@intutic/sync-daemon 2.0.0 → 2.2.0

package/dist/harness/hermesHooks.js

@@ -20,6 +20,8 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
+import { keepOriginal, noteWritten } from '../disconnect/originals.js';
+import { parseDocument, isMap } from 'yaml';
 import { newIso } from '@intutic/id';
 import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
 const log = createLogger('sync-hermes-hooks');
@@ -97,43 +99,43 @@ exit 0
 }
 // ─── YAML merge helpers ───────────────────────────────────────────────────────
 /**
- * YAML-safe merge of the Hermes config.
- *
- * Strategy (no YAML library — pure string manipulation):
- * - If file doesn't exist: write fresh with just the hooks block.
- * - If file exists and already contains `preToolUse:`: replace the command line.
- * - If file exists but has no `preToolUse:`: append the hooks block.
- * - If file has `hooks:` but no `preToolUse:`: insert inside existing hooks section.
+ * Merge the hook registration into the Hermes config: `hooks.preToolUse.command`
+ * is set to the gate, and everything else in the file — other hooks, MCP
+ * servers, comments — is kept. Edited through the `yaml` document model; an
+ * earlier line-based version replaced the first `command:` line anywhere in
+ * the file, whichever key it belonged to. A file that does not parse, or is
+ * not a mapping, is left untouched and reported.
  */
-async function mergeHermesConfig(hookScriptPath) {
-    const hooksBlock = [
-        'hooks:',
-        '  preToolUse:',
-        `    command: ${hookScriptPath}`,
-    ].join('\n');
-    let existing = null;
+export function mergeHermesYaml(existing, hookScriptPath) {
+    const doc = parseDocument(existing);
+    if (doc.errors.length > 0)
+        return null;
+    if (doc.contents === null)
+        doc.contents = doc.createNode({});
+    if (!isMap(doc.contents))
+        return null;
     try {
-        existing = await fs.readFile(HERMES_CONFIG, 'utf-8');
+        doc.setIn(['hooks', 'preToolUse', 'command'], hookScriptPath);
     }
     catch {
-        // File doesn't exist — write fresh
+        // `hooks` or `hooks.preToolUse` is a scalar or list — not a shape to edit.
+        return null;
     }
-    let merged;
-    if (existing === null) {
-        // Fresh write
-        merged = hooksBlock + '\n';
-    }
-    else if (/^\s*preToolUse:/m.test(existing)) {
-        // Replace the existing command line under preToolUse:
-        merged = existing.replace(/^(\s*command:\s*).*$/m, `$1${hookScriptPath}`);
+    return doc.toString();
+}
+async function mergeHermesConfig(hookScriptPath) {
+    let existing = '';
+    try {
+        existing = await fs.readFile(HERMES_CONFIG, 'utf-8');
     }
-    else if (/^hooks:/m.test(existing)) {
-        // hooks: block exists but no preToolUse: — insert inside hooks section
-        merged = existing.replace(/^(hooks:\s*)$/m, `$1\n  preToolUse:\n    command: ${hookScriptPath}`);
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
     }
-    else {
-        // No hooks: block at all — append
-        merged = existing.trimEnd() + '\n\n' + hooksBlock + '\n';
+    const merged = mergeHermesYaml(existing, hookScriptPath);
+    if (merged === null) {
+        log.warn({ action: 'hermes_config_merge_skipped', path: HERMES_CONFIG }, `${HERMES_CONFIG} could not be merged — left untouched`);
+        return;
     }
     const tmpPath = HERMES_CONFIG + '.intutic-tmp';
     await fs.writeFile(tmpPath, merged, 'utf-8');
@@ -156,7 +158,7 @@ Before every tool call, you MUST verify compliance with workspace SOPs.
 A pre-tool-use hook (\`~/.intutic/hooks/hermes-check.sh\`) enforces these rules automatically.
 
 If a tool call is blocked, do NOT attempt to circumvent the governance gate.
-To update policy, use the Intutic control plane at \`${proxyUrl}\`.
+Policy is managed in Intutic; this agent's LLM traffic goes through the Intutic proxy at \`${proxyUrl}\`.
 `;
 }
 // ─── Main export ──────────────────────────────────────────────────────────────
@@ -178,6 +180,9 @@ export async function writeHermesHooks(workspaceRoot, proxyUrl, workspaceId = ''
     const envDir = path.join(workspaceRoot, '.intutic', 'env');
     const hermesDir = path.join(os.homedir(), '.hermes');
     const skillsDir = path.join(hermesDir, 'skills', 'intutic-governance');
+    const skillPath = path.join(skillsDir, 'SKILL.md');
+    await keepOriginal(HERMES_CONFIG, workspaceRoot);
+    await keepOriginal(skillPath, workspaceRoot);
     await Promise.all([
         fs.mkdir(globalHookDir, { recursive: true }),
         fs.mkdir(hookEventsDir, { recursive: true }),
@@ -196,10 +201,11 @@ export async function writeHermesHooks(workspaceRoot, proxyUrl, workspaceId = ''
     await mergeHermesConfig(hookScriptPath);
     log.info({ action: 'hermes_config_merged', path: HERMES_CONFIG }, 'Merged Intutic hook into ~/.hermes/config.yaml');
     // ── 4. Write governance skill ──────────────────────────────────────────────
-    const skillPath = path.join(skillsDir, 'SKILL.md');
+    const skill = buildGovernanceSkill(proxyUrl);
     const tmpSkill = skillPath + '.intutic-tmp';
-    await fs.writeFile(tmpSkill, buildGovernanceSkill(proxyUrl), 'utf-8');
+    await fs.writeFile(tmpSkill, skill, 'utf-8');
     await fs.rename(tmpSkill, skillPath);
+    await noteWritten(skillPath, workspaceRoot, skill);
     log.info({ action: 'hermes_skill_written', path: skillPath }, 'Hermes governance skill written');
     // ── 5. Write env snippet ───────────────────────────────────────────────────
     const envSnippet = [

package/dist/harness/hermesHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,eAAe;QACf,gBAAgB,cAAc,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,cAAc;QACd,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC5B,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,sDAAsD;QACtD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,OAAO,CACvB,gBAAgB,EAChB,mCAAmC,cAAc,EAAE,CACpD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;uDAe8C,QAAQ;CAC9D,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}
+{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAiB,MAAM,MAAM,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,GAAG,GAAa,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,aAAa,uCAAuC,CAAC,CAAA;QACjI,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;6FAeoF,QAAQ;CACpG,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAElD,MAAM,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAChD,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACpC,MAAM,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IAElD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}

package/dist/harness/holdRedaction.d.ts

@@ -42,11 +42,14 @@ export declare const MAX_SNAPSHOT_BYTES = 32768;
 /**
  * Returns a redacted, size-capped copy of `value`.
  *
+ * `maxString` caps each string (the middle is dropped); config capture passes
+ * `Infinity`, because a captured file is uploaded whole or not at all.
+ *
  * Self-contained by contract — see the module docstring. Do not add imports or
  * outer-scope references to this function; `emitRedactor()` asserts it stays
  * closed over nothing.
  */
-export declare function redactSecrets(value: unknown, depth?: number): unknown;
+export declare function redactSecrets(value: unknown, depth?: number, maxString?: number): unknown;
 /**
  * Emits both functions as standalone JavaScript for the generated hook.
  *

package/dist/harness/holdRedaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holdRedaction.d.ts","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,OAAQ,CAAA;AAC/B,yEAAyE;AACzE,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,gCAAgC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAwGhE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB1B"}
+{"version":3,"file":"holdRedaction.d.ts","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,OAAQ,CAAA;AAC/B,yEAAyE;AACzE,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,gCAAgC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,EAAE,SAAS,SAAa,GAAG,OAAO,CA6HxF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB1B"}

package/dist/harness/holdRedaction.js

@@ -42,11 +42,14 @@ export const MAX_SNAPSHOT_BYTES = 32_768;
 /**
  * Returns a redacted, size-capped copy of `value`.
  *
+ * `maxString` caps each string (the middle is dropped); config capture passes
+ * `Infinity`, because a captured file is uploaded whole or not at all.
+ *
  * Self-contained by contract — see the module docstring. Do not add imports or
  * outer-scope references to this function; `emitRedactor()` asserts it stays
  * closed over nothing.
  */
-export function redactSecrets(value, depth = 0) {
+export function redactSecrets(value, depth = 0, maxString = MAX_STRING) {
     // Keys whose value is a credential regardless of what it looks like. Matched
     // loosely on purpose: `apiKey`, `api_key`, `X-Api-Key` and `apikey` all occur.
     const SECRET_KEY = /(pass(word|phrase)?|secret|token|api[-_ ]?key|auth(orization)?|credential|private[-_ ]?key|session[-_ ]?id|cookie)/i;
@@ -62,7 +65,7 @@ export function redactSecrets(value, depth = 0) {
         /xox[abprs]-[A-Za-z0-9-]{10,}/g, // Slack
         /AIza[0-9A-Za-z_-]{30,}/g, // Google
         /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, // JWT
-        /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+        // PEM private keys are handled by redactPem below, not a pattern here.
         // Bare basic-auth in a URL.
         /\/\/[^/\s:@]+:[^/\s:@]+@/g,
     ];
@@ -116,17 +119,38 @@ export function redactSecrets(value, depth = 0) {
         // `[redacted]` swallowing the key name does not.
         return copied === 0 ? s : out + s.slice(copied);
     };
+    // A PEM private key, header to footer. Scanned rather than matched with one
+    // lazy `BEGIN[\s\S]*?END` pattern, which rescans to the end of the text from
+    // every header that has no footer: quadratic, and this runs before any
+    // length cap. A header with no footer is redacted to the end of the text,
+    // because a truncated key is still a key.
+    const redactPem = (s) => {
+        const BEGIN = /-----BEGIN[A-Z ]*PRIVATE KEY-----/g;
+        const END = /-----END[A-Z ]*PRIVATE KEY-----/g;
+        let out = '';
+        let copied = 0;
+        let m;
+        while ((m = BEGIN.exec(s)) !== null) {
+            out += s.slice(copied, m.index) + '[redacted]';
+            END.lastIndex = BEGIN.lastIndex;
+            if (END.exec(s) === null)
+                return out;
+            copied = END.lastIndex;
+            BEGIN.lastIndex = copied;
+        }
+        return copied === 0 ? s : out + s.slice(copied);
+    };
     const scrub = (s) => {
-        let out = s;
+        let out = redactPem(s);
         for (const re of SECRET_VALUE)
             out = out.replace(re, '[redacted]');
         out = redactAssignments(out);
-        if (out.length > MAX_STRING) {
+        if (out.length > maxString) {
             // Keep both ends. A command's verb is at the front and its target is at
             // the back; truncating the tail throws away the half that identifies what
             // the hold was about.
-            const half = Math.floor(MAX_STRING / 2);
-            out = `${out.slice(0, half)}…[${out.length - MAX_STRING} chars elided]…${out.slice(-half)}`;
+            const half = Math.floor(maxString / 2);
+            out = `${out.slice(0, half)}…[${out.length - maxString} chars elided]…${out.slice(-half)}`;
         }
         return out;
     };
@@ -139,7 +163,7 @@ export function redactSecrets(value, depth = 0) {
     if (typeof value === 'number' || typeof value === 'boolean')
         return value;
     if (Array.isArray(value)) {
-        const kept = value.slice(0, MAX_ARRAY).map((v) => redactSecrets(v, depth + 1));
+        const kept = value.slice(0, MAX_ARRAY).map((v) => redactSecrets(v, depth + 1, maxString));
         if (value.length > MAX_ARRAY)
             kept.push(`[${value.length - MAX_ARRAY} more elided]`);
         return kept;
@@ -147,7 +171,7 @@ export function redactSecrets(value, depth = 0) {
     if (typeof value === 'object') {
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            out[k] = SECRET_KEY.test(k) ? '[redacted]' : redactSecrets(v, depth + 1);
+            out[k] = SECRET_KEY.test(k) ? '[redacted]' : redactSecrets(v, depth + 1, maxString);
         }
         return out;
     }

package/dist/harness/holdRedaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"holdRedaction.js","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAA;AAC/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAA;AAC1B,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,qHAAqH,CAAA;IAEvH,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAa;QAC7B,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,8BAA8B;QACnD,4BAA4B,EAAE,YAAY;QAC1C,sBAAsB,EAAE,wBAAwB;QAChD,6BAA6B,EAAE,SAAS;QACxC,+BAA+B;QAC/B,+BAA+B,EAAE,QAAQ;QACzC,yBAAyB,EAAE,SAAS;QACpC,6DAA6D,EAAE,MAAM;QACrE,2EAA2E;QAC3E,4BAA4B;QAC5B,2BAA2B;KAC5B,CAAA;IAED,iEAAiE;IACjE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,MAAM,cAAc,GAAG,kEAAkE,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,CAAA;IAE5B,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBAAE,SAAQ;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAA;YACxB,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAA;YACpE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,SAAQ;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,YAAY,CAAA;YACrD,MAAM,GAAG,GAAG,CAAA;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;QACtB,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,iDAAiD;QACjD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAClE,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,wEAAwE;YACxE,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACvC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,UAAU,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,IAAI,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,mEAAmE;IACnE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,OAAO;QACL,0EAA0E;QAC1E,gEAAgE;QAChE,sBAAsB,UAAU,GAAG;QACnC,qBAAqB,SAAS,GAAG;QACjC,qBAAqB,SAAS,GAAG;QACjC,8BAA8B,kBAAkB,GAAG;QACnD,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;QACjD,gCAAgC,MAAM,CAAC,oBAAoB,CAAC,GAAG;QAC/D,wCAAwC;QACxC,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ,CAAC,WAAW,CAAC,GAAG,YAAY,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,OAAO,CAAA;IACnG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"holdRedaction.js","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAA;AAC/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAA;AAC1B,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,qHAAqH,CAAA;IAEvH,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAa;QAC7B,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,8BAA8B;QACnD,4BAA4B,EAAE,YAAY;QAC1C,sBAAsB,EAAE,wBAAwB;QAChD,6BAA6B,EAAE,SAAS;QACxC,+BAA+B;QAC/B,+BAA+B,EAAE,QAAQ;QACzC,yBAAyB,EAAE,SAAS;QACpC,6DAA6D,EAAE,MAAM;QACrE,uEAAuE;QACvE,4BAA4B;QAC5B,2BAA2B;KAC5B,CAAA;IAED,iEAAiE;IACjE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,MAAM,cAAc,GAAG,kEAAkE,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,CAAA;IAE5B,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBAAE,SAAQ;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAA;YACxB,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAA;YACpE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,SAAQ;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,YAAY,CAAA;YACrD,MAAM,GAAG,GAAG,CAAA;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;QACtB,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,iDAAiD;QACjD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;QACtC,MAAM,KAAK,GAAG,oCAAoC,CAAA;QAClD,MAAM,GAAG,GAAG,kCAAkC,CAAA;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,YAAY,CAAA;YAC9C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;YAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAA;YACpC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAA;YACtB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACtB,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAClE,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACtC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,SAAS,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAC5F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,IAAI,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;QACzF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,mEAAmE;IACnE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,OAAO;QACL,0EAA0E;QAC1E,gEAAgE;QAChE,sBAAsB,UAAU,GAAG;QACnC,qBAAqB,SAAS,GAAG;QACjC,qBAAqB,SAAS,GAAG;QACjC,8BAA8B,kBAAkB,GAAG;QACnD,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;QACjD,gCAAgC,MAAM,CAAC,oBAAoB,CAAC,GAAG;QAC/D,wCAAwC;QACxC,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ,CAAC,WAAW,CAAC,GAAG,YAAY,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,OAAO,CAAA;IACnG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/harness/jetbrainsXmlConfig.d.ts

@@ -48,4 +48,24 @@
  * at all — refusal, not a guess.
  */
 export declare function mergeXmlComponentOptions(filePath: string, componentName: string, desiredOptions: Readonly<Record<string, string | boolean>>, readFile: (path: string) => Promise<string | null>, writeFileAtomic: (path: string, content: string) => Promise<void>): Promise<boolean>;
+/** One settings file as {@link parseComponentOptions} reads it. */
+export interface ComponentOptionsFile {
+    /** The named component's simple options. */
+    options: Record<string, string>;
+    /** Everything else inside that component, verbatim (normalised whitespace). */
+    extra?: string;
+    /** Every other component's block, verbatim, by name. */
+    others: Record<string, string>;
+}
+/**
+ * Reads `componentName`'s simple options from a settings file's text
+ * (`null` or empty: a file that does not exist yet). Returns null when the
+ * file is not the `<application><component>` shape this module understands.
+ */
+export declare function parseComponentOptions(raw: string | null, componentName: string): ComponentOptionsFile | null;
+/**
+ * Writes a settings file back in the layout {@link mergeXmlComponentOptions}
+ * uses. A component left with no options and nothing else is dropped.
+ */
+export declare function serializeComponentOptions(file: ComponentOptionsFile, componentName: string): string;
 //# sourceMappingURL=jetbrainsXmlConfig.d.ts.map

package/dist/harness/jetbrainsXmlConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jetbrainsXmlConfig.d.ts","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAwGH;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAC1D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,CA0BlB"}
+{"version":3,"file":"jetbrainsXmlConfig.d.ts","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAwGH;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAC1D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAS5G;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAanG"}

package/dist/harness/jetbrainsXmlConfig.js

@@ -125,27 +125,48 @@ function parseApplicationXml(raw, targetComponentName) {
  * at all — refusal, not a guess.
  */
 export async function mergeXmlComponentOptions(filePath, componentName, desiredOptions, readFile, writeFileAtomic) {
-    const existing = await readFile(filePath);
-    const parsed = parseApplicationXml(existing, componentName);
-    if (!parsed.ok)
+    const parsed = parseComponentOptions(await readFile(filePath), componentName);
+    if (parsed === null)
         return false;
-    const options = parsed.target?.simpleOptions ?? new Map();
     for (const [key, value] of Object.entries(desiredOptions)) {
-        options.set(key, typeof value === 'boolean' ? String(value) : value);
+        parsed.options[key] = typeof value === 'boolean' ? String(value) : value;
     }
-    const optionLines = [...options.entries()]
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([key, value]) => `    <option name="${escapeXmlAttr(key)}" value="${escapeXmlAttr(value)}" />`)
-        .join('\n');
-    const extra = parsed.target?.extra;
-    const componentBody = extra ? `${optionLines}\n${extra.split('\n').map((l) => `    ${l}`).join('\n')}` : optionLines;
-    const componentBlock = `  <component name="${escapeXmlAttr(componentName)}">\n${componentBody}\n  </component>`;
-    const otherBlocks = [...parsed.otherComponents.entries()]
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([, block]) => `  ${block}`);
-    const body = [componentBlock, ...otherBlocks].join('\n');
-    const serialized = `<application>\n${body}\n</application>\n`;
-    await writeFileAtomic(filePath, serialized);
+    await writeFileAtomic(filePath, serializeComponentOptions(parsed, componentName));
     return true;
 }
+/**
+ * Reads `componentName`'s simple options from a settings file's text
+ * (`null` or empty: a file that does not exist yet). Returns null when the
+ * file is not the `<application><component>` shape this module understands.
+ */
+export function parseComponentOptions(raw, componentName) {
+    const parsed = parseApplicationXml(raw, componentName);
+    if (!parsed.ok)
+        return null;
+    const out = {
+        options: Object.fromEntries(parsed.target?.simpleOptions ?? new Map()),
+        others: Object.fromEntries(parsed.otherComponents),
+    };
+    if (parsed.target?.extra)
+        out.extra = parsed.target.extra;
+    return out;
+}
+/**
+ * Writes a settings file back in the layout {@link mergeXmlComponentOptions}
+ * uses. A component left with no options and nothing else is dropped.
+ */
+export function serializeComponentOptions(file, componentName) {
+    const optionLines = Object.entries(file.options)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) => `    <option name="${escapeXmlAttr(key)}" value="${escapeXmlAttr(value)}" />`);
+    const extraLines = file.extra ? file.extra.split('\n').map((l) => `    ${l}`) : [];
+    const blocks = Object.entries(file.others).map(([name, block]) => [name, `  ${block}`]);
+    if (optionLines.length + extraLines.length > 0) {
+        const componentBody = [...optionLines, ...extraLines].join('\n');
+        blocks.push([componentName, `  <component name="${escapeXmlAttr(componentName)}">\n${componentBody}\n  </component>`]);
+    }
+    // The target component first, then the rest by name: the order the merge has always written.
+    blocks.sort(([a], [b]) => (a === componentName ? -1 : b === componentName ? 1 : a.localeCompare(b)));
+    return `<application>\n${blocks.map(([, block]) => block).join('\n')}\n</application>\n`;
+}
 //# sourceMappingURL=jetbrainsXmlConfig.js.map

package/dist/harness/jetbrainsXmlConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"jetbrainsXmlConfig.js","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0BH,MAAM,YAAY,GAAG,sDAAsD,CAAA;AAC3E,MAAM,gBAAgB,GAAG,mDAAmD,CAAA;AAE5E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAA;IAC9B,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC5E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjC,CAAC;IACD,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,eAAe,GAAG,KAAK;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AAClD,CAAC;AAED;;;2CAG2C;AAC3C,SAAS,mBAAmB,CAAC,GAAkB,EAAE,mBAA2B;IAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,MAAmC,CAAA;IACvC,IAAI,KAA6B,CAAA;IACjC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC7E,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC1D,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,IAAI,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,aAAqB,EACrB,cAA0D,EAC1D,QAAkD,EAClD,eAAiE;IAEjE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAA;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,aAAa,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;SACpG,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAA;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IACpH,MAAM,cAAc,GAAG,sBAAsB,aAAa,CAAC,aAAa,CAAC,OAAO,aAAa,kBAAkB,CAAA;IAE/G,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;IAEnC,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,kBAAkB,IAAI,oBAAoB,CAAA;IAC7D,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC3C,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"jetbrainsXmlConfig.js","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0BH,MAAM,YAAY,GAAG,sDAAsD,CAAA;AAC3E,MAAM,gBAAgB,GAAG,mDAAmD,CAAA;AAE5E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAA;IAC9B,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC5E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjC,CAAC;IACD,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,eAAe,GAAG,KAAK;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AAClD,CAAC;AAED;;;2CAG2C;AAC3C,SAAS,mBAAmB,CAAC,GAAkB,EAAE,mBAA2B;IAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,MAAmC,CAAA;IACvC,IAAI,KAA6B,CAAA;IACjC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC7E,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC1D,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,IAAI,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,aAAqB,EACrB,cAA0D,EAC1D,QAAkD,EAClD,eAAiE;IAEjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IAC7E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,CAAC,QAAQ,EAAE,yBAAyB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB,EAAE,aAAqB;IAC7E,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,MAAM,GAAG,GAAyB;QAChC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;QACtF,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC;KACnD,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAA;IACzD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA0B,EAAE,aAAqB;IACzF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,aAAa,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,MAAM,MAAM,GAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAA;IAC3G,IAAI,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,sBAAsB,aAAa,CAAC,aAAa,CAAC,OAAO,aAAa,kBAAkB,CAAC,CAAC,CAAA;IACxH,CAAC;IACD,6FAA6F;IAC7F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpG,OAAO,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAA;AAC1F,CAAC"}

package/dist/harness/jsonMergeTarget.d.ts

@@ -0,0 +1,23 @@
+/**
+ * jsonMergeTarget.ts — read a user-owned JSON config before merging into it.
+ *
+ * Every writer that adds Intutic keys to a file the user also edits (a
+ * harness's settings.json or hooks.json) used to treat a parse failure like a
+ * missing file and "start fresh" — so a single comment, trailing comma or
+ * half-saved edit made the next sync replace the user's whole file with the
+ * few keys Intutic owns. This helper separates the two cases: a missing file
+ * is an empty object, and a file that is present but not a plain JSON object
+ * is reported and left alone.
+ *
+ * @module
+ */
+/**
+ * Read `filePath` as a JSON object to merge into.
+ *
+ * @returns the parsed object, `{}` when the file does not exist, or `null`
+ *          when the file exists but is not a JSON object. On `null` the
+ *          caller must skip its write; a warning naming the file has already
+ *          been logged.
+ */
+export declare function readJsonObjectForMerge(filePath: string): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=jsonMergeTarget.d.ts.map

package/dist/harness/jsonMergeTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonMergeTarget.d.ts","sourceRoot":"","sources":["../../src/harness/jsonMergeTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAuBtG"}

package/dist/harness/jsonMergeTarget.js

@@ -0,0 +1,50 @@
+/**
+ * jsonMergeTarget.ts — read a user-owned JSON config before merging into it.
+ *
+ * Every writer that adds Intutic keys to a file the user also edits (a
+ * harness's settings.json or hooks.json) used to treat a parse failure like a
+ * missing file and "start fresh" — so a single comment, trailing comma or
+ * half-saved edit made the next sync replace the user's whole file with the
+ * few keys Intutic owns. This helper separates the two cases: a missing file
+ * is an empty object, and a file that is present but not a plain JSON object
+ * is reported and left alone.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-json-merge');
+/**
+ * Read `filePath` as a JSON object to merge into.
+ *
+ * @returns the parsed object, `{}` when the file does not exist, or `null`
+ *          when the file exists but is not a JSON object. On `null` the
+ *          caller must skip its write; a warning naming the file has already
+ *          been logged.
+ */
+export async function readJsonObjectForMerge(filePath) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return {};
+        log.warn({ action: 'config_merge_skipped', path: filePath, error: String(err) }, `Could not read ${filePath} — left untouched`);
+        return null;
+    }
+    if (raw.trim() === '')
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Reported below with the not-an-object case.
+    }
+    log.warn({ action: 'config_merge_skipped', path: filePath }, `${filePath} is not a plain JSON object (comments, a trailing comma or a syntax error?) — left untouched; fix it and the next sync will add the Intutic entries`);
+    return null;
+}
+//# sourceMappingURL=jsonMergeTarget.js.map

package/dist/harness/jsonMergeTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonMergeTarget.js","sourceRoot":"","sources":["../../src/harness/jsonMergeTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,QAAQ,mBAAmB,CAAC,CAAA;QAC/H,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAiC,CAAA;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClD,GAAG,QAAQ,qJAAqJ,CACjK,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/harness/mcpAutoWrite.d.ts

@@ -3,7 +3,11 @@
  * MCP servers with the @intutic/mcp-governance-proxy.
  *
  * Injects and proxy-wraps MCP server entries in:
- * - Claude Code:      ~/.claude/mcp.json
+ * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`,
+ *                      where the approved servers of the project's
+ *                      `.mcp.json` also get wrapped shadows — the shared
+ *                      `.mcp.json` itself is only read)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -15,11 +19,14 @@
  * - Muse Code:        ~/.config/muse/settings.json (`mcp_servers` section)
  * - Grok Build:       ~/.grok/config.toml + <workspaceRoot>/.grok/config.toml
  *                      ([mcp_servers.*] tables)
+ * - OpenCode:         ~/.config/opencode/opencode.json + <workspaceRoot>/opencode.json
+ *                      (`mcp` block — TD-487; see `injectOpenCode`)
  *
- * That is 12 config paths across 10 `HarnessType` values (Cursor and Grok
- * Build each own two paths — global/project for Cursor, user/project for
- * Grok Build). `discoverMcpServers` below reads all twelve read-only, for
- * reporting; the injectors above are the only thing that writes.
+ * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
+ * Build and OpenCode each own two paths — global/project for Cursor and
+ * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
+ * all fourteen read-only, for reporting, plus Claude Code's project
+ * `.mcp.json`; the injectors above are the only thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -65,15 +72,13 @@
  *   comment used to describe as "left untouched": the entry is rewritten to
  *   spawn the SAME proxy binary in bridge mode (`--remote-url`/
  *   `--remote-transport`, headers riding in `INTUTIC_REMOTE_HEADERS` env, not
- *   argv — `ps` visibility). `__intutic_original` preserves the entry's
- *   pre-wrap `url`/`type`/`headers` so `classifyEntry` can report the TRUE
- *   transport of what got wrapped, and so a wrapped entry could be unwrapped
- *   later. See TECH_DEBT.md TD-354 for the historical decline this phase
- *   supersedes.
- *
- * Continuous invariant, not one-shot: `injectMcpServer` is called once from
- * `intutic connect` (tools/cli) AND once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts), so a server a user adds to a harness
+ *   argv — `ps` visibility). `__intutic_original` keeps the whole pre-wrap
+ *   entry, stdio or remote, so `classifyEntry` can report the TRUE transport
+ *   of what got wrapped and `intutic disconnect` can put the entry back
+ *   exactly.
+ *
+ * Continuous invariant, not one-shot: `intutic connect` (tools/cli) calls
+ * `injectMcpServer` on every sync cycle, so a server a user adds to a harness
  * config after their first `connect` still gets wrapped on the next sync
  * cycle rather than staying invisible to governance forever. Running this
  * every ~30s only works because `writeJsonFile` below is write-if-changed —
@@ -91,10 +96,47 @@ export interface DiscoveredMcpServer {
     harness: string;
     transport: 'stdio' | 'http' | 'sse' | 'unknown';
     wrapped: boolean;
+    /**
+     * Set on a server the harness will start but the proxy cannot govern, with
+     * the reason. Today: an approved Claude Code project server that gets no
+     * local-scope copy (see `shadowBlocker` and `projectServerApproval`).
+     */
+    ungovernedReason?: string;
 }
+/**
+ * Resolve the path to the @intutic/mcp-governance-proxy entry point.
+ *
+ * Resolution order:
+ * 1. The copy installed next to this daemon — a dependency of
+ *    `@intutic/sync-daemon`, so a global `npm install -g @intutic/cli` has it
+ *    in the CLI's own node_modules. This is the normal case: the user's
+ *    project has no reason to depend on the proxy.
+ * 2. `<workspaceRoot>/node_modules/@intutic/mcp-governance-proxy/dist/index.js`
+ *    and `<workspaceRoot>/packages/mcp-proxy/dist/index.js` — for a run from
+ *    a bundled binary, whose bundled modules are not on disk for `node` to
+ *    load (their paths start with `/snapshot/`), and for a source checkout
+ *    that has not built the proxy yet.
+ *
+ * Synchronous on purpose — this runs while building config entries, not in a
+ * hot path.
+ */
+export declare function resolveProxyBin(workspaceRoot: string): string;
+export declare function claudeDesktopConfigPath(): string;
+export declare function cursorGlobalConfigPath(): string;
+export declare function windsurfConfigPath(): string;
+export declare function continueConfigPath(): string;
+export declare function gooseConfigPath(): string;
+export declare function museConfigPath(): string;
+export declare function grokUserConfigPath(): string;
+/** OpenCode's global config: `$XDG_CONFIG_HOME/opencode/opencode.json`, which
+ *  is `~/.config/opencode/opencode.json` unless XDG_CONFIG_HOME is set (OpenCode
+ *  resolves it through xdg-basedir). Only the `.json` spelling — see `injectOpenCode`. */
+export declare function openCodeGlobalConfigPath(): string;
+/** The proxy binary path `resolveProxyBin` returns, in either of its two forms. */
+export declare const PROXY_BIN_PATTERN: RegExp;
 /**
  * Discover every MCP server declared in any harness config this daemon knows
- * how to parse — the same 12 config paths / 10 harnesses `injectMcpServer`
+ * how to parse — the same 14 config paths / 11 harnesses `injectMcpServer`
  * wraps — without writing anything. Used for reporting (agentReporter's
  * `mcp_tools` facet) so visibility does not silently lag behind whatever
  * `injectMcpServer` was last run against.
@@ -117,16 +159,18 @@ export declare function discoverMcpServers(workspaceRoot: string): Promise<Disco
  *
  * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
  *
- * Called from two places by design: once from `intutic connect` (tools/cli)
- * for immediate effect, and once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts) so it is a continuous invariant
- * rather than a one-shot — a server a user adds after their first `connect`
+ * Called by `intutic connect` (tools/cli) on every sync cycle, so it is a
+ * continuous invariant rather than a one-shot — a server a user adds after their first `connect`
  * still gets wrapped on the next cycle. Safe to call every cycle because
  * `writeJsonFile` is write-if-changed: an already-wrapped, unchanged config
  * writes zero bytes.
  *
  * @param workspaceId - The workspace ID for policy lookups and event attribution.
  * @param workspaceRoot - Absolute path to the project workspace root.
+ * @param options.skip - Harness ids to leave alone: the ones `intutic
+ *   disconnect --harness` took out.
  */
-export declare function injectMcpServer(workspaceRoot: string, workspaceId?: string): Promise<void>;
+export declare function injectMcpServer(workspaceRoot: string, workspaceId?: string, options?: {
+    skip?: readonly string[];
+}): Promise<void>;
 //# sourceMappingURL=mcpAutoWrite.d.ts.map