@intutic/sync-daemon 2.2.0 → 2.4.0

package/dist/watcher/driftWatcher.js

@@ -5,7 +5,6 @@
  * When changes are detected, it notifies the daemon via a callback to trigger
  * validation against the integrity baseline.
  *
- * LLD #14 — driftWatcher.ts
  * HLD §3.14 — Real-Time State Mirroring (Filesystem integrity checks)
  *
  * @module
@@ -58,7 +57,7 @@ export function startWatcher(workspaceRoot, harnesses, onChange) {
         // dsh's profiles ROOT directory is watched (via buildProtectedPaths)
         // before it exists on disk, precisely so its own CREATION — chokidar's
         // `addDir`, never `change`/`unlink` — is observable: that is the moment
-        // TD-370's "silent no-profile window" closes, and settingsGuard.ts has
+        // dsh's "silent no-profile window" closes, and settingsGuard.ts has
         // nothing to register into until it does. Every other protected path
         // stays `change`/`unlink`-only, unchanged.
         const isDshProfilesCreation = event === 'addDir' && isDshProfilesRoot(path);

package/dist/watcher/driftWatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"driftWatcher.js","sourceRoot":"","sources":["../../src/watcher/driftWatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE3E,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,SAAwB,EACxB,QAA6C;IAE7C,MAAM,SAAS,GAAG,SAAS;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/C,iEAAiE;IACjE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAE7E,4EAA4E;IAC5E,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAA;IAEjF,iGAAiG;IACjG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IAEjE,mEAAmE;IACnE,qEAAqE;IACrE,qDAAqD;IACrD,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,cAAc,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,mCAAmC,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAA;IAE7J,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE;QACxC,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI,EAAE,2CAA2C;QAChE,gBAAgB,EAAE;YAChB,kBAAkB,EAAE,GAAG;YACvB,YAAY,EAAE,GAAG;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,qBAAqB,GAAG,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,qBAAqB,EAAE,CAAC;YACtE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC9F,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAA;YAClG,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,6BAA6B,CAAC,CAAA;YACnE,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,kCAAkC,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"driftWatcher.js","sourceRoot":"","sources":["../../src/watcher/driftWatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE3E,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,SAAwB,EACxB,QAA6C;IAE7C,MAAM,SAAS,GAAG,SAAS;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/C,iEAAiE;IACjE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAE7E,4EAA4E;IAC5E,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAA;IAEjF,iGAAiG;IACjG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IAEjE,mEAAmE;IACnE,qEAAqE;IACrE,qDAAqD;IACrD,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,cAAc,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;IACzD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,mCAAmC,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAA;IAE7J,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE;QACxC,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI,EAAE,2CAA2C;QAChE,gBAAgB,EAAE;YAChB,kBAAkB,EAAE,GAAG;YACvB,YAAY,EAAE,GAAG;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,qBAAqB,GAAG,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,qBAAqB,EAAE,CAAC;YACtE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC9F,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAA;YAClG,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,6BAA6B,CAAC,CAAA;YACnE,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,kCAAkC,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/watcher/settingsGuard.d.ts

@@ -5,12 +5,19 @@
  * Called by the drift watcher whenever any protected governance config file changes.
  *
  * Behaviour per path type:
- *   - JSON hook files (Cursor, Cline, OpenHands, Goose): validate marker presence, restore.
+ *   - Gate files (`GATE_ARTIFACTS`): restored by their writer when deleted or
+ *     no longer the generated gate.
+ *   - JSON hook files (Cursor, Windsurf, OpenHands, Muse, Grok): validate marker presence, restore.
+ *   - Registrations that name the gate script (Codex, GitHub Copilot, Hermes,
+ *     the Goose config, OpenClaw's openclaw.json): restored while the gate is installed.
  *   - Immutable files (Goose plugin): log governance_override_attempt incident instead of restoring.
- *   - Text rules (.roorules, .clinerules): restore from last-written hash.
- *   - Settings files (VS Code, Aider, claude_desktop_config.json): detect drift, restore.
+ *   - VS Code settings: `chat.useHooks` or a `chat.hookFilesLocations` entry that switches
+ *     off the GitHub Copilot gate is set back, and nothing else in the file is touched.
+ *   - The policy snapshot: restored from the last copy the daemon verified when it differs.
+ *   - Other settings files (claude_desktop_config.json, Grok's TOML): a deletion is logged as drift.
+ *   - Gemini CLI's ~/.gemini/settings.json and Antigravity's
+ *     ~/.gemini/config/hooks.json: restore when the gate registration is gone.
  *
- * LLD #14 — settingsGuard.ts
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
  *
  * @module
@@ -26,9 +33,26 @@ export declare function buildProtectedPaths(workspaceRoot: string): string[];
  * once dsh creates it; `driftWatcher.ts` needs to know to react to `addDir`
  * for this ONE path — every other protected path only reacts to
  * `change`/`unlink` (see that module's own comment) — so this predicate is
- * exported for it to check against. TD-370.
+ * exported for it to check against.
  */
 export declare function isDshProfilesRoot(changedPath: string): boolean;
+/**
+ * Whether a change to `changedPath` is one {@link guardSettingsFile} judges:
+ * a path {@link buildProtectedPaths} lists, or a file under one it lists as a
+ * directory (dsh's profiles). The watcher's callback routes on this, so a
+ * path added to that list reaches the guard without a second edit there.
+ */
+export declare function isGuardedPath(changedPath: string, workspaceRoot: string): boolean;
+/**
+ * The policy snapshot's self-heal. When the live snapshot differs from the
+ * last one the daemon verified, the verified copy goes back in force at once;
+ * when there is no verified copy and the live one fails its digest, `resync`
+ * fetches a fresh one. Either way the tamper is reported. A gate reading the
+ * damaged snapshot in between refuses every MCP call
+ * (`POLICY_SNAPSHOT_UNVERIFIED`) and drops its other dynamic rules. Returns
+ * whether it found tampering.
+ */
+export declare function guardPolicySnapshot(workspaceRoot: string, resync: () => Promise<unknown>, snapshotDir?: string): Promise<boolean>;
 /**
  * Inspect any protected governance config file and restore if tampered.
  *
@@ -40,12 +64,14 @@ export declare function isDshProfilesRoot(changedPath: string): boolean;
  * @param skip          - Harnesses `intutic disconnect --harness` took out:
  *                        their files are no longer governed, so a change to
  *                        one is not tampering and is not restored.
+ * @param resyncPolicy  - Fetches a fresh policy snapshot, for a damaged one
+ *                        with no verified copy to restore.
  * @returns true if tampering was detected.
  */
-export declare function guardSettingsFile(changedPath: string, workspaceRoot: string, sops: SyncSopEntry[], proxyUrl?: string, settings?: Record<string, unknown>, skip?: ReadonlySet<string>): Promise<boolean>;
+export declare function guardSettingsFile(changedPath: string, workspaceRoot: string, sops: SyncSopEntry[], proxyUrl?: string, settings?: Record<string, unknown>, skip?: ReadonlySet<string>, resyncPolicy?: () => Promise<unknown>): Promise<boolean>;
 /**
  * Side-effecting wrapper around `dshHooks.ts`'s pure `detectDshCoverageGap` —
- * logs TD-370's "silent no-profile window" as a `dsh_coverage_gap` warning
+ * logs dsh's "silent no-profile window" as a `dsh_coverage_gap` warning
  * when dsh is present on this machine but has zero profiles, so the window
  * is at least documented in the logs even though there is nothing to
  * restore into yet. Called once at `intutic connect` startup — see

package/dist/watcher/settingsGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settingsGuard.d.ts","sourceRoot":"","sources":["../../src/watcher/settingsGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAsBzD,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAyDnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,SAAK,EACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,IAAI,GAAE,WAAW,CAAC,MAAM,CAAa,GACpC,OAAO,CAAC,OAAO,CAAC,CAkKlB;AAuID;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAW7D"}
+{"version":3,"file":"settingsGuard.d.ts","sourceRoot":"","sources":["../../src/watcher/settingsGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAoEzD,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAuEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEjF;AAyDD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC9B,WAAW,GAAE,MAA6B,GACzC,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,SAAK,EACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,IAAI,GAAE,WAAW,CAAC,MAAM,CAAa,EACrC,YAAY,GAAE,MAAM,OAAO,CAAC,OAAO,CAAkB,GACpD,OAAO,CAAC,OAAO,CAAC,CA6LlB;AA8QD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAW7D"}