@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/syncLoop.d.ts

@@ -1,172 +0,0 @@
-/**
- * syncLoop.ts — Core bidirectional sync loop.
- *
- * The sync loop is the heartbeat of the daemon. Each iteration:
- * 1. Fetches config from the control plane (POST /api/v1/sync/config)
- * 2. If configVersion > local → writes SOP content to harness files
- * 3. Computes SHA-256 hashes of local config files
- * 4. Reports hashes + status back to the control plane
- * 5. Calls the onSync callback with the result
- * 6. Sleeps for pollIntervalMs (AbortSignal-aware)
- * 7. Repeats until signal.aborted
- *
- * Design: never crash on a single iteration failure. Errors are
- * caught per-iteration, logged, and the loop continues.
- *
- * HLD §3.14 — Real-Time State Mirroring
- * LLD #8 — Sync Daemon / CLI
- *
- * @module
- */
-import type { HarnessType, SyncConfigPayload, WorkspaceSettings, SyncSopEntry } from '@intutic/shared-types';
-import { type GovernanceCoverageInputs } from './configReader.js';
-import { type AgentReport } from './agentReporter.js';
-/**
- * Turns a non-clean `scanSkillContent` result — already computed as part of
- * `collectAgentReport`'s `facets.skills` — into a `skill_flagged` hook event
- * (TD-358).
- *
- * Deliberately reuses the report the daemon already built for this cycle
- * rather than re-scanning: `agentReporter.ts`'s `collectSkills` runs
- * `scanSkillContent` on every `.agents/skills/**\/SKILL.md` as part of
- * building `facets.skills` already, so this only turns a result the daemon
- * already has into a visible signal — it does not add a second scan pass.
- *
- * Appends directly to `.intutic/events/hook-events.jsonl`, the SAME file
- * every emitted PreToolUse gate's `log_event`/`logEvent` writes to and the
- * SAME mechanism `onDriftDetected` below already uses for `config_tamper` —
- * not a new event pipeline. `drainHookEvents` (`claudeCodeHooks.ts`) picks
- * this line up on its next pass exactly like a gate-written one, because it
- * only ever reads the file; it does not care who appended a given line.
- *
- * Report-only, per `scanSkillContent`'s own doc comment on the unmeasured
- * false-positive rate against real, benign skill markdown: this NEVER
- * blocks, mutates, or removes a skill. `hookEvents.ts`'s
- * `HookEventSchema.event` enum (control plane) counts `skill_flagged`
- * exactly like `tool_flagged` — advisory telemetry, not an incident.
- *
- * A failure to append is caught and warned, never thrown: a governance
- * telemetry write must not be able to abort the sync cycle it rides in on.
- */
-export declare function emitSkillFlaggedEvents(opts: {
-    workspaceRoot: string;
-    workspaceId: string;
-    harnessType: HarnessType;
-    skills: AgentReport['facets']['skills'];
-    /** Skills already emitted in this cycle, keyed `source:name`, mutated in
-     *  place. A skill is not harness-specific, and the caller invokes this
-     *  once per harness in the workspace — without a shared set, a workspace
-     *  with two active harnesses would double-emit every flagged skill. */
-    alreadyEmitted: Set<string>;
-}): void;
-/** Configuration for the sync loop. */
-export interface SyncLoopOptions {
-    /** Control plane base URL (e.g., `https://api.intutic.ai`). */
-    controlPlaneUrl: string;
-    /** API key for authentication (vk_* or JWT). */
-    apiKey: string;
-    /** Workspace identifier. */
-    workspaceId: string;
-    /** Absolute path to the workspace root directory. */
-    workspaceRoot: string;
-    /** Poll interval in milliseconds (default: 30000). */
-    pollIntervalMs?: number;
-    /** Enable dev mode (relaxed checks, verbose logging). */
-    devMode?: boolean;
-    /** Callback invoked after each successful sync iteration. */
-    onSync?: (result: SyncResult) => void;
-    /** AbortSignal to gracefully stop the loop. */
-    signal?: AbortSignal;
-}
-/** Result of a single sync iteration. */
-export interface SyncResult {
-    /** Config version from the control plane. */
-    configVersion: number;
-    /** Number of harness config files written. */
-    sopsWritten: number;
-    /** Number of files with hash drift. */
-    driftCount: number;
-    /** ISO timestamp of this sync. */
-    timestamp: string;
-    /** Resolved workspace settings from the control plane. WS-5. */
-    settings?: WorkspaceSettings;
-    /** All active SOP rules. */
-    sops?: SyncConfigPayload['sops'];
-    /** Proxy URL. */
-    proxyUrl?: string;
-    /** Active harnesses. */
-    harnesses?: HarnessType[];
-    /**
-     * This cycle's per-harness governance-coverage enforcement signals, derived
-     * from the same `collectAgentReport` facets step 5b already computes for
-     * `POST /api/v1/agents/report` — see that step's inline derivation for the
-     * mapping. Consumed by the outer loop's config-capture step to fire
-     * `POST /api/v1/governance-coverage/snapshot` once per harness whose rules
-     * file content actually changed this cycle.
-     */
-    harnessGovernanceInputs?: Partial<Record<HarnessType, GovernanceCoverageInputs>>;
-}
-/**
- * Start the sync loop. This function runs indefinitely until the
- * AbortSignal is triggered or the process exits.
- *
- * @param options - Sync loop configuration.
- */
-/** The credentials every gate-side refresh takes. */
-export interface GateCacheRefreshOptions {
-    controlPlaneUrl: string;
-    apiKey: string;
-    workspaceId: string;
-    /** See {@link PolicySnapshotOptions.localHoldTokens}. */
-    localHoldTokens?: readonly string[];
-}
-/**
- * The `review_before:` tokens the snapshot compiles into hold rules: from the
- * synced SOPs' front matter and JSON blocks, the workspace settings, and the
- * local `.intutic/sops`. The same parse the Claude Code writer runs for its
- * pattern blacklist, so the two cannot disagree about what is held.
- */
-export declare function localHoldTokensFor(workspaceRoot: string, sops: SyncSopEntry[], settings: Record<string, unknown> | undefined, harnesses?: HarnessType[]): Promise<string[]>;
-/**
- * Refresh the three gate-side caches every hook reads: the policy snapshot
- * (`~/.intutic/hooks/policy-snapshot.rules`), the approved review-hold
- * bypasses and the central egress policy. Called on EVERY sync cycle by both
- * loops — this one and `intutic connect`'s — never only when the config
- * version moved: policy changes without the version changing, and before
- * this helper existed `connect` refreshed once at startup and never again, so
- * a guardrail promoted mid-session reached a connected machine only on
- * restart (TD-488). None of the three throw; the return says which of them
- * landed.
- */
-export declare function refreshGateCaches(opts: GateCacheRefreshOptions): Promise<{
-    snapshot: boolean;
-    bypasses: boolean;
-    egress: boolean;
-}>;
-export declare function startSyncLoop(options: SyncLoopOptions): Promise<void>;
-export interface IterationContext {
-    controlPlaneUrl: string;
-    apiKey: string;
-    workspaceId: string;
-    workspaceRoot: string;
-    onSync?: (result: SyncResult) => void;
-}
-/**
- * Execute a single sync iteration:
- * 1. Fetch config from control plane
- * 2. Write config files if version is newer
- * 3. Compute file hashes
- * 4. Report status back to control plane
- * 5. Update local integrity store
- * 6. Call onSync callback
- *
- * Exported (in addition to being used internally by `startSyncLoop`'s
- * polling loop) as a test seam — it is the unit that exercises exactly one
- * cycle's worth of work, including the injectMcpServer call (step 3c),
- * without the surrounding while-loop's extra one-time/Nth-iteration network
- * calls (policy snapshot, approved bypasses, egress policy, compliance
- * probes, drift watcher, decisions digest, config capture).
- */
-export declare function runSyncIteration(ctx: IterationContext): Promise<SyncResult>;
-export declare function syncOfflineTraces(controlPlaneUrl: string, apiKey: string): Promise<void>;
-//# sourceMappingURL=syncLoop.d.ts.map

package/dist/syncLoop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"syncLoop.d.ts","sourceRoot":"","sources":["../src/syncLoop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,iBAAiB,EACjB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAqB9B,OAAO,EAAgD,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAS/G,OAAO,EAA8D,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAqBjH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;IACvC;;;2EAGuE;IACvE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC5B,GAAG,IAAI,CA+BP;AAID,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IACrC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAChC,iBAAiB;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wBAAwB;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAA;IACzB;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAA;CACjF;AA6BD;;;;;GAKG;AACH,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,SAAS,GAAE,WAAW,EAAO,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAKpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8R3E;AAID,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4PjF;AAwKD,wBAAsB,iBAAiB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqE9F"}