@intutic/sync-daemon 2.2.0 → 2.3.0

package/dist/lib/regexLinearity.js

@@ -0,0 +1,275 @@
+/**
+ * A static check for the regex constructs that make a backtracking engine
+ * super-linear, run on every pattern the gates evaluate against a command or
+ * a tool's arguments.
+ *
+ * The JavaScript gates run rule sources as `RegExp`s and the Python ones as
+ * `re` patterns; both backtrack. A rule like ` git .*(…)` was correct and took
+ * 9.5 s on 200 KB of crafted command, long enough for a harness that treats a
+ * hook timeout as "allow" to run the call. The constructs below are the ones
+ * that cost time growing faster than the text:
+ *
+ * - **nested quantifier**: a repeated group that contains a repeated element,
+ *   `(a+)+` — the classic catastrophic form;
+ * - **unbounded wildcard before more pattern**: `.*`, `[\s\S]*`, a negated
+ *   class or `\S`/`\W`/`\D` repeated without bound and followed by anything —
+ *   every start rescans to the end of the text;
+ * - **unbounded lazy quantifier**: `*?`, `+?`, `{n,}?` — the same rescan, one
+ *   character at a time;
+ * - **adjacent overlapping runs**: two unbounded repetitions whose character
+ *   sets overlap, with nothing between them that only one can match —
+ *   `[a-z]*R[a-z]*` tries every split of `RRRR…`.
+ *
+ * A pattern that needs one of these anyway goes on {@link BACKTRACKING_ALLOWLIST}
+ * by rule id, with the reason a reviewer accepted it; the test that walks
+ * every gate rule fails on anything else. A rule marked `sequence` is checked
+ * step by step, since that is how the JS and Python gates run it.
+ *
+ * It parses the JS ∩ Python `re` dialect the rules use. Character sets are
+ * modelled over ASCII; a class with anything beyond ASCII counts as
+ * overlapping everything, which errs toward a finding.
+ */
+const range = (from, to) => {
+    const s = new Array(128).fill(false);
+    for (let c = from; c <= to; c++)
+        s[c] = true;
+    return s;
+};
+const union = (a, b) => a.map((v, i) => v || b[i]);
+const invert = (a) => a.map((v) => !v);
+const SPACE = (() => {
+    const s = new Array(128).fill(false);
+    for (const c of [9, 10, 11, 12, 13, 32])
+        s[c] = true;
+    return s;
+})();
+const DIGIT = range(48, 57);
+const WORD = union(union(union(range(48, 57), range(65, 90)), range(97, 122)), (() => {
+    const s = new Array(128).fill(false);
+    s[95] = true;
+    return s;
+})());
+const ALL = range(0, 127);
+const single = (ch) => {
+    const s = new Array(128).fill(false);
+    const c = ch.charCodeAt(0);
+    if (c < 128)
+        s[c] = true;
+    else
+        s.fill(true); // beyond ASCII: assume it overlaps everything
+    return s;
+};
+/** The set an escape names, and whether it is one of the wide negations. */
+function escapeSet(ch) {
+    switch (ch) {
+        case 's': return { set: SPACE, wide: false };
+        case 'S': return { set: invert(SPACE), wide: true };
+        case 'd': return { set: DIGIT, wide: false };
+        case 'D': return { set: invert(DIGIT), wide: true };
+        case 'w': return { set: WORD, wide: false };
+        case 'W': return { set: invert(WORD), wide: true };
+        case 'n': return { set: single('\n'), wide: false };
+        case 't': return { set: single('\t'), wide: false };
+        case 'r': return { set: single('\r'), wide: false };
+        default: return { set: single(ch), wide: false };
+    }
+}
+/** Parses `source` into alternatives of items. Throws on syntax it does not know. */
+function parse(source) {
+    let i = 0;
+    const alternatives = () => {
+        const alts = [[]];
+        while (i < source.length) {
+            const c = source[i];
+            if (c === ')')
+                break;
+            if (c === '|') {
+                i++;
+                alts.push([]);
+                continue;
+            }
+            const item = atom();
+            if (item) {
+                quantifier(item);
+                alts[alts.length - 1].push(item);
+            }
+        }
+        return alts;
+    };
+    const atom = () => {
+        const c = source[i];
+        const base = { group: null, min: 1, max: 1, lazy: false, wide: false };
+        if (c === '(') {
+            i++;
+            if (source[i] === '?') {
+                // (?: (?= (?! (?<= (?<! — the group's kind does not change the check.
+                i++;
+                if (source[i] === '<')
+                    i++;
+                i++;
+            }
+            const group = alternatives();
+            if (source[i] !== ')')
+                throw new Error(`unclosed group in ${source}`);
+            i++;
+            return { ...base, set: null, group };
+        }
+        if (c === '[')
+            return { ...base, ...charClass(), group: null };
+        if (c === '\\') {
+            const e = source[i + 1] ?? '';
+            i += 2;
+            if (e === 'b' || e === 'B')
+                return null; // an assertion, not a character
+            if (/[1-9]/.test(e))
+                return { ...base, set: ALL }; // a backreference: counts as one wide character
+            const { set, wide } = escapeSet(e);
+            return { ...base, set, wide };
+        }
+        i++;
+        if (c === '^' || c === '$')
+            return null;
+        if (c === '.')
+            return { ...base, set: invert(single('\n')), wide: true };
+        return { ...base, set: single(c) };
+    };
+    const charClass = () => {
+        i++; // [
+        let negated = false;
+        if (source[i] === '^') {
+            negated = true;
+            i++;
+        }
+        let set = new Array(128).fill(false);
+        let first = true;
+        while (i < source.length && (source[i] !== ']' || first)) {
+            first = false;
+            let lo;
+            let loChar = '';
+            if (source[i] === '\\') {
+                const e = source[i + 1] ?? '';
+                i += 2;
+                lo = escapeSet(e).set;
+                if (!/[sSdDwW]/.test(e))
+                    loChar = e === 'n' ? '\n' : e === 't' ? '\t' : e === 'r' ? '\r' : e;
+            }
+            else {
+                loChar = source[i];
+                lo = single(loChar);
+                i++;
+            }
+            if (loChar && source[i] === '-' && source[i + 1] !== ']' && i + 1 < source.length) {
+                i++;
+                let hiChar = source[i];
+                if (hiChar === '\\') {
+                    hiChar = source[i + 1] ?? '';
+                    i++;
+                }
+                i++;
+                set = union(set, range(loChar.charCodeAt(0), Math.min(127, hiChar.charCodeAt(0))));
+                if (hiChar.charCodeAt(0) > 127)
+                    set = ALL.slice();
+                continue;
+            }
+            set = union(set, lo);
+        }
+        i++; // ]
+        const full = set.every(Boolean);
+        return { set: negated ? invert(set) : set, wide: negated || full };
+    };
+    const quantifier = (item) => {
+        const c = source[i];
+        if (c === '*')
+            [item.min, item.max] = [0, Infinity];
+        else if (c === '+')
+            [item.min, item.max] = [1, Infinity];
+        else if (c === '?')
+            [item.min, item.max] = [0, 1];
+        else if (c === '{') {
+            const m = /^\{(\d+)(,(\d*))?\}/.exec(source.slice(i));
+            if (!m)
+                return;
+            item.min = Number(m[1]);
+            item.max = m[2] === undefined ? item.min : m[3] === '' ? Infinity : Number(m[3]);
+            i += m[0].length - 1;
+        }
+        else
+            return;
+        i++;
+        if (source[i] === '?') {
+            item.lazy = true;
+            i++;
+        }
+    };
+    const alts = alternatives();
+    if (i !== source.length)
+        throw new Error(`unbalanced ) in ${source}`);
+    return alts;
+}
+const unbounded = (it) => it.max === Infinity;
+const hasUnbounded = (alts) => alts.some((seq) => seq.some((it) => unbounded(it) || (it.group !== null && hasUnbounded(it.group))));
+const overlaps = (a, b) => a.some((v, i) => v && b[i]);
+/** Every construct in `source` that can make a backtracking engine super-linear. */
+export function backtrackingFindings(source) {
+    const findings = [];
+    const subset = (a, b) => a.every((v, c) => !v || b[c]);
+    const walk = (alts, topLevel) => {
+        for (const seq of alts) {
+            seq.forEach((it, k) => {
+                if (it.group && unbounded(it) && hasUnbounded(it.group))
+                    findings.push('nested quantifier');
+                if (it.lazy && unbounded(it))
+                    findings.push('unbounded lazy quantifier');
+                // A wide run is harmless only as the very last thing a match needs.
+                if (it.wide && unbounded(it) && !(topLevel && k === seq.length - 1)) {
+                    findings.push('unbounded wildcard before more pattern');
+                }
+                if (it.set && unbounded(it)) {
+                    // Past the fixed characters this run could also have taken, is the
+                    // next repetition one whose set overlaps it?
+                    for (let j = k + 1; j < seq.length; j++) {
+                        const next = seq[j];
+                        if (!next.set)
+                            break;
+                        if (unbounded(next)) {
+                            if (overlaps(it.set, next.set))
+                                findings.push('adjacent overlapping runs');
+                            break;
+                        }
+                        if (!subset(next.set, it.set))
+                            break;
+                    }
+                }
+                if (it.group)
+                    walk(it.group, false);
+            });
+        }
+    };
+    walk(parse(source), true);
+    return [...new Set(findings)];
+}
+/**
+ * Rules allowed a construct {@link backtrackingFindings} reports, by rule id,
+ * with the reason a reviewer accepted it. Each entry must still trip the
+ * check (a stale entry fails the test), and each such rule has adversarial
+ * vectors that every reader must decide in linear time.
+ */
+export const BACKTRACKING_ALLOWLIST = {
+    'destructive.rm_rf_root': '`( +-[a-zA-Z-]+)+`: every repetition must begin with a space and the inner run cannot ' +
+        'contain one, so there is one way to split the flags; each ` rm` start does work linear in ' +
+        'its own flag list and stops at the next ` rm`.',
+    'skill_content.*': 'The argPattern wrapper `"key":"(?:[^"\\\\]|\\\\.)*?(?:P)` scans one JSON string lazily and ' +
+        'tries P at each position. It starts only at a key, which can appear unescaped in ' +
+        'the serialized input only as a key; the two alternatives begin with different ' +
+        'characters, so the scan is single-pass; and each P is bounded per position ' +
+        '(`{0,40}`-style windows, a lookahead-committed URL in markdown-exfil-link, a 600-character ' +
+        'close check in html-comment-hidden-instruction).',
+};
+/** The allowlist entry that covers a rule id, if any (`prefix.*` entries match a family). */
+export function backtrackingAllowance(id) {
+    if (BACKTRACKING_ALLOWLIST[id])
+        return BACKTRACKING_ALLOWLIST[id];
+    const family = Object.keys(BACKTRACKING_ALLOWLIST).find((k) => k.endsWith('.*') && id.startsWith(k.slice(0, -1)));
+    return family ? BACKTRACKING_ALLOWLIST[family] : undefined;
+}
+//# sourceMappingURL=regexLinearity.js.map

package/dist/lib/regexLinearity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regexLinearity.js","sourceRoot":"","sources":["../../src/lib/regexLinearity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAkBH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE;IAClD,MAAM,CAAC,GAAY,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAC5C,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC9E,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACxD,MAAM,KAAK,GAAY,CAAC,GAAG,EAAE;IAC3B,MAAM,CAAC,GAAY,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACpD,OAAO,CAAC,CAAA;AACV,CAAC,CAAC,EAAE,CAAA;AACJ,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;IACnF,MAAM,CAAC,GAAY,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;IACZ,OAAO,CAAC,CAAA;AACV,CAAC,CAAC,EAAE,CAAC,CAAA;AACL,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACzB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAW,EAAE;IACrC,MAAM,CAAC,GAAY,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,GAAG;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,8CAA8C;IAChE,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,EAAU;IAC3B,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAC5C,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACnD,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAC5C,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACnD,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAC3C,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAClD,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACnD,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACnD,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACnD,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAClD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,KAAK,CAAC,MAAc;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,YAAY,GAAG,GAAa,EAAE;QAClC,MAAM,IAAI,GAAa,CAAC,EAAE,CAAC,CAAA;QAC3B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,KAAK,GAAG;gBAAE,MAAK;YACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,CAAC,EAAE,CAAA;gBACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACb,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,GAAgB,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACtE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAA;YACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,sEAAsE;gBACtE,CAAC,EAAE,CAAA;gBACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,EAAE,CAAA;gBAC1B,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAA;YAC5B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAA;YACrE,CAAC,EAAE,CAAA;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACtC,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAC9D,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7B,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA,CAAC,gCAAgC;YACxE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,gDAAgD;YAClG,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;YAClC,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAC/B,CAAC;QACD,CAAC,EAAE,CAAA;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACvC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACxE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACpC,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,GAAoC,EAAE;QACtD,CAAC,EAAE,CAAA,CAAC,IAAI;QACR,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,CAAA;YACd,CAAC,EAAE,CAAA;QACL,CAAC;QACD,IAAI,GAAG,GAAY,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,KAAK,GAAG,IAAI,CAAA;QAChB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YACzD,KAAK,GAAG,KAAK,CAAA;YACb,IAAI,EAAW,CAAA;YACf,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC7B,CAAC,IAAI,CAAC,CAAA;gBACN,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;gBACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9F,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;gBACnB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;gBACnB,CAAC,EAAE,CAAA;YACL,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClF,CAAC,EAAE,CAAA;gBACH,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;gBACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;oBAC5B,CAAC,EAAE,CAAA;gBACL,CAAC;gBACD,CAAC,EAAE,CAAA;gBACH,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBAClF,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG;oBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAA;gBACjD,SAAQ;YACV,CAAC;YACD,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;QACD,CAAC,EAAE,CAAA,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/B,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CAAA;IACpE,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,IAAU,EAAQ,EAAE;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;aAC9C,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;aACnD,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;aAC5C,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrD,IAAI,CAAC,CAAC;gBAAE,OAAM;YACd,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAChF,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;QACtB,CAAC;;YAAM,OAAM;QACb,CAAC,EAAE,CAAA;QACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAChB,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,EAAQ,EAAW,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAA;AAC5D,MAAM,YAAY,GAAG,CAAC,IAAc,EAAW,EAAE,CAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAElF,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IAClF,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,QAAiB,EAAQ,EAAE;QACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpB,IAAI,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;gBAC3F,IAAI,EAAE,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBACxE,oEAAoE;gBACpE,IAAI,EAAE,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBACpE,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;gBACzD,CAAC;gBACD,IAAI,EAAE,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC5B,mEAAmE;oBACnE,6CAA6C;oBAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAA;wBACpB,IAAI,CAAC,IAAI,CAAC,GAAG;4BAAE,MAAK;wBACpB,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;4BACpB,IAAI,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gCAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;4BAC1E,MAAK;wBACP,CAAC;wBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;4BAAE,MAAK;oBACtC,CAAC;gBACH,CAAC;gBACD,IAAI,EAAE,CAAC,KAAK;oBAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACrC,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAqC;IACtE,wBAAwB,EACtB,wFAAwF;QACxF,4FAA4F;QAC5F,gDAAgD;IAClD,iBAAiB,EACf,6FAA6F;QAC7F,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,6FAA6F;QAC7F,kDAAkD;CACrD,CAAA;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,IAAI,sBAAsB,CAAC,EAAE,CAAC;QAAE,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjH,OAAO,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC"}

package/dist/lib/runtimeEnv.d.ts

@@ -16,8 +16,6 @@
  *   INTUTIC_WORKSPACE_ID=ws_...
  *   INTUTIC_VALKEY_URL=redis://127.0.0.1:6379   (only when a local Valkey is running)
  *
- * LLD #14 — Dual-path hook telemetry (WS-A1)
- *
  * @module
  */
 /** Default path to the runtime env file sourced by all generated hook scripts. */
@@ -39,7 +37,7 @@ export interface RuntimeEnvOptions {
     bypassEnforcementTier?: string;
     /**
      * The local Valkey the MCP governance proxies share their anomaly session
-     * window through (Wave 5.3, TD-437). Written as `INTUTIC_VALKEY_URL` only
+     * window through (Wave 5.3). Written as `INTUTIC_VALKEY_URL` only
      * when the caller has one running; omitted otherwise, so a proxy never
      * probes a Valkey nobody started.
      */

package/dist/lib/runtimeEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeEnv.d.ts","sourceRoot":"","sources":["../../src/lib/runtimeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,QAA4D,CAAA;AAEjG,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC5E"}
+{"version":3,"file":"runtimeEnv.d.ts","sourceRoot":"","sources":["../../src/lib/runtimeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,QAA4D,CAAA;AAEjG,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAA;IACvB,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC5E"}

package/dist/lib/runtimeEnv.js

@@ -16,8 +16,6 @@
  *   INTUTIC_WORKSPACE_ID=ws_...
  *   INTUTIC_VALKEY_URL=redis://127.0.0.1:6379   (only when a local Valkey is running)
  *
- * LLD #14 — Dual-path hook telemetry (WS-A1)
- *
  * @module
  */
 import * as fs from 'node:fs/promises';

package/dist/lib/runtimeEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtimeEnv.js","sourceRoot":"","sources":["../../src/lib/runtimeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AA0BjG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuB;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAA;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEpC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE3C,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC5D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG;QACd,mEAAmE;QACnE,4FAA4F;QAC5F,4GAA4G;QAC5G,sHAAsH;QACtH,gBAAgB,IAAI,EAAE;QACtB,mBAAmB,GAAG,EAAE;QACxB,wBAAwB,IAAI,EAAE;QAC9B,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAChG,0BAA0B,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE;QAC9D,uBAAuB,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE;QAChE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,EAAE;QACF,iFAAiF;QACjF,wCAAwC;QACxC,yCAAyC;QACzC,4CAA4C;QAC5C,sCAAsC;QACtC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IAChC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEjC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,4BAA4B,CAAC,CAAA;AAC3F,CAAC"}
+{"version":3,"file":"runtimeEnv.js","sourceRoot":"","sources":["../../src/lib/runtimeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AA0BjG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuB;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAA;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEpC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE3C,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC5D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG;QACd,mEAAmE;QACnE,4FAA4F;QAC5F,4GAA4G;QAC5G,sHAAsH;QACtH,gBAAgB,IAAI,EAAE;QACtB,mBAAmB,GAAG,EAAE;QACxB,wBAAwB,IAAI,EAAE;QAC9B,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAChG,0BAA0B,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE;QAC9D,uBAAuB,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE;QAChE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,EAAE;QACF,iFAAiF;QACjF,wCAAwC;QACxC,yCAAyC;QACzC,4CAA4C;QAC5C,sCAAsC;QACtC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IAChC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEjC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,4BAA4B,CAAC,CAAA;AAC3F,CAAC"}

package/dist/lib/sequencePy.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The sequence-rule matcher in Python, for the Open WebUI filter.
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/sequence.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s sequence.ts, and both run the
+ * shared vectors.
+ */
+export declare const SEQUENCE_PY_SOURCE: string;
+//# sourceMappingURL=sequencePy.d.ts.map

package/dist/lib/sequencePy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequencePy.d.ts","sourceRoot":"","sources":["../../src/lib/sequencePy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,QA4F9B,CAAA"}

package/dist/lib/sequencePy.js

@@ -0,0 +1,102 @@
+/**
+ * The sequence-rule matcher in Python, for the Open WebUI filter.
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/sequence.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s sequence.ts, and both run the
+ * shared vectors.
+ */
+export const SEQUENCE_PY_SOURCE = String.raw `"""Sequence rules: a gate rule "A.*B" run as "find A, then find B after it".
+
+A transliteration of packages/shared-types/src/sequence.ts; read that module's
+docstring for when this means the same as the regex. A rule whose .rules
+flags column contains "s" is cut into alternatives of steps at its top-level
+"|" and ".*", and each step is searched for once, from where the previous one
+ended: linear in the text, where re.search on the whole regex backtracks from
+every start of the first step to the end of the text.
+
+Every reader runs packages/shared-types/fixtures/gate-rule-vectors.json, and
+the Open WebUI filter emits this file verbatim
+(services/sync-daemon/src/lib/sequencePy.ts holds a byte-identical copy,
+which a test compares). It must stay self-contained: the standard library
+only, no module state, and no backtick or dollar-brace, which the TypeScript
+copy cannot hold.
+"""
+
+import re
+
+
+def sequence_alternatives(source):
+    """Split a sequence rule's source into alternatives of steps."""
+    alternatives = []
+    steps = []
+    current = []
+    depth = 0
+    in_class = False
+    i = 0
+    n = len(source)
+    while i < n:
+        c = source[i]
+        if c == "\\":
+            current.append(source[i:i + 2])
+            i += 2
+            continue
+        if in_class:
+            current.append(c)
+            i += 1
+            if c == "]":
+                in_class = False
+            continue
+        if c == "[":
+            in_class = True
+            current.append(c)
+            i += 1
+            if source[i:i + 1] == "^":
+                current.append("^")
+                i += 1
+            if source[i:i + 1] == "]":
+                current.append("]")
+                i += 1
+            continue
+        if c == "(":
+            depth += 1
+        elif c == ")":
+            depth -= 1
+        if depth == 0 and c == "|":
+            steps.append("".join(current))
+            alternatives.append([s for s in steps if s])
+            steps = []
+            current = []
+            i += 1
+            continue
+        if depth == 0 and c == "." and source[i + 1:i + 2] == "*":
+            steps.append("".join(current))
+            current = []
+            i += 2
+            continue
+        current.append(c)
+        i += 1
+    steps.append("".join(current))
+    alternatives.append([s for s in steps if s])
+    return alternatives
+
+
+def compile_sequence(source, flags=0):
+    """Compile a sequence rule's steps for sequence_match."""
+    return [[re.compile(s, flags) for s in steps] for steps in sequence_alternatives(source)]
+
+
+def sequence_match(alternatives, text):
+    """Whether some alternative's steps occur in text in order."""
+    for steps in alternatives:
+        pos = 0
+        for step in steps:
+            m = step.search(text, pos)
+            if m is None:
+                break
+            pos = m.end()
+        else:
+            return True
+    return False
+`;
+//# sourceMappingURL=sequencePy.js.map

package/dist/lib/sequencePy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequencePy.js","sourceRoot":"","sources":["../../src/lib/sequencePy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4F3C,CAAA"}

package/dist/sessionReporter.d.ts

@@ -6,10 +6,11 @@
  * capture and the Jira/Linear/GitHub task-context cascade) had no production
  * caller: sessions only ever existed as synthetic `ssp_` rows minted
  * server-side. The daemon knows everything the route wants — workspace root,
- * harness, git branch and commit — so it reports them once per harness per
- * daemon run when the harness is first detected.
+ * harness, git repository, branch and commit — so it reports them when the
+ * harness is first detected, and again whenever the repository, branch or
+ * HEAD commit changes.
  *
- * WHICH row it reports them onto (TD-231, Wave 5.6): when a local proxy is
+ * WHICH row it reports them onto (Wave 5.6): when a local proxy is
  * reachable, the caller passes that process's `proxyInstanceId` and the
  * control plane puts the context on the proxy's OWN row — the
  * `ssp_<ws>_<harness>_<instance>` session it derives for that process's
@@ -27,15 +28,19 @@
  *
  * Dedupe lives here (module state keyed workspace+harness+instance), so
  * callers (`reportHarnessAgents`, every `intutic connect` cycle) can call
- * `startHarnessSession` every iteration and only the first
- * one POSTs. Git context is captured once per key, not on a branch switch.
- * Everything is best-effort: a dead control plane costs a warning, never the
- * sync loop.
+ * `startHarnessSession` every iteration. Git is read on every call and the
+ * session is POSTed again only when it changed: the control plane copies the
+ * session's git context onto each trace as it records it, which is what makes
+ * cost per branch and per commit possible, so a stale commit would file a
+ * call under the wrong one. A re-POST updates the same row. Everything is
+ * best-effort: a dead control plane costs a warning, never the sync loop.
  *
  * @module
  */
-import type { HarnessType } from '@intutic/shared-types';
+import { type HarnessType } from '@intutic/shared-types';
 export interface GitInfo {
+    /** The `origin` remote, normalised: host/path, never credentials. */
+    repoUrl?: string;
     branchName?: string;
     commitHash?: string;
     commitMessage?: string;
@@ -43,9 +48,10 @@ export interface GitInfo {
 /** Best-effort git context from the workspace root. */
 export declare function readGitInfo(workspaceRoot: string): Promise<GitInfo>;
 /**
- * Report a harness session once per run — onto the local proxy's own row when
- * `proxyInstanceId` is given (see the module doc), else as a new `ses_` row.
- * Returns the sessionId when one is known (new or previously created).
+ * Report a harness session — onto the local proxy's own row when
+ * `proxyInstanceId` is given (see the module doc), else as a `ses_` row — and
+ * report it again when its git context changes. Returns the sessionId when one
+ * is known (new or previously created).
  */
 export declare function startHarnessSession(opts: {
     controlPlaneUrl: string;

package/dist/sessionReporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionReporter.d.ts","sourceRoot":"","sources":["../src/sessionReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAiBxD,MAAM,WAAW,OAAO;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,wBAAsB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBzE;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuCzB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB/F"}
+{"version":3,"file":"sessionReporter.d.ts","sourceRoot":"","sources":["../src/sessionReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAqB5E,MAAM,WAAW,OAAO;IACtB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,wBAAsB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBzE;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCzB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB/F"}

package/dist/sessionReporter.js

@@ -6,10 +6,11 @@
  * capture and the Jira/Linear/GitHub task-context cascade) had no production
  * caller: sessions only ever existed as synthetic `ssp_` rows minted
  * server-side. The daemon knows everything the route wants — workspace root,
- * harness, git branch and commit — so it reports them once per harness per
- * daemon run when the harness is first detected.
+ * harness, git repository, branch and commit — so it reports them when the
+ * harness is first detected, and again whenever the repository, branch or
+ * HEAD commit changes.
  *
- * WHICH row it reports them onto (TD-231, Wave 5.6): when a local proxy is
+ * WHICH row it reports them onto (Wave 5.6): when a local proxy is
  * reachable, the caller passes that process's `proxyInstanceId` and the
  * control plane puts the context on the proxy's OWN row — the
  * `ssp_<ws>_<harness>_<instance>` session it derives for that process's
@@ -27,16 +28,19 @@
  *
  * Dedupe lives here (module state keyed workspace+harness+instance), so
  * callers (`reportHarnessAgents`, every `intutic connect` cycle) can call
- * `startHarnessSession` every iteration and only the first
- * one POSTs. Git context is captured once per key, not on a branch switch.
- * Everything is best-effort: a dead control plane costs a warning, never the
- * sync loop.
+ * `startHarnessSession` every iteration. Git is read on every call and the
+ * session is POSTed again only when it changed: the control plane copies the
+ * session's git context onto each trace as it records it, which is what makes
+ * cost per branch and per commit possible, so a stale commit would file a
+ * call under the wrong one. A re-POST updates the same row. Everything is
+ * best-effort: a dead control plane costs a warning, never the sync loop.
  *
  * @module
  */
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { newIso } from '@intutic/id';
+import { normalizeGitRemote } from '@intutic/shared-types';
 const execFileP = promisify(execFile);
 /**
  * sessionIds this daemon run opened AND owns the lifecycle of — the `ses_`
@@ -48,8 +52,12 @@ const openSessions = new Map();
  * `${workspaceId}:${harness}:${proxyInstanceId}`. Dedupe only — never ended.
  */
 const registeredProxyRows = new Map();
-/** Keys with a POST in flight or already attempted (success or not) — one try per run. */
-const attempted = new Set();
+/**
+ * The git context last POSTed (or attempted, success or not) per key. One try
+ * per key and git state per run: a failing control plane is not retried every
+ * cycle, but a branch switch or a new commit is reported.
+ */
+const attempted = new Map();
 /** Best-effort git context from the workspace root. */
 export async function readGitInfo(workspaceRoot) {
     const git = async (...args) => {
@@ -62,28 +70,31 @@ export async function readGitInfo(workspaceRoot) {
             return undefined;
         }
     };
-    const [branchName, commitHash, commitMessage] = await Promise.all([
+    const [remote, branchName, commitHash, commitMessage] = await Promise.all([
+        git('remote', 'get-url', 'origin'),
         git('rev-parse', '--abbrev-ref', 'HEAD'),
         git('rev-parse', 'HEAD'),
         git('log', '-1', '--format=%s'),
     ]);
-    return { branchName, commitHash, commitMessage };
+    // Normalised here, before it is held anywhere: a remote can embed a token.
+    const repoUrl = remote ? (normalizeGitRemote(remote) ?? undefined) : undefined;
+    return { repoUrl, branchName, commitHash, commitMessage };
 }
 /**
- * Report a harness session once per run — onto the local proxy's own row when
- * `proxyInstanceId` is given (see the module doc), else as a new `ses_` row.
- * Returns the sessionId when one is known (new or previously created).
+ * Report a harness session — onto the local proxy's own row when
+ * `proxyInstanceId` is given (see the module doc), else as a `ses_` row — and
+ * report it again when its git context changes. Returns the sessionId when one
+ * is known (new or previously created).
  */
 export async function startHarnessSession(opts) {
     const key = `${opts.workspaceId}:${opts.harnessType}:${opts.proxyInstanceId ?? ''}`;
     const existing = opts.proxyInstanceId ? registeredProxyRows.get(key) : openSessions.get(key);
-    if (existing)
-        return existing;
-    if (attempted.has(key))
-        return null;
-    attempted.add(key);
+    const git = await readGitInfo(opts.workspaceRoot);
+    const gitState = JSON.stringify([git.repoUrl, git.branchName, git.commitHash]);
+    if (attempted.get(key) === gitState)
+        return existing ?? null;
+    attempted.set(key, gitState);
     try {
-        const git = await readGitInfo(opts.workspaceRoot);
         const res = await fetch(`${opts.controlPlaneUrl}/api/v1/sessions`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${opts.apiKey}` },
@@ -92,6 +103,8 @@ export async function startHarnessSession(opts) {
                 harnessType: opts.harnessType,
                 ...(opts.agentRole ? { agentRole: opts.agentRole } : {}),
                 ...(opts.proxyInstanceId ? { proxyInstanceId: opts.proxyInstanceId } : {}),
+                // A `ses_` row this run already opened is updated, not opened again.
+                ...(existing && !opts.proxyInstanceId ? { sessionId: existing } : {}),
                 ...git,
                 reportedAt: newIso(),
             }),
@@ -99,7 +112,7 @@ export async function startHarnessSession(opts) {
         });
         if (!res.ok) {
             console.warn(`[sync-daemon] startHarnessSession failed for ${opts.harnessType}: ${res.status}`);
-            return null;
+            return existing ?? null;
         }
         const body = (await res.json());
         if (body.sessionId) {
@@ -107,11 +120,11 @@ export async function startHarnessSession(opts) {
             (opts.proxyInstanceId ? registeredProxyRows : openSessions).set(key, body.sessionId);
             return body.sessionId;
         }
-        return null;
+        return existing ?? null;
     }
     catch (err) {
         console.warn(`[sync-daemon] startHarnessSession error for ${opts.harnessType}:`, err instanceof Error ? err.message : err);
-        return null;
+        return existing ?? null;
     }
 }
 /**