreToolUse gate's `log_event`/`logEvent` writes to and the
+ * SAME mechanism `onDriftDetected` below already uses for `config_tamper` —
+ * not a new event pipeline. `drainHookEvents` (`claudeCodeHooks.ts`) picks
+ * this line up on its next pass exactly like a gate-written one, because it
+ * only ever reads the file; it does not care who appended a given line.
+ *
+ * Report-only, per `scanSkillContent`'s own doc comment on the unmeasured
+ * false-positive rate against real, benign skill markdown: this NEVER
+ * blocks, mutates, or removes a skill. `hookEvents.ts`'s
+ * `HookEventSchema.event` enum (control plane) counts `skill_flagged`
+ * exactly like `tool_flagged` — advisory telemetry, not an incident.
+ *
+ * A failure to append is caught and warned, never thrown: a governance
+ * telemetry write must not be able to abort the sync cycle it rides in on.
+ */
+export declare function emitSkillFlaggedEvents(opts: {
+    workspaceRoot: string;
+    workspaceId: string;
+    harnessType: HarnessType;
+    skills: AgentReport['facets']['skills'];
+    /** Skills already emitted in this cycle, keyed `source:name`, mutated in
+     *  place. A skill is not harness-specific, and the caller invokes this
+     *  once per harness in the workspace — without a shared set, a workspace
+     *  with two active harnesses would double-emit every flagged skill. */
+    alreadyEmitted: Set<string>;
+}): void;
 /** Configuration for the sync loop. */
 export interface SyncLoopOptions {
     /** Control plane base URL (e.g., `https://api.intutic.ai`). */
@@ -37,8 +77,6 @@ export interface SyncLoopOptions {
     onSync?: (result: SyncResult) => void;
     /** AbortSignal to gracefully stop the loop. */
     signal?: AbortSignal;
-    /** Adapter identifier for ContextGraph sync. */
-    adapterId?: string;
 }
 /** Result of a single sync iteration. */
 export interface SyncResult {
@@ -58,6 +96,15 @@ export interface SyncResult {
     proxyUrl?: string;
     /** Active harnesses. */
     harnesses?: HarnessType[];
+    /**
+     * This cycle's per-harness governance-coverage enforcement signals, derived
+     * from the same `collectAgentReport` facets step 5b already computes for
+     * `POST /api/v1/agents/report` — see that step's inline derivation for the
+     * mapping. Consumed by the outer loop's config-capture step to fire
+     * `POST /api/v1/governance-coverage/snapshot` once per harness whose rules
+     * file content actually changed this cycle.
+     */
+    harnessGovernanceInputs?: Partial<Record<HarnessType, GovernanceCoverageInputs>>;
 }
 /**
  * Start the sync loop. This function runs indefinitely until the
@@ -65,6 +112,61 @@ export interface SyncResult {
  *
  * @param options - Sync loop configuration.
  */
+/** The credentials every gate-side refresh takes. */
+export interface GateCacheRefreshOptions {
+    controlPlaneUrl: string;
+    apiKey: string;
+    workspaceId: string;
+    /** See {@link PolicySnapshotOptions.localHoldTokens}. */
+    localHoldTokens?: readonly string[];
+}
+/**
+ * The `review_before:` tokens the snapshot compiles into hold rules: from the
+ * synced SOPs' front matter and JSON blocks, the workspace settings, and the
+ * local `.intutic/sops`. The same parse the Claude Code writer runs for its
+ * pattern blacklist, so the two cannot disagree about what is held.
+ */
+export declare function localHoldTokensFor(workspaceRoot: string, sops: SyncSopEntry[], settings: Record<string, unknown> | undefined, harnesses?: HarnessType[]): Promise<string[]>;
+/**
+ * Refresh the three gate-side caches every hook reads: the policy snapshot
+ * (`~/.intutic/hooks/policy-snapshot.rules`), the approved review-hold
+ * bypasses and the central egress policy. Called on EVERY sync cycle by both
+ * loops — this one and `intutic connect`'s — never only when the config
+ * version moved: policy changes without the version changing, and before
+ * this helper existed `connect` refreshed once at startup and never again, so
+ * a guardrail promoted mid-session reached a connected machine only on
+ * restart (TD-488). None of the three throw; the return says which of them
+ * landed.
+ */
+export declare function refreshGateCaches(opts: GateCacheRefreshOptions): Promise<{
+    snapshot: boolean;
+    bypasses: boolean;
+    egress: boolean;
+}>;
 export declare function startSyncLoop(options: SyncLoopOptions): Promise<void>;
+export interface IterationContext {
+    controlPlaneUrl: string;
+    apiKey: string;
+    workspaceId: string;
+    workspaceRoot: string;
+    onSync?: (result: SyncResult) => void;
+}
+/**
+ * Execute a single sync iteration:
+ * 1. Fetch config from control plane
+ * 2. Write config files if version is newer
+ * 3. Compute file hashes
+ * 4. Report status back to control plane
+ * 5. Update local integrity store
+ * 6. Call onSync callback
+ *
+ * Exported (in addition to being used internally by `startSyncLoop`'s
+ * polling loop) as a test seam — it is the unit that exercises exactly one
+ * cycle's worth of work, including the injectMcpServer call (step 3c),
+ * without the surrounding while-loop's extra one-time/Nth-iteration network
+ * calls (policy snapshot, approved bypasses, egress policy, compliance
+ * probes, drift watcher, decisions digest, config capture).
+ */
+export declare function runSyncIteration(ctx: IterationContext): Promise<SyncResult>;
 export declare function syncOfflineTraces(controlPlaneUrl: string, apiKey: string): Promise<void>;
 //# sourceMappingURL=syncLoop.d.ts.map

package/dist/syncLoop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncLoop.d.ts","sourceRoot":"","sources":["../src/syncLoop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,iBAAiB,EAClB,MAAM,uBAAuB,CAAA;AAe9B,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IACrC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAChC,iBAAiB;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wBAAwB;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAA;CAC1B;AAQD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyN3E;AAkTD,wBAAsB,iBAAiB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqE9F"}
+{"version":3,"file":"syncLoop.d.ts","sourceRoot":"","sources":["../src/syncLoop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,iBAAiB,EACjB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAqB9B,OAAO,EAAgD,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAS/G,OAAO,EAA8D,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAqBjH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvC;;;2EAGuE;IACvE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC5B,GAAG,IAAI,CA+BP;AAID,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IACrC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAChC,iBAAiB;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wBAAwB;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAA;IACzB;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAA;CACjF;AA6BD;;;;;GAKG;AACH,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,SAAS,GAAE,WAAW,EAAO,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAKpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8R3E;AAID,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4PjF;AAwKD,wBAAsB,iBAAiB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqE9F"}