@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/harness/hermesHooks.js

@@ -2,7 +2,7 @@
  * hermesHooks.ts — Hermes AI agent governance hook injection.
  *
  * Hermes is a skills-based AI agent that reads `~/.hermes/config.yaml`
- * for configuration. Hook commands are registered under `hooks.preToolUse`.
+ * for configuration. The gate is a shell hook under `hooks.pre_tool_call`.
  * This module:
  *
  * 1. YAML-safe-merges `~/.hermes/config.yaml` to register the hook command.
@@ -11,7 +11,6 @@
  * 4. Writes `.intutic/env/hermes.env` — env snippet for IDE/shell integration.
  *
  * WS-C1 — Hermes harness (Phase 3 cross-harness defence)
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
  *
  * @module
@@ -20,9 +19,11 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
-import { parseDocument, isMap } from 'yaml';
+import { keepOriginal, noteWritten } from '../disconnect/originals.js';
+import { parseDocument, isMap, isSeq } from 'yaml';
 import { newIso } from '@intutic/id';
-import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
+import { HOOK_TIMEOUT_SECONDS } from '@intutic/shared-types';
+import { emitShellGate, SHELL_EXTRACT, emitShellFailClosed } from './gateBody.js';
 const log = createLogger('sync-hermes-hooks');
 /** Path to the Hermes global config file. */
 const HERMES_CONFIG = path.join(os.homedir(), '.hermes', 'config.yaml');
@@ -38,7 +39,7 @@ function buildHermesCheckScript(proxyUrl, workspaceRoot, workspaceId) {
 # Generated: ${newIso()}
 # Workspace: ${workspaceId}
 set -euo pipefail
-${SHELL_FAIL_CLOSED}
+${emitShellFailClosed('hermes')}
 # Source runtime credentials (never embedded in this file)
 if [ -f "${runtimeEnv}" ]; then
   # shellcheck disable=SC1090
@@ -78,7 +79,11 @@ log_event() {
   local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   # incidentId = sha1(timestamp + toolName + workspaceId).slice(0,16)
   local incident_id; incident_id="\$(echo -n \"\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}\" | sha1sum | cut -c1-16)"
-  local entry="{\\\"event\\\":\\\"\${verdict}\\\",\\\"toolName\\\":\\\"\${tool}\\\",\\\"reason\\\":\\\"\${reason}\\\",\\\"workspaceId\\\":\\\"\${INTUTIC_WORKSPACE_ID}\\\",\\\"harnessType\\\":\\\"hermes\\\",\\\"incidentId\\\":\\\"\${incident_id}\\\",\\\"timestamp\\\":\\\"\${ts}\\\"}"
+  # The event's id: random, made once here, and resent with the line it is
+  # written into, so the control plane processes the event once.
+  local event_id; event_id="\$(od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \\n' || true)"
+  [ -n "\$event_id" ] || event_id="\$(date +%s)\$\$\${RANDOM}\${RANDOM}\${RANDOM}"
+  local entry="{\\\"event\\\":\\\"\${verdict}\\\",\\\"toolName\\\":\\\"\${tool}\\\",\\\"reason\\\":\\\"\${reason}\\\",\\\"workspaceId\\\":\\\"\${INTUTIC_WORKSPACE_ID}\\\",\\\"harnessType\\\":\\\"hermes\\\",\\\"incidentId\\\":\\\"\${incident_id}\\\",\\\"eventId\\\":\\\"\${event_id}\\\",\\\"timestamp\\\":\\\"\${ts}\\\"}"
   # Path B: reliable file append (sync-daemon drains on FSEvents change)
   printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
   # Path A: fire-and-forget HTTP POST (near-real-time dashboard, non-blocking)
@@ -98,12 +103,26 @@ exit 0
 }
 // ─── YAML merge helpers ───────────────────────────────────────────────────────
 /**
- * Merge the hook registration into the Hermes config: `hooks.preToolUse.command`
- * is set to the gate, and everything else in the file — other hooks, MCP
- * servers, comments — is kept. Edited through the `yaml` document model; an
- * earlier line-based version replaced the first `command:` line anywhere in
- * the file, whichever key it belonged to. A file that does not parse, or is
- * not a mapping, is left untouched and reported.
+ * The gate's shell-hook entry: \`fail_closed\` makes Hermes refuse the call
+ * when the gate times out, crashes or prints something it cannot read, where
+ * its default runs it; \`timeout\` replaces Hermes's 60 s default, and the
+ * gate refuses at its own deadline inside it. Hermes splits \`command\` with
+ * shlex, so a path with a space or a quote in it is quoted.
+ */
+export function hermesHookEntry(hookScriptPath) {
+    const command = /[\s'"\\]/.test(hookScriptPath) ? `'${hookScriptPath.replace(/'/g, `'"'"'`)}'` : hookScriptPath;
+    return { command, timeout: HOOK_TIMEOUT_SECONDS, fail_closed: true };
+}
+/**
+ * Merge the hook registration into the Hermes config: the gate's entry is put
+ * in the \`hooks.pre_tool_call\` list, replacing an earlier one of ours, and
+ * everything else in the file — other hooks, MCP servers, comments — is kept.
+ * Edited through the \`yaml\` document model. A file that does not parse, or
+ * is not a mapping, or holds \`hooks\` or \`pre_tool_call\` in a shape Hermes
+ * would not read, is left untouched and reported.
+ *
+ * Earlier versions wrote \`hooks.preToolUse.command\`, which Hermes skips as an
+ * unknown event: that registration is removed.
  */
 export function mergeHermesYaml(existing, hookScriptPath) {
     const doc = parseDocument(existing);
@@ -113,12 +132,25 @@ export function mergeHermesYaml(existing, hookScriptPath) {
         doc.contents = doc.createNode({});
     if (!isMap(doc.contents))
         return null;
-    try {
-        doc.setIn(['hooks', 'preToolUse', 'command'], hookScriptPath);
-    }
-    catch {
-        // `hooks` or `hooks.preToolUse` is a scalar or list — not a shape to edit.
+    const hooks = doc.get('hooks');
+    if (hooks !== undefined && hooks !== null && !isMap(hooks))
+        return null;
+    const legacy = doc.getIn(['hooks', 'preToolUse', 'command']);
+    if (typeof legacy === 'string' && legacy.endsWith('hermes-check.sh'))
+        doc.deleteIn(['hooks', 'preToolUse']);
+    const list = doc.getIn(['hooks', 'pre_tool_call']);
+    if (list !== undefined && list !== null && !isSeq(list))
         return null;
+    const entry = doc.createNode(hermesHookEntry(hookScriptPath));
+    if (isSeq(list)) {
+        list.items = list.items.filter((item) => {
+            const command = isMap(item) ? item.get('command') : undefined;
+            return !(typeof command === 'string' && /hermes-check\.sh'?$/.test(command));
+        });
+        list.items.push(entry);
+    }
+    else {
+        doc.setIn(['hooks', 'pre_tool_call'], doc.createNode([hermesHookEntry(hookScriptPath)]));
     }
     return doc.toString();
 }
@@ -179,6 +211,9 @@ export async function writeHermesHooks(workspaceRoot, proxyUrl, workspaceId = ''
     const envDir = path.join(workspaceRoot, '.intutic', 'env');
     const hermesDir = path.join(os.homedir(), '.hermes');
     const skillsDir = path.join(hermesDir, 'skills', 'intutic-governance');
+    const skillPath = path.join(skillsDir, 'SKILL.md');
+    await keepOriginal(HERMES_CONFIG, workspaceRoot);
+    await keepOriginal(skillPath, workspaceRoot);
     await Promise.all([
         fs.mkdir(globalHookDir, { recursive: true }),
         fs.mkdir(hookEventsDir, { recursive: true }),
@@ -197,10 +232,11 @@ export async function writeHermesHooks(workspaceRoot, proxyUrl, workspaceId = ''
     await mergeHermesConfig(hookScriptPath);
     log.info({ action: 'hermes_config_merged', path: HERMES_CONFIG }, 'Merged Intutic hook into ~/.hermes/config.yaml');
     // ── 4. Write governance skill ──────────────────────────────────────────────
-    const skillPath = path.join(skillsDir, 'SKILL.md');
+    const skill = buildGovernanceSkill(proxyUrl);
     const tmpSkill = skillPath + '.intutic-tmp';
-    await fs.writeFile(tmpSkill, buildGovernanceSkill(proxyUrl), 'utf-8');
+    await fs.writeFile(tmpSkill, skill, 'utf-8');
     await fs.rename(tmpSkill, skillPath);
+    await noteWritten(skillPath, workspaceRoot, skill);
     log.info({ action: 'hermes_skill_written', path: skillPath }, 'Hermes governance skill written');
     // ── 5. Write env snippet ───────────────────────────────────────────────────
     const envSnippet = [

package/dist/harness/hermesHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAiB,MAAM,MAAM,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,GAAG,GAAa,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,aAAa,uCAAuC,CAAC,CAAA;QACjI,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;6FAeoF,QAAQ;CACpG,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}
+{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAiB,MAAM,MAAM,CAAA;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEjF,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,mBAAmB,CAAC,QAAQ,CAAC;;WAEpB,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2C7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,cAAsB;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAA;IAC/G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,GAAG,GAAa,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAA;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IAC3G,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAA;IAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC7D,OAAO,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,aAAa,uCAAuC,CAAC,CAAA;QACjI,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;6FAeoF,QAAQ;CACpG,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAElD,MAAM,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAChD,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACpC,MAAM,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IAElD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}

package/dist/harness/holdRedaction.d.ts

@@ -42,11 +42,14 @@ export declare const MAX_SNAPSHOT_BYTES = 32768;
 /**
  * Returns a redacted, size-capped copy of `value`.
  *
+ * `maxString` caps each string (the middle is dropped); config capture passes
+ * `Infinity`, because a captured file is uploaded whole or not at all.
+ *
  * Self-contained by contract — see the module docstring. Do not add imports or
  * outer-scope references to this function; `emitRedactor()` asserts it stays
  * closed over nothing.
  */
-export declare function redactSecrets(value: unknown, depth?: number): unknown;
+export declare function redactSecrets(value: unknown, depth?: number, maxString?: number): unknown;
 /**
  * Emits both functions as standalone JavaScript for the generated hook.
  *

package/dist/harness/holdRedaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holdRedaction.d.ts","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,OAAQ,CAAA;AAC/B,yEAAyE;AACzE,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,gCAAgC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAwGhE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB1B"}
+{"version":3,"file":"holdRedaction.d.ts","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,OAAQ,CAAA;AAC/B,yEAAyE;AACzE,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,gCAAgC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,EAAE,SAAS,SAAa,GAAG,OAAO,CA6HxF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB1B"}

package/dist/harness/holdRedaction.js

@@ -42,11 +42,14 @@ export const MAX_SNAPSHOT_BYTES = 32_768;
 /**
  * Returns a redacted, size-capped copy of `value`.
  *
+ * `maxString` caps each string (the middle is dropped); config capture passes
+ * `Infinity`, because a captured file is uploaded whole or not at all.
+ *
  * Self-contained by contract — see the module docstring. Do not add imports or
  * outer-scope references to this function; `emitRedactor()` asserts it stays
  * closed over nothing.
  */
-export function redactSecrets(value, depth = 0) {
+export function redactSecrets(value, depth = 0, maxString = MAX_STRING) {
     // Keys whose value is a credential regardless of what it looks like. Matched
     // loosely on purpose: `apiKey`, `api_key`, `X-Api-Key` and `apikey` all occur.
     const SECRET_KEY = /(pass(word|phrase)?|secret|token|api[-_ ]?key|auth(orization)?|credential|private[-_ ]?key|session[-_ ]?id|cookie)/i;
@@ -62,7 +65,7 @@ export function redactSecrets(value, depth = 0) {
         /xox[abprs]-[A-Za-z0-9-]{10,}/g, // Slack
         /AIza[0-9A-Za-z_-]{30,}/g, // Google
         /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, // JWT
-        /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+        // PEM private keys are handled by redactPem below, not a pattern here.
         // Bare basic-auth in a URL.
         /\/\/[^/\s:@]+:[^/\s:@]+@/g,
     ];
@@ -116,17 +119,38 @@ export function redactSecrets(value, depth = 0) {
         // `[redacted]` swallowing the key name does not.
         return copied === 0 ? s : out + s.slice(copied);
     };
+    // A PEM private key, header to footer. Scanned rather than matched with one
+    // lazy `BEGIN[\s\S]*?END` pattern, which rescans to the end of the text from
+    // every header that has no footer: quadratic, and this runs before any
+    // length cap. A header with no footer is redacted to the end of the text,
+    // because a truncated key is still a key.
+    const redactPem = (s) => {
+        const BEGIN = /-----BEGIN[A-Z ]*PRIVATE KEY-----/g;
+        const END = /-----END[A-Z ]*PRIVATE KEY-----/g;
+        let out = '';
+        let copied = 0;
+        let m;
+        while ((m = BEGIN.exec(s)) !== null) {
+            out += s.slice(copied, m.index) + '[redacted]';
+            END.lastIndex = BEGIN.lastIndex;
+            if (END.exec(s) === null)
+                return out;
+            copied = END.lastIndex;
+            BEGIN.lastIndex = copied;
+        }
+        return copied === 0 ? s : out + s.slice(copied);
+    };
     const scrub = (s) => {
-        let out = s;
+        let out = redactPem(s);
         for (const re of SECRET_VALUE)
             out = out.replace(re, '[redacted]');
         out = redactAssignments(out);
-        if (out.length > MAX_STRING) {
+        if (out.length > maxString) {
             // Keep both ends. A command's verb is at the front and its target is at
             // the back; truncating the tail throws away the half that identifies what
             // the hold was about.
-            const half = Math.floor(MAX_STRING / 2);
-            out = `${out.slice(0, half)}…[${out.length - MAX_STRING} chars elided]…${out.slice(-half)}`;
+            const half = Math.floor(maxString / 2);
+            out = `${out.slice(0, half)}…[${out.length - maxString} chars elided]…${out.slice(-half)}`;
         }
         return out;
     };
@@ -139,7 +163,7 @@ export function redactSecrets(value, depth = 0) {
     if (typeof value === 'number' || typeof value === 'boolean')
         return value;
     if (Array.isArray(value)) {
-        const kept = value.slice(0, MAX_ARRAY).map((v) => redactSecrets(v, depth + 1));
+        const kept = value.slice(0, MAX_ARRAY).map((v) => redactSecrets(v, depth + 1, maxString));
         if (value.length > MAX_ARRAY)
             kept.push(`[${value.length - MAX_ARRAY} more elided]`);
         return kept;
@@ -147,7 +171,7 @@ export function redactSecrets(value, depth = 0) {
     if (typeof value === 'object') {
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            out[k] = SECRET_KEY.test(k) ? '[redacted]' : redactSecrets(v, depth + 1);
+            out[k] = SECRET_KEY.test(k) ? '[redacted]' : redactSecrets(v, depth + 1, maxString);
         }
         return out;
     }

package/dist/harness/holdRedaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"holdRedaction.js","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAA;AAC/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAA;AAC1B,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,qHAAqH,CAAA;IAEvH,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAa;QAC7B,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,8BAA8B;QACnD,4BAA4B,EAAE,YAAY;QAC1C,sBAAsB,EAAE,wBAAwB;QAChD,6BAA6B,EAAE,SAAS;QACxC,+BAA+B;QAC/B,+BAA+B,EAAE,QAAQ;QACzC,yBAAyB,EAAE,SAAS;QACpC,6DAA6D,EAAE,MAAM;QACrE,2EAA2E;QAC3E,4BAA4B;QAC5B,2BAA2B;KAC5B,CAAA;IAED,iEAAiE;IACjE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,MAAM,cAAc,GAAG,kEAAkE,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,CAAA;IAE5B,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBAAE,SAAQ;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAA;YACxB,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAA;YACpE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,SAAQ;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,YAAY,CAAA;YACrD,MAAM,GAAG,GAAG,CAAA;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;QACtB,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,iDAAiD;QACjD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAClE,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,wEAAwE;YACxE,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACvC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,UAAU,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,IAAI,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,mEAAmE;IACnE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,OAAO;QACL,0EAA0E;QAC1E,gEAAgE;QAChE,sBAAsB,UAAU,GAAG;QACnC,qBAAqB,SAAS,GAAG;QACjC,qBAAqB,SAAS,GAAG;QACjC,8BAA8B,kBAAkB,GAAG;QACnD,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;QACjD,gCAAgC,MAAM,CAAC,oBAAoB,CAAC,GAAG;QAC/D,wCAAwC;QACxC,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ,CAAC,WAAW,CAAC,GAAG,YAAY,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,OAAO,CAAA;IACnG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"holdRedaction.js","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAA;AAC/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAA;AAC1B,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,qHAAqH,CAAA;IAEvH,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAa;QAC7B,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,8BAA8B;QACnD,4BAA4B,EAAE,YAAY;QAC1C,sBAAsB,EAAE,wBAAwB;QAChD,6BAA6B,EAAE,SAAS;QACxC,+BAA+B;QAC/B,+BAA+B,EAAE,QAAQ;QACzC,yBAAyB,EAAE,SAAS;QACpC,6DAA6D,EAAE,MAAM;QACrE,uEAAuE;QACvE,4BAA4B;QAC5B,2BAA2B;KAC5B,CAAA;IAED,iEAAiE;IACjE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,MAAM,cAAc,GAAG,kEAAkE,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,CAAA;IAE5B,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBAAE,SAAQ;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAA;YACxB,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAA;YACpE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,SAAQ;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,YAAY,CAAA;YACrD,MAAM,GAAG,GAAG,CAAA;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;QACtB,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,iDAAiD;QACjD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;QACtC,MAAM,KAAK,GAAG,oCAAoC,CAAA;QAClD,MAAM,GAAG,GAAG,kCAAkC,CAAA;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,YAAY,CAAA;YAC9C,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;YAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAA;YACpC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAA;YACtB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACtB,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAClE,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACtC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,SAAS,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAC5F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,IAAI,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;QACzF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,mEAAmE;IACnE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,OAAO;QACL,0EAA0E;QAC1E,gEAAgE;QAChE,sBAAsB,UAAU,GAAG;QACnC,qBAAqB,SAAS,GAAG;QACjC,qBAAqB,SAAS,GAAG;QACjC,8BAA8B,kBAAkB,GAAG;QACnD,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;QACjD,gCAAgC,MAAM,CAAC,oBAAoB,CAAC,GAAG;QAC/D,wCAAwC;QACxC,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ,CAAC,WAAW,CAAC,GAAG,YAAY,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,OAAO,CAAA;IACnG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/harness/jetbrainsXmlConfig.d.ts

@@ -48,4 +48,24 @@
  * at all — refusal, not a guess.
  */
 export declare function mergeXmlComponentOptions(filePath: string, componentName: string, desiredOptions: Readonly<Record<string, string | boolean>>, readFile: (path: string) => Promise<string | null>, writeFileAtomic: (path: string, content: string) => Promise<void>): Promise<boolean>;
+/** One settings file as {@link parseComponentOptions} reads it. */
+export interface ComponentOptionsFile {
+    /** The named component's simple options. */
+    options: Record<string, string>;
+    /** Everything else inside that component, verbatim (normalised whitespace). */
+    extra?: string;
+    /** Every other component's block, verbatim, by name. */
+    others: Record<string, string>;
+}
+/**
+ * Reads `componentName`'s simple options from a settings file's text
+ * (`null` or empty: a file that does not exist yet). Returns null when the
+ * file is not the `<application><component>` shape this module understands.
+ */
+export declare function parseComponentOptions(raw: string | null, componentName: string): ComponentOptionsFile | null;
+/**
+ * Writes a settings file back in the layout {@link mergeXmlComponentOptions}
+ * uses. A component left with no options and nothing else is dropped.
+ */
+export declare function serializeComponentOptions(file: ComponentOptionsFile, componentName: string): string;
 //# sourceMappingURL=jetbrainsXmlConfig.d.ts.map

package/dist/harness/jetbrainsXmlConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jetbrainsXmlConfig.d.ts","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAwGH;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAC1D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,CA0BlB"}
+{"version":3,"file":"jetbrainsXmlConfig.d.ts","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAwGH;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAC1D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAS5G;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAanG"}

package/dist/harness/jetbrainsXmlConfig.js

@@ -125,27 +125,48 @@ function parseApplicationXml(raw, targetComponentName) {
  * at all — refusal, not a guess.
  */
 export async function mergeXmlComponentOptions(filePath, componentName, desiredOptions, readFile, writeFileAtomic) {
-    const existing = await readFile(filePath);
-    const parsed = parseApplicationXml(existing, componentName);
-    if (!parsed.ok)
+    const parsed = parseComponentOptions(await readFile(filePath), componentName);
+    if (parsed === null)
         return false;
-    const options = parsed.target?.simpleOptions ?? new Map();
     for (const [key, value] of Object.entries(desiredOptions)) {
-        options.set(key, typeof value === 'boolean' ? String(value) : value);
+        parsed.options[key] = typeof value === 'boolean' ? String(value) : value;
     }
-    const optionLines = [...options.entries()]
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([key, value]) => `    <option name="${escapeXmlAttr(key)}" value="${escapeXmlAttr(value)}" />`)
-        .join('\n');
-    const extra = parsed.target?.extra;
-    const componentBody = extra ? `${optionLines}\n${extra.split('\n').map((l) => `    ${l}`).join('\n')}` : optionLines;
-    const componentBlock = `  <component name="${escapeXmlAttr(componentName)}">\n${componentBody}\n  </component>`;
-    const otherBlocks = [...parsed.otherComponents.entries()]
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([, block]) => `  ${block}`);
-    const body = [componentBlock, ...otherBlocks].join('\n');
-    const serialized = `<application>\n${body}\n</application>\n`;
-    await writeFileAtomic(filePath, serialized);
+    await writeFileAtomic(filePath, serializeComponentOptions(parsed, componentName));
     return true;
 }
+/**
+ * Reads `componentName`'s simple options from a settings file's text
+ * (`null` or empty: a file that does not exist yet). Returns null when the
+ * file is not the `<application><component>` shape this module understands.
+ */
+export function parseComponentOptions(raw, componentName) {
+    const parsed = parseApplicationXml(raw, componentName);
+    if (!parsed.ok)
+        return null;
+    const out = {
+        options: Object.fromEntries(parsed.target?.simpleOptions ?? new Map()),
+        others: Object.fromEntries(parsed.otherComponents),
+    };
+    if (parsed.target?.extra)
+        out.extra = parsed.target.extra;
+    return out;
+}
+/**
+ * Writes a settings file back in the layout {@link mergeXmlComponentOptions}
+ * uses. A component left with no options and nothing else is dropped.
+ */
+export function serializeComponentOptions(file, componentName) {
+    const optionLines = Object.entries(file.options)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) => `    <option name="${escapeXmlAttr(key)}" value="${escapeXmlAttr(value)}" />`);
+    const extraLines = file.extra ? file.extra.split('\n').map((l) => `    ${l}`) : [];
+    const blocks = Object.entries(file.others).map(([name, block]) => [name, `  ${block}`]);
+    if (optionLines.length + extraLines.length > 0) {
+        const componentBody = [...optionLines, ...extraLines].join('\n');
+        blocks.push([componentName, `  <component name="${escapeXmlAttr(componentName)}">\n${componentBody}\n  </component>`]);
+    }
+    // The target component first, then the rest by name: the order the merge has always written.
+    blocks.sort(([a], [b]) => (a === componentName ? -1 : b === componentName ? 1 : a.localeCompare(b)));
+    return `<application>\n${blocks.map(([, block]) => block).join('\n')}\n</application>\n`;
+}
 //# sourceMappingURL=jetbrainsXmlConfig.js.map

package/dist/harness/jetbrainsXmlConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"jetbrainsXmlConfig.js","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0BH,MAAM,YAAY,GAAG,sDAAsD,CAAA;AAC3E,MAAM,gBAAgB,GAAG,mDAAmD,CAAA;AAE5E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAA;IAC9B,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC5E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjC,CAAC;IACD,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,eAAe,GAAG,KAAK;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AAClD,CAAC;AAED;;;2CAG2C;AAC3C,SAAS,mBAAmB,CAAC,GAAkB,EAAE,mBAA2B;IAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,MAAmC,CAAA;IACvC,IAAI,KAA6B,CAAA;IACjC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC7E,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC1D,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,IAAI,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,aAAqB,EACrB,cAA0D,EAC1D,QAAkD,EAClD,eAAiE;IAEjE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAA;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,aAAa,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;SACpG,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAA;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IACpH,MAAM,cAAc,GAAG,sBAAsB,aAAa,CAAC,aAAa,CAAC,OAAO,aAAa,kBAAkB,CAAA;IAE/G,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;IAEnC,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,kBAAkB,IAAI,oBAAoB,CAAA;IAC7D,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC3C,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"jetbrainsXmlConfig.js","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0BH,MAAM,YAAY,GAAG,sDAAsD,CAAA;AAC3E,MAAM,gBAAgB,GAAG,mDAAmD,CAAA;AAE5E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAA;IAC9B,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC5E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjC,CAAC;IACD,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,eAAe,GAAG,KAAK;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AAClD,CAAC;AAED;;;2CAG2C;AAC3C,SAAS,mBAAmB,CAAC,GAAkB,EAAE,mBAA2B;IAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,MAAmC,CAAA;IACvC,IAAI,KAA6B,CAAA;IACjC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAC7E,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC1D,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,IAAI,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,aAAqB,EACrB,cAA0D,EAC1D,QAAkD,EAClD,eAAiE;IAEjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IAC7E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,CAAC,QAAQ,EAAE,yBAAyB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB,EAAE,aAAqB;IAC7E,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,MAAM,GAAG,GAAyB;QAChC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;QACtF,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC;KACnD,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAA;IACzD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA0B,EAAE,aAAqB;IACzF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,aAAa,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,MAAM,MAAM,GAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAA;IAC3G,IAAI,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,sBAAsB,aAAa,CAAC,aAAa,CAAC,OAAO,aAAa,kBAAkB,CAAC,CAAC,CAAA;IACxH,CAAC;IACD,6FAA6F;IAC7F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpG,OAAO,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAA;AAC1F,CAAC"}

package/dist/harness/mcpAutoWrite.d.ts

@@ -4,7 +4,10 @@
  *
  * Injects and proxy-wraps MCP server entries in:
  * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
- *                      local-scope `projects[<workspaceRoot>].mcpServers`)
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`,
+ *                      where the approved servers of the project's
+ *                      `.mcp.json` also get wrapped shadows — the shared
+ *                      `.mcp.json` itself is only read)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -17,13 +20,18 @@
  * - Grok Build:       ~/.grok/config.toml + <workspaceRoot>/.grok/config.toml
  *                      ([mcp_servers.*] tables)
  * - OpenCode:         ~/.config/opencode/opencode.json + <workspaceRoot>/opencode.json
- *                      (`mcp` block — TD-487; see `injectOpenCode`)
+ *                      (`mcp` block; see `injectOpenCode`)
+ * - Gemini CLI:       ~/.gemini/settings.json + <workspaceRoot>/.gemini/settings.json
+ *                      (`mcpServers`)
+ * - Antigravity:      ~/.gemini/config/mcp_config.json (`mcpServers`)
+ *                      (both under the `antigravity` harness; see `injectAntigravity`)
  *
- * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
+ * That is 17 config paths across 12 `HarnessType` values (Cursor, Grok
  * Build and OpenCode each own two paths — global/project for Cursor and
- * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
- * all fourteen read-only, for reporting; the injectors above are the only
- * thing that writes.
+ * OpenCode, user/project for Grok Build — and the `antigravity` harness
+ * three, for its two products). `discoverMcpServers` below reads all
+ * seventeen read-only, for reporting, plus Claude Code's project
+ * `.mcp.json`; the injectors above are the only thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -56,8 +64,9 @@
  * `command`-or-`url` shape every other JSON-map harness here uses — `wrapAllServers`
  * / `wrapWithProxy` branch on exactly that, so a `streamable_http` entry is
  * wrapped through the SAME remote-bridge path a `url`-keyed Claude Desktop/
- * Windsurf entry gets, without new code. See TD-362 for why this is recorded
- * as an assumption rather than a confirmation.
+ * Windsurf entry gets, without new code. This is recorded as an assumption
+ * rather than a confirmation because the `muse` binary could not be installed
+ * to check it (see museHooks.ts).
  *
  * Proxy-wrapping convention:
  *   Each existing stdio MCP server entry is rewritten so that the governance
@@ -65,25 +74,22 @@
  *   after `--`, tagged with `--server-name <name>` so the proxy can attribute
  *   traffic to the server it fronts. A `__intutic_wrapped: true` flag is added
  *   to prevent double-wrapping. Remote (HTTP/SSE, `url`-keyed) entries are now
- *   ALSO wrapped — TD-354's stdio→HTTP bridge phase closed the gap this
+ *   ALSO wrapped — the stdio→HTTP bridge phase closed the gap this
  *   comment used to describe as "left untouched": the entry is rewritten to
  *   spawn the SAME proxy binary in bridge mode (`--remote-url`/
  *   `--remote-transport`, headers riding in `INTUTIC_REMOTE_HEADERS` env, not
- *   argv — `ps` visibility). `__intutic_original` preserves the entry's
- *   pre-wrap `url`/`type`/`headers` so `classifyEntry` can report the TRUE
- *   transport of what got wrapped, and so a wrapped entry could be unwrapped
- *   later. See TECH_DEBT.md TD-354 for the historical decline this phase
- *   supersedes.
- *
- * Continuous invariant, not one-shot: `injectMcpServer` is called once from
- * `intutic connect` (tools/cli) AND once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts), so a server a user adds to a harness
+ *   argv — `ps` visibility). `__intutic_original` keeps the whole pre-wrap
+ *   entry, stdio or remote, so `classifyEntry` can report the TRUE transport
+ *   of what got wrapped and `intutic disconnect` can put the entry back
+ *   exactly.
+ *
+ * Continuous invariant, not one-shot: `intutic connect` (tools/cli) calls
+ * `injectMcpServer` on every sync cycle, so a server a user adds to a harness
  * config after their first `connect` still gets wrapped on the next sync
  * cycle rather than staying invisible to governance forever. Running this
  * every ~30s only works because `writeJsonFile` below is write-if-changed —
  * an already-wrapped, unchanged config produces zero bytes written.
  *
- * LLD #14 — mcpAutoWrite.ts
  * HLD §3.14 — GUI Harness Interception (MCP registration + Universal MCP Governance)
  *
  * @module
@@ -95,6 +101,18 @@ export interface DiscoveredMcpServer {
     harness: string;
     transport: 'stdio' | 'http' | 'sse' | 'unknown';
     wrapped: boolean;
+    /**
+     * A remote server's URL, without its user name, password, query string or
+     * a token-shaped path segment (`sanitizeMcpEndpoint`). Absent for a local
+     * server: its command line can carry secrets and is never reported.
+     */
+    endpoint?: string;
+    /**
+     * Set on a server the harness will start but the proxy cannot govern, with
+     * the reason. Today: an approved Claude Code project server that gets no
+     * local-scope copy (see `shadowBlocker` and `projectServerApproval`).
+     */
+    ungovernedReason?: string;
 }
 /**
  * Resolve the path to the @intutic/mcp-governance-proxy entry point.
@@ -114,9 +132,26 @@ export interface DiscoveredMcpServer {
  * hot path.
  */
 export declare function resolveProxyBin(workspaceRoot: string): string;
+export declare function claudeDesktopConfigPath(): string;
+export declare function cursorGlobalConfigPath(): string;
+export declare function windsurfConfigPath(): string;
+export declare function continueConfigPath(): string;
+export declare function gooseConfigPath(): string;
+export declare function museConfigPath(): string;
+export declare function grokUserConfigPath(): string;
+/** OpenCode's global config: `$XDG_CONFIG_HOME/opencode/opencode.json`, which
+ *  is `~/.config/opencode/opencode.json` unless XDG_CONFIG_HOME is set (OpenCode
+ *  resolves it through xdg-basedir). Only the `.json` spelling — see `injectOpenCode`. */
+export declare function openCodeGlobalConfigPath(): string;
+/** Gemini CLI's user settings, which also hold its `BeforeTool` gate (antigravityHooks.ts). */
+export declare function geminiSettingsPath(): string;
+/** Google Antigravity's global MCP servers, next to its `hooks.json` (antigravityCliHooks.ts). */
+export declare function antigravityMcpConfigPath(): string;
+/** The proxy binary path `resolveProxyBin` returns, in either of its two forms. */
+export declare const PROXY_BIN_PATTERN: RegExp;
 /**
  * Discover every MCP server declared in any harness config this daemon knows
- * how to parse — the same 14 config paths / 11 harnesses `injectMcpServer`
+ * how to parse — the same 17 config paths / 12 harnesses `injectMcpServer`
  * wraps — without writing anything. Used for reporting (agentReporter's
  * `mcp_tools` facet) so visibility does not silently lag behind whatever
  * `injectMcpServer` was last run against.
@@ -139,16 +174,18 @@ export declare function discoverMcpServers(workspaceRoot: string): Promise<Disco
  *
  * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
  *
- * Called from two places by design: once from `intutic connect` (tools/cli)
- * for immediate effect, and once per sync-loop iteration
- * (services/sync-daemon/src/syncLoop.ts) so it is a continuous invariant
- * rather than a one-shot — a server a user adds after their first `connect`
+ * Called by `intutic connect` (tools/cli) on every sync cycle, so it is a
+ * continuous invariant rather than a one-shot — a server a user adds after their first `connect`
  * still gets wrapped on the next cycle. Safe to call every cycle because
  * `writeJsonFile` is write-if-changed: an already-wrapped, unchanged config
  * writes zero bytes.
  *
  * @param workspaceId - The workspace ID for policy lookups and event attribution.
  * @param workspaceRoot - Absolute path to the project workspace root.
+ * @param options.skip - Harness ids to leave alone: the ones `intutic
+ *   disconnect --harness` took out.
  */
-export declare function injectMcpServer(workspaceRoot: string, workspaceId?: string): Promise<void>;
+export declare function injectMcpServer(workspaceRoot: string, workspaceId?: string, options?: {
+    skip?: readonly string[];
+}): Promise<void>;
 //# sourceMappingURL=mcpAutoWrite.d.ts.map

package/dist/harness/mcpAutoWrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpAutoWrite.d.ts","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAsDH;gEACgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;CACjB;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAc7D;AAopCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgB9F;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BnG"}
+{"version":3,"file":"mcpAutoWrite.d.ts","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAkEH;gEACgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAc7D;AAgBD,wBAAgB,uBAAuB,IAAI,MAAM,CAQhD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAQ/C;AAUD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAMD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD;;0FAE0F;AAC1F,wBAAgB,wBAAwB,IAAI,MAAM,CAGjD;AAMD,+FAA+F;AAC/F,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD,kGAAkG;AAClG,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAyyBD,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,QAAoG,CAAA;AAimBlI;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiB9F;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,WAAW,SAAY,EACvB,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACzC,OAAO,CAAC,IAAI,CAAC,CA4Bf"}