@intutic/sync-daemon 2.2.0 → 2.4.0

package/dist/inventory.js

@@ -0,0 +1,133 @@
+/**
+ * inventory.ts — this machine's AI inventory, for the org-wide view.
+ *
+ * Which AI coding harnesses the machine has, whether Intutic's gate is
+ * installed and live for each, the MCP servers their configs declare (wrapped
+ * by the MCP governance proxy or not), the skill bundles on disk, and the
+ * local proxy's guard-probe result. `intutic connect` runs it every few
+ * minutes and sends it as the `inventory` facet of
+ * `POST /api/v1/agents/report`, the path the agent facets already use, with
+ * the device fingerprint `intutic enforce` reports under.
+ *
+ * Harness detection is the CLI's (its adapters hold the detection rules), so
+ * the caller passes in what it detected; everything else is read here.
+ *
+ * What leaves the machine is names, home-relative paths, hashes and
+ * timestamps only (see `@intutic/shared-types`'s `devInventory.ts`): never a
+ * file's contents, an environment value, an MCP server's command line, or a
+ * URL's credentials and query string.
+ *
+ * @module
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { DEVICE_INVENTORY_SCHEMA_VERSION, gateIdentitiesOf, gateKindForHarness, homeRelativePath, } from '@intutic/shared-types';
+import { newIso } from '@intutic/id';
+import { collectSkillsIn, fetchGuardProbes } from './agentReporter.js';
+import { discoverMcpServers } from './harness/mcpAutoWrite.js';
+import { findGateFile, findIdentityGateFile } from './harness/gateArtifacts.js';
+import { mergeSightings, readGateSightings, sideLogSightings } from './harness/gateSightings.js';
+import { antigravityGateIdentities } from './harness/antigravityProducts.js';
+/**
+ * Collects this machine's inventory. Never throws for a missing or unreadable
+ * file: an absent config is an absent item, not an error.
+ *
+ * @param opts.detected   - Harnesses the CLI's detection rules found.
+ * @param opts.configured - This machine's `intutic connect` harnesses; listed even when detection misses them.
+ * @param opts.home       - The home directory; defaults to the current user's.
+ */
+export async function collectDeviceInventory(opts) {
+    const home = opts.home ?? homedir();
+    const versions = new Map(opts.detected.map((d) => [d.type, d.version]));
+    const configured = new Set(opts.configured);
+    const disconnected = new Set(opts.disconnected ?? []);
+    const types = [...new Set([...opts.configured, ...opts.detected.map((d) => d.type)])].sort();
+    const [sightings, sideSightings, mcp, skillSets, probes] = await Promise.all([
+        readGateSightings(opts.workspaceRoot),
+        sideLogSightings(home),
+        discoverMcpServers(opts.workspaceRoot),
+        Promise.all([
+            collectSkillsIn(join(opts.workspaceRoot, '.agents', 'skills'), '.agents/skills'),
+            collectSkillsIn(join(opts.workspaceRoot, '.claude', 'skills'), '.claude/skills'),
+            collectSkillsIn(join(home, '.claude', 'skills'), '~/.claude/skills'),
+        ]),
+        fetchGuardProbes(),
+    ]);
+    const harnesses = [];
+    for (const type of types) {
+        const gateKind = gateKindForHarness(type);
+        // The antigravity harness is listed once per product found, each under
+        // its own gate id with its own gate file and events (gateIdentity.ts in
+        // @intutic/shared-types); with neither found, once under its own id.
+        const gateIds = type === 'antigravity' ? await antigravityGateIdentities(opts.workspaceRoot, { home, path: opts.path }) : [];
+        const split = gateIds.length > 0;
+        for (const id of split ? gateIds : [type]) {
+            const gateFile = gateKind !== 'hook' ? null : split ? await findIdentityGateFile(id, opts.workspaceRoot, home) : await findGateFile(type, opts.workspaceRoot, home);
+            // Listed under the harness id, it carries the events of every gate the harness has.
+            const sighting = (split ? [id] : gateIdentitiesOf(type))
+                .map((g) => mergeSightings(sightings[g], sideSightings[g]))
+                .reduce((acc, g) => mergeSightings(acc, g), undefined);
+            const version = versions.get(type);
+            harnesses.push({
+                type: id,
+                ...(version ? { version } : {}),
+                configured: configured.has(type),
+                ...(disconnected.has(type) ? { disconnected: true } : {}),
+                gateKind,
+                gateInstalled: gateKind === 'hook' ? gateFile !== null : null,
+                ...(gateFile ? { gateFile: homeRelativePath(gateFile, home) } : {}),
+                lastHookEventAt: sighting?.lastEventAt ?? null,
+                guardsDisabledAt: sighting?.guardsDisabledAt ?? null,
+            });
+        }
+    }
+    const skills = skillSets.flat().map((s) => ({
+        name: s.name,
+        source: s.source,
+        ...(s.sha256 ? { sha256: s.sha256 } : {}),
+        scanned: s.scanned,
+        clean: s.clean,
+        findingsCount: s.findingsCount,
+        scriptCount: s.scripts?.total ?? 0,
+    }));
+    return {
+        schemaVersion: DEVICE_INVENTORY_SCHEMA_VERSION,
+        collectedAt: newIso(),
+        workspace: homeRelativePath(opts.workspaceRoot, home),
+        harnesses,
+        mcpServers: mcp.map((s) => ({
+            server: s.server,
+            harness: s.harness,
+            transport: s.transport,
+            wrapped: s.wrapped,
+            ...(s.endpoint ? { endpoint: s.endpoint } : {}),
+            ...(s.ungovernedReason ? { ungovernedReason: s.ungovernedReason } : {}),
+        })),
+        skills,
+        ...(probes ? { guardProbes: { total: probes.total, failed: probes.failed, ranAt: probes.ranAt } } : {}),
+    };
+}
+/**
+ * Sends the inventory to `POST /api/v1/agents/report` as an inventory-only
+ * report: the device and an `inventory` facet, no agent. Returns whether the
+ * control plane accepted it. Never throws: a failed report is retried on the
+ * next inventory cycle.
+ */
+export async function reportDeviceInventory(controlPlaneUrl, apiKey, device, inventory) {
+    try {
+        const res = await fetch(`${controlPlaneUrl}/api/v1/agents/report`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+            body: JSON.stringify({ device, facets: { inventory }, reportedAt: newIso() }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok)
+            console.warn(`[sync-daemon] inventory report failed: ${res.status}`);
+        return res.ok;
+    }
+    catch (err) {
+        console.warn('[sync-daemon] inventory report error:', err instanceof Error ? err.message : err);
+        return false;
+    }
+}
+//# sourceMappingURL=inventory.js.map

package/dist/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GAMjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAQ5E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAS5C;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAA;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5F,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3E,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC;QACrC,gBAAgB,CAAC,IAAI,CAAC;QACtB,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC;YACV,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;YAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;YAChF,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;SACrE,CAAC;QACF,gBAAgB,EAAE;KACnB,CAAC,CAAA;IAEF,MAAM,SAAS,GAAuB,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAmB,CAAC,CAAA;QACxD,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;QAChC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GACZ,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;YACpJ,oFAAoF;YACpF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;iBACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC1D,MAAM,CAAoC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAClC,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,QAAQ;gBACR,aAAa,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;gBAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,eAAe,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI;gBAC9C,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI;aACrD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC;KACnC,CAAC,CAAC,CAAA;IAEH,OAAO;QACL,aAAa,EAAE,+BAA+B;QAC9C,WAAW,EAAE,MAAM,EAAE;QACrB,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC;QACrD,SAAS;QACT,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxG,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,eAAuB,EACvB,MAAc,EACd,MAA+B,EAC/B,SAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,uBAAuB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;YAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,GAAG,CAAC,EAAE,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC/F,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/lib/complianceProbes.d.ts

@@ -11,7 +11,6 @@
  * If the connection fails (connection refused/timed out) or succeeds with an
  * Intutic-signed certificate, containment is active and verified.
  *
- * LLD #14 — Phase 6 active compliance probes (6C-1)
  * @module
  */
 export interface ProbeResult {
@@ -25,6 +24,8 @@ export interface ProbeResult {
         workspaceId: string;
         timestamp: string;
         incidentId: string;
+        /** This detection's id, made once: a resend of it is processed once. */
+        eventId: string;
     };
 }
 /**

package/dist/lib/complianceProbes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complianceProbes.d.ts","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAqF5G;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAiBjG"}
+{"version":3,"file":"complianceProbes.d.ts","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,wEAAwE;QACxE,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsF5G;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAiBjG"}

package/dist/lib/complianceProbes.js

@@ -11,7 +11,6 @@
  * If the connection fails (connection refused/timed out) or succeeds with an
  * Intutic-signed certificate, containment is active and verified.
  *
- * LLD #14 — Phase 6 active compliance probes (6C-1)
  * @module
  */
 import * as https from 'node:https';
@@ -65,6 +64,7 @@ export function checkHostContainment(hostname, workspaceId, port = 443) {
                         workspaceId,
                         timestamp: ts,
                         incidentId,
+                        eventId: crypto.randomBytes(16).toString('hex'),
                     },
                 });
             }

package/dist/lib/complianceProbes.js.map

@@ -1 +1 @@
-{"version":3,"file":"complianceProbes.js","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAEnC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAgB7C;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAAmB,EAAE,IAAI,GAAG,GAAG;IACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,MAAM,WAAW,GAAyB;YACxC,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,IAAI;SACd,CAAA;QACD,8FAA8F;QAC9F,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACtD;QAAC,WAAuC,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;QAE9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7C,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YAEf,MAAM,MAAM,GAAG,GAAG,CAAC,MAAuB,CAAA;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAA;YAExC,mEAAmE;YACnE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAEvH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAEjF,GAAG,CAAC,OAAO,EAAE,CAAA;YAEb,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,sDAAsD;gBACtD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBACnC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBAE3G,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE;wBACR,KAAK,EAAE,gBAAgB;wBACvB,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,wBAAwB,QAAQ,mCAAmC;wBAC3E,WAAW;wBACX,SAAS,EAAE,EAAE;wBACb,UAAU;qBACX;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC7C,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,2GAA2G;YAC3G,gDAAgD;YAChD,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,+DAA+D;gBAC/D,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,iCAAiC;gBACjC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;aAC/B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAI,GAAG,GAAG;IACvE,MAAM,KAAK,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;IACrD,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAE1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EACtC,2DAA2D,CAC5D,CAAA;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"complianceProbes.js","sourceRoot":"","sources":["../../src/lib/complianceProbes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAEnC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAkB7C;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAAmB,EAAE,IAAI,GAAG,GAAG;IACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,MAAM,WAAW,GAAyB;YACxC,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,IAAI;SACd,CAAA;QACD,8FAA8F;QAC9F,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACtD;QAAC,WAAuC,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;QAE9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7C,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YAEf,MAAM,MAAM,GAAG,GAAG,CAAC,MAAuB,CAAA;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAA;YAExC,mEAAmE;YACnE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAClH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAEvH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAEjF,GAAG,CAAC,OAAO,EAAE,CAAA;YAEb,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,sDAAsD;gBACtD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBACnC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBAE3G,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE;wBACR,KAAK,EAAE,gBAAgB;wBACvB,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,wBAAwB,QAAQ,mCAAmC;wBAC3E,WAAW;wBACX,SAAS,EAAE,EAAE;wBACb,UAAU;wBACV,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;qBAChD;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC7C,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,2GAA2G;YAC3G,gDAAgD;YAChD,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,+DAA+D;gBAC/D,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,iCAAiC;gBACjC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;aAC/B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAI,GAAG,GAAG;IACvE,MAAM,KAAK,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;IACrD,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAE1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EACtC,2DAA2D,CAC5D,CAAA;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/decisionsDigest.d.ts

@@ -29,13 +29,22 @@
  *     pattern (i): a DO-NOT-EDIT header + `atomicWrite`. Gitignored — runtime
  *     artifacts stay untracked, the same rule this repo's own CLAUDE.md doc
  *     comment states for daemon-generated governance files.
- *  2. A bounded, marker-delimited section (last ~10 entries) idempotently
- *     injected into the `claude-code` harness's own regenerated config file
- *     (`HARNESS_FILES['claude-code']`, i.e. `CLAUDE.md`) — this is what makes
- *     the digest something the agent actually reads without needing to know
- *     `.intutic/DECISIONS.md` exists. A marker pair
- *     (`INTUTIC:DECISIONS_LOG:START`/`END`) is replaced in place on every
- *     cycle, never re-appended.
+ *  2. The newest ~10 entries, delivered to every active harness that reads
+ *     an instructions file, where `HARNESS_RULES_FILES` says it reads them
+ *     (`decisionsTargetOf`) — this is what makes the digest something the
+ *     agent actually reads without needing to know `.intutic/DECISIONS.md`
+ *     exists. In a file the user also writes (`AGENTS.md`, `GEMINI.md`,
+ *     ...) it is a marked section of its own (`INTUTIC:DECISIONS_LOG`),
+ *     apart from the rules section; next to a rules file of Intutic's own it
+ *     is a second file (`.claude/rules/intutic-decisions.md`, ...). Claude
+ *     Code gets it from `.claude/rules/`, which it loads with or without a
+ *     `CLAUDE.md`; `CLAUDE.md` itself is never written. When Claude Code
+ *     also reads the workspace's `AGENTS.md` and that file carries the
+ *     section for another harness, Claude Code's own file is left out, so it
+ *     does not read the log twice (see `claudeAgentsMd.ts`).
+ *
+ * Earlier versions put the section in `CLAUDE.md`; {@link
+ * retireClaudeMdDigest} takes it out again on every sync.
  *
  * Deliberately does NOT reuse `configWriter.ts`'s own `fileHeader()` for the
  * DECISIONS.md header — that helper stamps `newIso()` (wall-clock "Last
@@ -49,6 +58,8 @@
 import { HarnessType } from '@intutic/shared-types';
 /** Relative to the workspace root. */
 export declare const DECISIONS_LOG_RELATIVE_PATH: string;
+/** First line of the decisions log's own files, which `intutic disconnect` recognises. */
+export declare const DECISIONS_FILE_HEADER = "# Intutic Governed Decisions Log (auto-generated)";
 /** One digest entry, exactly as `GET /api/v1/workspace/decisions-digest` returns it — the summary line is already rendered server-side. */
 export interface DecisionsDigestEntry {
     id: string;
@@ -65,7 +76,7 @@ export interface DecisionsDigestOptions {
     apiKey: string;
     workspaceId: string;
     workspaceRoot: string;
-    /** Active harnesses this cycle — the bounded section is only injected when `claude-code` is among them. */
+    /** Active harnesses this cycle: each that reads an instructions file gets the newest entries there. */
     harnesses: HarnessType[];
 }
 /**
@@ -76,16 +87,23 @@ export interface DecisionsDigestOptions {
 export declare function fetchDecisionsDigest(opts: Pick<DecisionsDigestOptions, 'controlPlaneUrl' | 'apiKey' | 'workspaceId'>): Promise<DecisionsDigestResponse | null>;
 /** Renders the full bounded record written to `.intutic/DECISIONS.md`. */
 export declare function renderDecisionsMarkdown(entries: DecisionsDigestEntry[]): string;
-/** Renders the bounded, marker-delimited section injected into the harness config file — the newest `limit` entries only. */
-export declare function renderBoundedSection(entries: DecisionsDigestEntry[], limit?: number): string;
+/** The newest `limit` entries, as the body of the section or file each harness reads. */
+export declare function renderDecisionsSectionBody(entries: DecisionsDigestEntry[], limit?: number): string;
+/**
+ * Writes `body` wherever each of `harnesses` reads its instructions, once per
+ * file. Claude Code's own file is left out (and removed) when Claude Code
+ * reads the workspace's `AGENTS.md` and that file gets the section for
+ * another harness.
+ */
+export declare function writeDecisionsTargets(workspaceRoot: string, harnesses: readonly HarnessType[], body: string): Promise<void>;
 /**
- * Idempotently inject/replace the bounded section in `content`. If the
- * markers are present, everything between them (inclusive) is replaced — the
- * mechanism the `applyConfigEdits` SkillOpt writer already uses elsewhere in
- * this file's sibling module, `configWriter.ts` — never duplicated. If
- * absent, the section is appended once, with a separating blank line.
+ * Takes out the decisions-log section earlier versions wrote into the
+ * workspace's `CLAUDE.md`, leaving the user's text as it was. A `CLAUDE.md`
+ * Intutic created that holds nothing else goes, with its record; one an
+ * earlier version wrote whole is given back (`retireRulesFile`). Runs on
+ * every sync, whether or not the decisions log is on.
  */
-export declare function injectBoundedSection(content: string, section: string): string;
+export declare function retireClaudeMdDigest(workspaceRoot: string): Promise<void>;
 /**
  * Fetch and write both files in one call, mirroring `refreshEgressPolicy`.
  * Never throws — a failed poll must not take down the sync loop.

package/dist/lib/decisionsDigest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsDigest.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAKnD,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,QAAwC,CAAA;AAKhF,2IAA2I;AAC3I,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,2GAA2G;IAC3G,SAAS,EAAE,WAAW,EAAE,CAAA;CACzB;AAyBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GAC/E,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA0BzC;AAkBD,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAO/E;AAED,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmC5C"}
+{"version":3,"file":"decisionsDigest.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAKH,OAAO,EAAE,WAAW,EAAkC,MAAM,uBAAuB,CAAA;AAUnF,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,QAAwC,CAAA;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,sDAAsD,CAAA;AAExF,2IAA2I;AAC3I,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,uGAAuG;IACvG,SAAS,EAAE,WAAW,EAAE,CAAA;CACzB;AAyBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GAC/E,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA0BzC;AAkBD,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAO/E;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAO9F;AAgBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjI;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAe5C"}

package/dist/lib/decisionsDigest.js

@@ -29,13 +29,22 @@
  *     pattern (i): a DO-NOT-EDIT header + `atomicWrite`. Gitignored — runtime
  *     artifacts stay untracked, the same rule this repo's own CLAUDE.md doc
  *     comment states for daemon-generated governance files.
- *  2. A bounded, marker-delimited section (last ~10 entries) idempotently
- *     injected into the `claude-code` harness's own regenerated config file
- *     (`HARNESS_FILES['claude-code']`, i.e. `CLAUDE.md`) — this is what makes
- *     the digest something the agent actually reads without needing to know
- *     `.intutic/DECISIONS.md` exists. A marker pair
- *     (`INTUTIC:DECISIONS_LOG:START`/`END`) is replaced in place on every
- *     cycle, never re-appended.
+ *  2. The newest ~10 entries, delivered to every active harness that reads
+ *     an instructions file, where `HARNESS_RULES_FILES` says it reads them
+ *     (`decisionsTargetOf`) — this is what makes the digest something the
+ *     agent actually reads without needing to know `.intutic/DECISIONS.md`
+ *     exists. In a file the user also writes (`AGENTS.md`, `GEMINI.md`,
+ *     ...) it is a marked section of its own (`INTUTIC:DECISIONS_LOG`),
+ *     apart from the rules section; next to a rules file of Intutic's own it
+ *     is a second file (`.claude/rules/intutic-decisions.md`, ...). Claude
+ *     Code gets it from `.claude/rules/`, which it loads with or without a
+ *     `CLAUDE.md`; `CLAUDE.md` itself is never written. When Claude Code
+ *     also reads the workspace's `AGENTS.md` and that file carries the
+ *     section for another harness, Claude Code's own file is left out, so it
+ *     does not read the log twice (see `claudeAgentsMd.ts`).
+ *
+ * Earlier versions put the section in `CLAUDE.md`; {@link
+ * retireClaudeMdDigest} takes it out again on every sync.
  *
  * Deliberately does NOT reuse `configWriter.ts`'s own `fileHeader()` for the
  * DECISIONS.md header — that helper stamps `newIso()` (wall-clock "Last
@@ -49,13 +58,18 @@
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { createLogger } from '@intutic/logger';
-import { HarnessType } from '@intutic/shared-types';
-import { HARNESS_FILES, atomicWrite } from '../configWriter.js';
+import { HarnessType, decisionsTargetOf, rulesFileOf } from '@intutic/shared-types';
+import { atomicWrite } from '../configWriter.js';
+import { DECISIONS_MARKERS, removeRulesSection, retireRulesFile, writeRulesSection } from '../harness/rulesSection.js';
+import { claudeCodeReadsAgentsMd } from '../harness/claudeAgentsMd.js';
+import { openclawAgentWorkspace } from '../harness/openclawHooks.js';
+import { ensureAiderReadEntry } from '../harness/aiderConfigMerger.js';
+import { forgetOriginal, readOriginal, writeOwnedFile } from '../disconnect/originals.js';
 const log = createLogger('sync-decisions-digest');
 /** Relative to the workspace root. */
 export const DECISIONS_LOG_RELATIVE_PATH = path.join('.intutic', 'DECISIONS.md');
-const SECTION_START = '<!-- INTUTIC:DECISIONS_LOG:START -->';
-const SECTION_END = '<!-- INTUTIC:DECISIONS_LOG:END -->';
+/** First line of the decisions log's own files, which `intutic disconnect` recognises. */
+export const DECISIONS_FILE_HEADER = '# Intutic Governed Decisions Log (auto-generated)';
 /**
  * Trims trailing `/` without a regex — see the identical helper in
  * `egressPolicy.ts`/`approvedBypasses.ts`: `/\/+$/` is flagged by CodeQL as a
@@ -131,29 +145,93 @@ export function renderDecisionsMarkdown(entries) {
     const lines = entries.map((e) => `- ${e.timestamp} — ${e.summary}`);
     return header + lines.join('\n') + '\n';
 }
-/** Renders the bounded, marker-delimited section injected into the harness config file — the newest `limit` entries only. */
-export function renderBoundedSection(entries, limit = 10) {
+/** The newest `limit` entries, as the body of the section or file each harness reads. */
+export function renderDecisionsSectionBody(entries, limit = 10) {
     const bounded = entries.slice(0, limit);
     const lines = bounded.length > 0
         ? bounded.map((e) => `- ${e.timestamp} — ${e.summary}`)
         : ['_No governance decisions recorded yet._'];
-    return [SECTION_START, '## Recent Governed Decisions', '', ...lines, SECTION_END].join('\n');
+    return ['## Recent Governed Decisions', '', ...lines].join('\n');
+}
+/** A harness's decisions file: the product's front matter, the header, the entries. */
+function renderDecisionsFile(body, frontMatter) {
+    const head = frontMatter ? `---\n${frontMatter}\n---\n\n` : '';
+    return `${head}${DECISIONS_FILE_HEADER}\n# DO NOT EDIT — managed by intutic sync daemon\n\n${body}\n`;
+}
+async function readText(file) {
+    try {
+        return await fs.readFile(file, 'utf-8');
+    }
+    catch {
+        return null;
+    }
 }
 /**
- * Idempotently inject/replace the bounded section in `content`. If the
- * markers are present, everything between them (inclusive) is replaced — the
- * mechanism the `applyConfigEdits` SkillOpt writer already uses elsewhere in
- * this file's sibling module, `configWriter.ts` — never duplicated. If
- * absent, the section is appended once, with a separating blank line.
+ * Writes `body` wherever each of `harnesses` reads its instructions, once per
+ * file. Claude Code's own file is left out (and removed) when Claude Code
+ * reads the workspace's `AGENTS.md` and that file gets the section for
+ * another harness.
  */
-export function injectBoundedSection(content, section) {
-    const startIdx = content.indexOf(SECTION_START);
-    const endIdx = content.indexOf(SECTION_END);
-    if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-        return content.slice(0, startIdx) + section + content.slice(endIdx + SECTION_END.length);
+export async function writeDecisionsTargets(workspaceRoot, harnesses, body) {
+    const claudeFromAgentsMd = harnesses.includes(HarnessType.CLAUDE_CODE) &&
+        harnesses.some((h) => rulesFileOf(h) === 'AGENTS.md') &&
+        (await claudeCodeReadsAgentsMd(workspaceRoot));
+    const written = new Set();
+    for (const harness of harnesses) {
+        const target = decisionsTargetOf(harness);
+        if (!target)
+            continue;
+        const file = target.kind === 'section' && target.scope === 'user'
+            ? path.join(await openclawAgentWorkspace(), 'AGENTS.md')
+            : path.join(workspaceRoot, target.path);
+        if (harness === HarnessType.CLAUDE_CODE && claudeFromAgentsMd) {
+            await retireRulesFile(file, workspaceRoot);
+            continue;
+        }
+        if (written.has(file))
+            continue;
+        written.add(file);
+        if (target.kind === 'section') {
+            await writeRulesSection(file, workspaceRoot, body, DECISIONS_MARKERS);
+            continue;
+        }
+        const content = renderDecisionsFile(body, target.frontMatter?.('Intutic governed decisions log') ?? '');
+        if ((await readText(file)) !== content)
+            await writeOwnedFile(file, workspaceRoot, content);
+        // Aider loads no file it is not told about.
+        if (harness === HarnessType.AIDER)
+            await ensureAiderReadEntry(path.join(workspaceRoot, '.aider.conf.yml'), file);
     }
-    const sep = content.endsWith('\n\n') ? '' : content.endsWith('\n') ? '\n' : '\n\n';
-    return `${content}${sep}${section}\n`;
+}
+/**
+ * Takes out the decisions-log section earlier versions wrote into the
+ * workspace's `CLAUDE.md`, leaving the user's text as it was. A `CLAUDE.md`
+ * Intutic created that holds nothing else goes, with its record; one an
+ * earlier version wrote whole is given back (`retireRulesFile`). Runs on
+ * every sync, whether or not the decisions log is on.
+ */
+export async function retireClaudeMdDigest(workspaceRoot) {
+    const file = path.join(workspaceRoot, 'CLAUDE.md');
+    const text = await readText(file);
+    if (text === null)
+        return;
+    const next = removeRulesSection(text, DECISIONS_MARKERS);
+    if (next !== null) {
+        const record = await readOriginal(file, workspaceRoot);
+        if (next.trim() === '' && record && !record.existed) {
+            await fs.rm(file, { force: true });
+            await forgetOriginal(file, workspaceRoot);
+            log.info({ action: 'decisions_claude_md_removed', path: file }, 'Removed the CLAUDE.md an earlier version created for the decisions log');
+            return;
+        }
+        const mode = (await fs.stat(file)).mode & 0o7777;
+        const tmp = `${file}.intutic-tmp`;
+        await fs.writeFile(tmp, next, 'utf-8');
+        await fs.chmod(tmp, mode);
+        await fs.rename(tmp, file);
+        log.info({ action: 'decisions_claude_md_section_removed', path: file }, 'Took the decisions-log section out of CLAUDE.md');
+    }
+    await retireRulesFile(file, workspaceRoot);
 }
 /**
  * Fetch and write both files in one call, mirroring `refreshEgressPolicy`.
@@ -169,26 +247,7 @@ export async function refreshDecisionsDigest(opts) {
     try {
         const fullPath = path.join(opts.workspaceRoot, DECISIONS_LOG_RELATIVE_PATH);
         await atomicWrite(fullPath, renderDecisionsMarkdown(digest.entries));
-        if (opts.harnesses.includes(HarnessType.CLAUDE_CODE)) {
-            const claudeMdPath = path.join(opts.workspaceRoot, HARNESS_FILES[HarnessType.CLAUDE_CODE]);
-            let existing = null;
-            try {
-                existing = await fs.readFile(claudeMdPath, 'utf-8');
-            }
-            catch {
-                existing = null;
-            }
-            if (existing !== null) {
-                const section = renderBoundedSection(digest.entries, 10);
-                const updated = injectBoundedSection(existing, section);
-                if (updated !== existing) {
-                    await atomicWrite(claudeMdPath, updated);
-                }
-            }
-            else {
-                log.debug({ action: 'decisions_digest_skip_inject' }, 'claude-code config file not written yet this run — skipping bounded-section injection this cycle');
-            }
-        }
+        await writeDecisionsTargets(opts.workspaceRoot, opts.harnesses, renderDecisionsSectionBody(digest.entries, 10));
         return { entriesWritten: digest.entries.length };
     }
     catch (err) {

package/dist/lib/decisionsDigest.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisionsDigest.js","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE/D,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,sCAAsC;AACtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEhF,MAAM,aAAa,GAAG,sCAAsC,CAAA;AAC5D,MAAM,WAAW,GAAG,oCAAoC,CAAA;AAwBxD;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAgF;IAEhF,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC;QAChF,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/D,kCAAkC,CACnC,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAA+B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,OAAO,CAAA;IAC/C,OAAO;QACL,mDAAmD;QACnD,gDAAgD;QAChD,wBAAwB,MAAM,EAAE;QAChC,GAAG;QACH,sEAAsE;QACtE,yEAAyE;QACzE,yCAAyC;QACzC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,2CAA2C,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACnE,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AACzC,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,oBAAoB,CAAC,OAA+B,EAAE,KAAK,GAAG,EAAE;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAA;IACjD,OAAO,CAAC,aAAa,EAAE,8BAA8B,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IAClF,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,OAAO,IAAI,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAA;QAC3E,MAAM,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAEpE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAA;YAC1F,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACzB,MAAM,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,8BAA8B,EAAE,EAC1C,kGAAkG,CACnG,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACjG,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"decisionsDigest.js","sourceRoot":"","sources":["../../src/lib/decisionsDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEzF,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD,sCAAsC;AACtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAwBxF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAgF;IAEhF,MAAM,GAAG,GACP,GAAG,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC;QAChF,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/D,kCAAkC,CACnC,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAA+B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,OAAO,CAAA;IAC/C,OAAO;QACL,mDAAmD;QACnD,gDAAgD;QAChD,wBAAwB,MAAM,EAAE;QAChC,GAAG;QACH,sEAAsE;QACtE,yEAAyE;QACzE,yCAAyC;QACzC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,2CAA2C,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACnE,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AACzC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,OAA+B,EAAE,KAAK,GAAG,EAAE;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAA;IACjD,OAAO,CAAC,8BAA8B,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,OAAO,GAAG,IAAI,GAAG,qBAAqB,uDAAuD,IAAI,IAAI,CAAA;AACvG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,SAAiC,EAAE,IAAY;IAChH,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;QACrD,CAAC,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,EAAE,WAAW,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,OAAO,KAAK,WAAW,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9D,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;YACrE,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QACvG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QAC1F,4CAA4C;QAC5C,IAAI,OAAO,KAAK,WAAW,CAAC,KAAK;YAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAA;IAClH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAM;IACzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAClC,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,wEAAwE,CAAC,CAAA;YACzI,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,cAAc,CAAA;QACjC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,iDAAiD,CAAC,CAAA;IAC5H,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAA;QAC3E,MAAM,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAEpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;QAE/G,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACjG,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/egressPolicy.d.ts

@@ -1,8 +1,8 @@
 /**
  * egressPolicy.ts — ships the workspace's central egress policy *to* the
  * machine, so an admin sets `enforce`/`monitor` + an allow list once in the
- * control plane rather than in every developer's local proxy config
- * (LLD #63 §4). Mirrors `policySnapshot.ts` / `approvedBypasses.ts`: fetch from
+ * control plane rather than in every developer's local proxy config.
+ * Mirrors `policySnapshot.ts` / `approvedBypasses.ts`: fetch from
  * the control plane, write a local artifact under `.intutic/hooks` with
  * integrity headers, and let the consumer (here the Rust proxy) read it.
  *

package/dist/lib/egressPolicy.js

@@ -1,8 +1,8 @@
 /**
  * egressPolicy.ts — ships the workspace's central egress policy *to* the
  * machine, so an admin sets `enforce`/`monitor` + an allow list once in the
- * control plane rather than in every developer's local proxy config
- * (LLD #63 §4). Mirrors `policySnapshot.ts` / `approvedBypasses.ts`: fetch from
+ * control plane rather than in every developer's local proxy config.
+ * Mirrors `policySnapshot.ts` / `approvedBypasses.ts`: fetch from
  * the control plane, write a local artifact under `.intutic/hooks` with
  * integrity headers, and let the consumer (here the Rust proxy) read it.
  *

package/dist/lib/mcpRegistryPy.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The MCP server registry and allowlist decisions in Python, for the bash
+ * gates (their extractor already requires python3).
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/mcp_registry.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s mcpRegistryRecord.ts, and both
+ * run the shared vectors.
+ */
+export declare const MCP_REGISTRY_PY_SOURCE: string;
+//# sourceMappingURL=mcpRegistryPy.d.ts.map

package/dist/lib/mcpRegistryPy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpRegistryPy.d.ts","sourceRoot":"","sources":["../../src/lib/mcpRegistryPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAkKlC,CAAA"}