@ironbee-ai/cli 0.8.2 → 0.9.0

package/dist/commands/cycle-toggle.js

@@ -0,0 +1,264 @@
+"use strict";
+/**
+ * Shared helpers for the per-platform enable / disable subcommands:
+ *
+ *   - `applyEnableCycle(cycle, projectDir, target, clientName)` — writes a
+ *     minimal `{ "<cycle>": {} }` block to the targeted config layer (no
+ *     pattern materialization; code defaults flow in at runtime via
+ *     `getCyclePatterns`). If a prior `<cycle> disable` left
+ *     `verifyPatterns: []` behind, it is stripped here so the code defaults
+ *     flow back in. Refuses (warn + no-op) when the cycle is already
+ *     enabled at the targeted layer.
+ *
+ *   - `applyDisableCycle(cycle, projectDir, target, clientName)` — disables
+ *     the cycle. Drops the entire `<cycle>` key from config when no
+ *     customizations + no lower-layer override (clean config); otherwise
+ *     writes `verifyPatterns: []` as a load-bearing hard kill while
+ *     preserving `alwaysRequired` / `evidencePaths` /
+ *     `additionalVerifyPatterns`.
+ *
+ * Three platforms use this today: `browser` (default-on; opt out via
+ * `browser disable`), `node` (Node.js runtime debug, `node-devtools` MCP,
+ * `ndt_*` tools) and `backend` (runtime-agnostic protocol cycle,
+ * `backend-devtools` MCP, `bedt_*` tools). Consumed by
+ * `src/commands/{browser,node,backend}.ts` — the hierarchical
+ * `<platform> <verb>` shape leaves room for future per-platform
+ * subcommands beyond enable/disable.
+ *
+ * Both helpers throw when `<cycle>` isn't a known cycle; callers handle the
+ * error and exit.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.knownCycles = knownCycles;
+exports.assertKnownCycle = assertKnownCycle;
+exports.applyEnableCycle = applyEnableCycle;
+exports.applyDisableCycle = applyDisableCycle;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const registry_1 = require("../clients/registry");
+const logger_1 = require("../lib/logger");
+const output_1 = require("../lib/output");
+const config_1 = require("../lib/config");
+function knownCycles() {
+    return [...config_1.ALL_CYCLES];
+}
+function assertKnownCycle(cycle) {
+    const known = knownCycles();
+    if (!known.includes(cycle)) {
+        throw new Error(`Unknown cycle '${cycle}'. Available: ${known.join(", ")}.`);
+    }
+}
+function readLayerConfig(configPath) {
+    if (!(0, fs_1.existsSync)(configPath)) {
+        return {};
+    }
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
+    }
+    catch (e) {
+        logger_1.logger.debug(`failed to read ${configPath}: ${e}`);
+        throw new Error(`Config at ${configPath} is not valid JSON: ${e instanceof Error ? e.message : e}`);
+    }
+}
+function writeLayerConfig(configPath, config) {
+    (0, fs_1.mkdirSync)((0, path_1.join)(configPath, ".."), { recursive: true });
+    (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+/**
+ * Resolve the clients whose artifacts should be re-rendered after a cycle
+ * toggle. `--client all` (or undefined) means every client currently
+ * detected in the project — undetected clients are skipped to avoid
+ * dropping `.claude/` / `.cursor/` into a project the user never opted
+ * into. A specific `<name>` is honored even when undetected so scripted
+ * setups can pre-populate one of the dirs.
+ */
+function resolveAffectedClients(projectDir, clientName) {
+    if (clientName === undefined || clientName === "all") {
+        return (0, registry_1.detectClients)(projectDir);
+    }
+    return (0, registry_1.resolveTargetClients)(projectDir, clientName);
+}
+/**
+ * Re-render the artifacts for every affected client off the **just-written**
+ * config. Each `client.install(projectDir, config)` call:
+ *
+ *   - Rewrites `.mcp.json` / `.cursor/mcp.json` with `isCycleEnabled`-gated
+ *     entries (disabled cycles drop their MCP server entry; re-enabled
+ *     cycles add it back).
+ *   - Rewrites `.claude/settings.json` permissions with the same per-cycle
+ *     gating (Claude only — Cursor has no per-permission allowlist).
+ *   - Calls `syncPlatformSectionsToConfig` which flips the platform
+ *     marker blocks in installed skill / rule / command md files based
+ *     on the new cycle-enabled state.
+ *
+ * Returns the project-relative md files that the platform-section sync
+ * actually updated, just for the user-facing log line.
+ */
+function rerenderClientArtifacts(projectDir, clientName) {
+    const clients = resolveAffectedClients(projectDir, clientName);
+    if (clients.length === 0) {
+        logger_1.logger.debug(`cycle-toggle: no clients detected in ${projectDir} — skipping artifact rerender`);
+        return [];
+    }
+    const cfg = (0, config_1.loadConfig)(projectDir);
+    const updated = [];
+    for (const client of clients) {
+        try {
+            client.install(projectDir, cfg);
+            updated.push(client.name);
+        }
+        catch (e) {
+            logger_1.logger.debug(`cycle-toggle: failed to rerender ${client.name}: ${e}`);
+        }
+    }
+    return updated;
+}
+function readCycleBlock(config, cycle) {
+    const raw = config[cycle];
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        return raw;
+    }
+    return undefined;
+}
+/** Disable command + flag suffix for a given target. Used in messages only. */
+function disableCommandHint(cycle, target) {
+    const flag = target === "project" ? "" : ` --${target}`;
+    return `ironbee ${cycle} disable${flag}`;
+}
+/**
+ * Enable a cycle and re-render installed skill/rule/command md files.
+ *
+ * The canonical disable signal is `block.enable: false` (mirrors
+ * `recording.enable` / `jobQueue.enable` / `verification.enable`). `<cycle>
+ * enable` reverses that: drops the `enable` key. Stale legacy disable
+ * markers (`verifyPatterns: []`) are cleaned up at the same time so the
+ * cycle truly turns on. Migrates older `{ "disabled": [...] }` shapes too.
+ *
+ * Result shapes:
+ *   - Default-on cycle (browser) on a fresh project → block dropped if
+ *     content becomes empty (block-absent + default-on already activates).
+ *   - Default-off cycle (node, backend) on a fresh project → minimal
+ *     `{ "<cycle>": {} }` (block presence is the enable signal).
+ *   - Undoing `<cycle> disable`: `enable: false` removed; if cleaned block
+ *     becomes `{}` and cycle is default-on, block dropped too.
+ *
+ * No-op + warning when the cycle is already enabled at the targeted layer.
+ *
+ * `target` selects which config layer to write:
+ *   - `"project"` (default) — committed `<project>/.ironbee/config.json`.
+ *   - `"global"`  — `~/.ironbee/config.json`.
+ *   - `"local"`   — gitignored `<project>/.ironbee/config.local.json`.
+ *
+ * `clientName`: optional filter for which clients' md files to update.
+ * `"all"` / `<name>` / undefined (default: every registered client; per-file
+ * existsSync gate skips ones without installed artifacts).
+ */
+function applyEnableCycle(cycle, projectDir, target, clientName) {
+    assertKnownCycle(cycle);
+    const configPath = (0, config_1.getTargetConfigPath)(target, projectDir);
+    const config = readLayerConfig(configPath);
+    const block = readCycleBlock(config, cycle);
+    const explicitlyDisabledAtLayer = block !== undefined
+        && (block.enable === false
+            || (Array.isArray(block.verifyPatterns) && block.verifyPatterns.length === 0));
+    const isDefaultOnCycle = config_1.CYCLES_ENABLED_BY_DEFAULT.has(cycle);
+    // "Already enabled at the targeted layer": NOT disabled at this layer
+    // AND has an enabled signal (block present OR default-on fallback).
+    const alreadyEnabledAtLayer = !explicitlyDisabledAtLayer
+        && (block !== undefined || isDefaultOnCycle);
+    if (alreadyEnabledAtLayer) {
+        console.log(`${output_1.pc.yellow("⚠")}  ${cycle} cycle is already enabled in ${target} config (${output_1.pc.dim(configPath)}).\n` +
+            `   Run ${output_1.pc.cyan(disableCommandHint(cycle, target))} first to reset, then re-run enable-${cycle}.`);
+        return;
+    }
+    if (block !== undefined) {
+        // Strip the disable signals; preserve every other field (customizations).
+        const cleaned = { ...block };
+        delete cleaned.enable;
+        if (Array.isArray(cleaned.verifyPatterns) && cleaned.verifyPatterns.length === 0) {
+            delete cleaned.verifyPatterns;
+        }
+        // Always keep the cleaned block, even when empty. The minimal `{}`
+        // shape is the canonical post-enable footprint — uniform across
+        // every cycle (browser / node / backend) so users see consistent
+        // config output regardless of which platform they toggled.
+        config[cycle] = cleaned;
+    }
+    else if (!isDefaultOnCycle) {
+        // Default-off cycle, no block → write a minimal `{}` so the code
+        // defaults flow at runtime.
+        config[cycle] = {};
+    }
+    // Else: default-on cycle, block absent → already activated by fallback;
+    // no work needed.
+    writeLayerConfig(configPath, config);
+    const updatedClients = rerenderClientArtifacts(projectDir, clientName);
+    console.log(`${output_1.pc.green("✓")}  Enabled ${output_1.pc.bold(cycle)} cycle verification in ${target} config (${output_1.pc.dim(configPath)}).`);
+    console.log(`   ${output_1.pc.dim("Default verifyPatterns from CLI " + cycle + " cycle apply automatically.")}`);
+    if (updatedClients.length > 0) {
+        console.log(`   ${output_1.pc.dim("Re-rendered artifacts (MCP servers, permissions, skill/rule/command md) for: " + updatedClients.join(", "))}`);
+    }
+    console.log(`\n   ${output_1.pc.dim("To customize, set")} ${output_1.pc.cyan(`${cycle}.verifyPatterns`)} ${output_1.pc.dim("(replaces defaults)")} ${output_1.pc.dim("or")} ${output_1.pc.cyan(`${cycle}.additionalVerifyPatterns`)} ${output_1.pc.dim("(appended).")}`);
+}
+/**
+ * Disable a cycle and reset the cycle fragment in installed skill / rule /
+ * command md files.
+ *
+ * Writes `block.enable: false` on the cycle block — the canonical disable
+ * signal (mirrors `recording.enable` / `jobQueue.enable` /
+ * `verification.enable`). Real customizations (`alwaysRequired`,
+ * `evidencePaths`, `additionalVerifyPatterns`, non-empty `verifyPatterns`)
+ * are preserved untouched; the runtime ignores them because `enable: false`
+ * takes precedence in `getCyclePatterns`.
+ *
+ * Footprint after `<cycle> disable` on a fresh project:
+ *
+ *   `{ "<cycle>": { "enable": false } }`
+ *
+ * Cleanup pass also runs: stale legacy `verifyPatterns: []` markers are
+ * stripped (the user previously disabled with an older CLI), since the
+ * canonical signal now lives on `enable`. Empty stub blocks left behind
+ * by prior toggles are normalized — the block ends up as
+ * `{ "enable": false, ...preservedCustomizations }`.
+ *
+ * Idempotent: re-running disable is a no-op when `block.enable` is already
+ * `false` AND no stale markers need cleanup.
+ *
+ * `target` / `clientName` semantics match `applyEnableCycle`.
+ */
+function applyDisableCycle(cycle, projectDir, target, clientName) {
+    assertKnownCycle(cycle);
+    const configPath = (0, config_1.getTargetConfigPath)(target, projectDir);
+    const config = readLayerConfig(configPath);
+    const block = readCycleBlock(config, cycle);
+    // Build the new block: { enable: false, ...preservedCustomizations }.
+    // Stale legacy `verifyPatterns: []` is dropped (the canonical signal is
+    // now `enable: false`). Real customizations stay untouched.
+    const cleaned = { ...(block ?? {}) };
+    if (Array.isArray(cleaned.verifyPatterns) && cleaned.verifyPatterns.length === 0) {
+        delete cleaned.verifyPatterns;
+    }
+    cleaned.enable = false;
+    // Did anything change? Compare against the original block by-key.
+    const sameAsOriginal = block !== undefined
+        && block.enable === false
+        && Object.keys(block).length === Object.keys(cleaned).length
+        && Object.keys(cleaned).every((k) => {
+            // Shallow equality for primitive fields; reference equality is
+            // sufficient because cleaned spreads block's array/object refs.
+            return block[k] === cleaned[k];
+        });
+    if (sameAsOriginal) {
+        console.log(`${output_1.pc.dim("·")}  ${cycle} cycle already disabled in ${target} config (no-op).`);
+        return;
+    }
+    config[cycle] = cleaned;
+    writeLayerConfig(configPath, config);
+    const updatedClients = rerenderClientArtifacts(projectDir, clientName);
+    console.log(`${output_1.pc.green("✓")}  Disabled ${output_1.pc.bold(cycle)} cycle verification in ${target} config (${output_1.pc.dim(configPath)}).`);
+    console.log(`   ${output_1.pc.dim("Customizations of alwaysRequired, evidencePaths, additionalVerifyPatterns are preserved.")}`);
+    if (updatedClients.length > 0) {
+        console.log(`   ${output_1.pc.dim("Re-rendered artifacts (MCP servers, permissions, skill/rule/command md) for: " + updatedClients.join(", "))}`);
+    }
+}
+//# sourceMappingURL=cycle-toggle.js.map

package/dist/commands/cycle-toggle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cycle-toggle.js","sourceRoot":"","sources":["../../src/commands/cycle-toggle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AA8BH,kCAEC;AAED,4CAKC;AA+GD,4CA6DC;AA4BD,8CA6CC;AA1RD,2BAAwE;AACxE,+BAA4B;AAE5B,kDAA0E;AAC1E,0CAAuC;AACvC,0CAAmC;AACnC,0CAQuB;AAcvB,SAAgB,WAAW;IACvB,OAAO,CAAC,GAAG,mBAAU,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAa,WAAW,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACvC,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAkB,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,eAAM,CAAC,KAAK,CAAC,kBAAkB,UAAU,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,MAAqB;IAC/D,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,UAAkB,EAAE,UAAmB;IACnE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACnD,OAAO,IAAA,wBAAa,EAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAA,+BAAoB,EAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,UAAkB,EAAE,UAAmB;IACpE,MAAM,OAAO,GAAc,sBAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,eAAM,CAAC,KAAK,CAAC,wCAAwC,UAAU,+BAA+B,CAAC,CAAC;QAChG,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAkB,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,MAAqB,EAAE,KAAa;IACxD,MAAM,GAAG,GAAY,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,GAAiB,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,KAAa,EAAE,MAAoB;IAC3D,MAAM,IAAI,GAAW,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC;IAChE,OAAO,WAAW,KAAK,WAAW,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,gBAAgB,CAC5B,KAAa,EACb,UAAkB,EAClB,MAAoB,EACpB,UAAmB;IAEnB,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,UAAU,GAAW,IAAA,4BAAmB,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,MAAM,GAAkB,eAAe,CAAC,UAAU,CAAC,CAAC;IAE1D,MAAM,KAAK,GAA2B,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,yBAAyB,GAAY,KAAK,KAAK,SAAS;WACvD,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;eACnB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,gBAAgB,GAAY,kCAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEvE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,qBAAqB,GAAY,CAAC,yBAAyB;WAC1D,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,CAAC;IAEjD,IAAI,qBAAqB,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACP,GAAG,WAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,gCAAgC,MAAM,YAAY,WAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM;YACrG,UAAU,WAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,uCAAuC,KAAK,GAAG,CACtG,CAAC;QACF,OAAO;IACX,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,0EAA0E;QAC1E,MAAM,OAAO,GAAe,EAAE,GAAG,KAAK,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/E,OAAO,OAAO,CAAC,cAAc,CAAC;QAClC,CAAC;QACD,mEAAmE;QACnE,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,iEAAiE;QACjE,4BAA4B;QAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,wEAAwE;IACxE,kBAAkB;IAElB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,cAAc,GAAa,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,GAAG,WAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,WAAE,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,MAAM,YAAY,WAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3H,OAAO,CAAC,GAAG,CAAC,MAAM,WAAE,CAAC,GAAG,CAAC,kCAAkC,GAAG,KAAK,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,WAAE,CAAC,GAAG,CAAC,+EAA+E,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7I,CAAC;IACD,OAAO,CAAC,GAAG,CACP,QAAQ,WAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,WAAE,CAAC,IAAI,CAAC,GAAG,KAAK,iBAAiB,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAE,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CACxM,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,iBAAiB,CAC7B,KAAa,EACb,UAAkB,EAClB,MAAoB,EACpB,UAAmB;IAEnB,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,UAAU,GAAW,IAAA,4BAAmB,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,MAAM,GAAkB,eAAe,CAAC,UAAU,CAAC,CAAC;IAE1D,MAAM,KAAK,GAA2B,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEpE,sEAAsE;IACtE,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,OAAO,GAAe,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,OAAO,CAAC,cAAc,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;IAEvB,kEAAkE;IAClE,MAAM,cAAc,GAAY,KAAK,KAAK,SAAS;WAC5C,KAAK,CAAC,MAAM,KAAK,KAAK;WACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;WACzD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAS,EAAW,EAAE;YACjD,+DAA+D;YAC/D,gEAAgE;YAChE,OAAQ,KAAiC,CAAC,CAAC,CAAC,KAAM,OAAmC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IAEP,IAAI,cAAc,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,8BAA8B,MAAM,kBAAkB,CAAC,CAAC;QAC5F,OAAO;IACX,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,cAAc,GAAa,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,GAAG,WAAE,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,WAAE,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,MAAM,YAAY,WAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5H,OAAO,CAAC,GAAG,CAAC,MAAM,WAAE,CAAC,GAAG,CAAC,0FAA0F,CAAC,EAAE,CAAC,CAAC;IACxH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,WAAE,CAAC,GAAG,CAAC,+EAA+E,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7I,CAAC;AACL,CAAC"}

package/dist/commands/disable-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disable-verification.d.ts","sourceRoot":"","sources":["../../src/commands/disable-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,0BAA0B,EAAE,OAanC,CAAC"}
+{"version":3,"file":"disable-verification.d.ts","sourceRoot":"","sources":["../../src/commands/disable-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,0BAA0B,EAAE,OAenC,CAAC"}

package/dist/commands/disable-verification.js

@@ -16,17 +16,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.disableVerificationCommand = void 0;
 const commander_1 = require("commander");
 const registry_1 = require("../clients/registry");
+const config_1 = require("../lib/config");
 const output_1 = require("../lib/output");
 const verification_toggle_1 = require("./verification-toggle");
 exports.disableVerificationCommand = new commander_1.Command("disable-verification")
-    .description("Turn off verification enforcement for the current project; ironbee runs in monitoring-only mode (session/activity/tool_call telemetry still flows to the collector).")
+    .description("Turn off verification enforcement; ironbee runs in monitoring-only mode (session/activity/tool_call telemetry still flows to the collector). Default target is the committed project config; -g writes global, --local writes the gitignored personal layer.")
     .option("-p, --project-dir <dir>", "Project directory (default: cwd).")
     .option("-g, --global", "Write to the global config (~/.ironbee/config.json) instead of the project.")
+    .option("--local", "Write to the gitignored project-local override (<project>/.ironbee/config.local.json). Mutually exclusive with --global.")
     .option("--client <name>", `Only re-render artifacts for this client (${(0, registry_1.clientNames)()}), or "all". Default: detected clients.`)
     .action((opts) => {
     try {
         const projectDir = opts.projectDir ?? process.cwd();
-        (0, verification_toggle_1.applyVerificationToggle)(false, projectDir, opts.global ?? false, opts.client);
+        const target = (0, config_1.resolveConfigTargetFromFlags)(opts);
+        (0, verification_toggle_1.applyVerificationToggle)(false, projectDir, target, opts.client);
     }
     catch (e) {
         console.error(`${output_1.pc.red("✗")}  ${e instanceof Error ? e.message : e}`);

package/dist/commands/disable-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"disable-verification.js","sourceRoot":"","sources":["../../src/commands/disable-verification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,yCAAoC;AACpC,kDAAkD;AAClD,0CAAmC;AACnC,+DAAgE;AAEnD,QAAA,0BAA0B,GAAY,IAAI,mBAAO,CAAC,sBAAsB,CAAC;KACjF,WAAW,CAAC,sKAAsK,CAAC;KACnL,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,cAAc,EAAE,6EAA6E,CAAC;KACrG,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,IAAA,sBAAW,GAAE,yCAAyC,CAAC;KAC9H,MAAM,CAAC,CAAC,IAAgE,EAAQ,EAAE;IAC/E,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAA,6CAAuB,EAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"disable-verification.js","sourceRoot":"","sources":["../../src/commands/disable-verification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,yCAAoC;AACpC,kDAAkD;AAClD,0CAA2E;AAC3E,0CAAmC;AACnC,+DAAgE;AAEnD,QAAA,0BAA0B,GAAY,IAAI,mBAAO,CAAC,sBAAsB,CAAC;KACjF,WAAW,CAAC,8PAA8P,CAAC;KAC3Q,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,cAAc,EAAE,6EAA6E,CAAC;KACrG,MAAM,CAAC,SAAS,EAAE,0HAA0H,CAAC;KAC7I,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,IAAA,sBAAW,GAAE,yCAAyC,CAAC;KAC9H,MAAM,CAAC,CAAC,IAAiF,EAAQ,EAAE;IAChG,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAiB,IAAA,qCAA4B,EAAC,IAAI,CAAC,CAAC;QAChE,IAAA,6CAAuB,EAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/enable-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enable-verification.d.ts","sourceRoot":"","sources":["../../src/commands/enable-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,yBAAyB,EAAE,OAalC,CAAC"}
+{"version":3,"file":"enable-verification.d.ts","sourceRoot":"","sources":["../../src/commands/enable-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,yBAAyB,EAAE,OAelC,CAAC"}

package/dist/commands/enable-verification.js

@@ -14,17 +14,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.enableVerificationCommand = void 0;
 const commander_1 = require("commander");
 const registry_1 = require("../clients/registry");
+const config_1 = require("../lib/config");
 const output_1 = require("../lib/output");
 const verification_toggle_1 = require("./verification-toggle");
 exports.enableVerificationCommand = new commander_1.Command("enable-verification")
-    .description("Turn verification enforcement back on for the current project (writes verification.enable: true and re-renders client artifacts).")
+    .description("Turn verification enforcement back on (writes verification.enable: true and re-renders client artifacts). Default target is the committed project config; -g writes global, --local writes the gitignored personal layer.")
     .option("-p, --project-dir <dir>", "Project directory (default: cwd).")
     .option("-g, --global", "Write to the global config (~/.ironbee/config.json) instead of the project.")
+    .option("--local", "Write to the gitignored project-local override (<project>/.ironbee/config.local.json). Mutually exclusive with --global.")
     .option("--client <name>", `Only re-render artifacts for this client (${(0, registry_1.clientNames)()}), or "all". Default: detected clients.`)
     .action((opts) => {
     try {
         const projectDir = opts.projectDir ?? process.cwd();
-        (0, verification_toggle_1.applyVerificationToggle)(true, projectDir, opts.global ?? false, opts.client);
+        const target = (0, config_1.resolveConfigTargetFromFlags)(opts);
+        (0, verification_toggle_1.applyVerificationToggle)(true, projectDir, target, opts.client);
     }
     catch (e) {
         console.error(`${output_1.pc.red("✗")}  ${e instanceof Error ? e.message : e}`);

package/dist/commands/enable-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"enable-verification.js","sourceRoot":"","sources":["../../src/commands/enable-verification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,yCAAoC;AACpC,kDAAkD;AAClD,0CAAmC;AACnC,+DAAgE;AAEnD,QAAA,yBAAyB,GAAY,IAAI,mBAAO,CAAC,qBAAqB,CAAC;KAC/E,WAAW,CAAC,mIAAmI,CAAC;KAChJ,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,cAAc,EAAE,6EAA6E,CAAC;KACrG,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,IAAA,sBAAW,GAAE,yCAAyC,CAAC;KAC9H,MAAM,CAAC,CAAC,IAAgE,EAAQ,EAAE;IAC/E,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAA,6CAAuB,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"enable-verification.js","sourceRoot":"","sources":["../../src/commands/enable-verification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,yCAAoC;AACpC,kDAAkD;AAClD,0CAA2E;AAC3E,0CAAmC;AACnC,+DAAgE;AAEnD,QAAA,yBAAyB,GAAY,IAAI,mBAAO,CAAC,qBAAqB,CAAC;KAC/E,WAAW,CAAC,2NAA2N,CAAC;KACxO,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,cAAc,EAAE,6EAA6E,CAAC;KACrG,MAAM,CAAC,SAAS,EAAE,0HAA0H,CAAC;KAC7I,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,IAAA,sBAAW,GAAE,yCAAyC,CAAC;KAC9H,MAAM,CAAC,CAAC,IAAiF,EAAQ,EAAE;IAChG,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAiB,IAAA,qCAA4B,EAAC,IAAI,CAAC,CAAC;QAChE,IAAA,6CAAuB,EAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/node.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `ironbee node <subcommand>` — manage the Node.js runtime debug cycle
+ * (V8 inspector probes via the `node-devtools` MCP, `ndt_*` tools).
+ *
+ * Subcommands today:
+ *   - `enable`  — opt in (writes a minimal `{ "node": {} }` block; code
+ *                 defaults flow in at runtime).
+ *   - `disable` — opt out (drops the block clean when no customizations
+ *                 + no lower-layer override; otherwise hard-kills via
+ *                 `verifyPatterns: []` while preserving customizations).
+ */
+import { Command } from "commander";
+export declare const nodeEnableCommand: Command;
+export declare const nodeDisableCommand: Command;
+export declare const nodeCommand: Command;
+//# sourceMappingURL=node.d.ts.map

package/dist/commands/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/commands/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC,eAAO,MAAM,iBAAiB,EAAE,OAW1B,CAAC;AAEP,eAAO,MAAM,kBAAkB,EAAE,OAW3B,CAAC;AAEP,eAAO,MAAM,WAAW,EAAE,OAGS,CAAC"}

package/dist/commands/node.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * `ironbee node <subcommand>` — manage the Node.js runtime debug cycle
+ * (V8 inspector probes via the `node-devtools` MCP, `ndt_*` tools).
+ *
+ * Subcommands today:
+ *   - `enable`  — opt in (writes a minimal `{ "node": {} }` block; code
+ *                 defaults flow in at runtime).
+ *   - `disable` — opt out (drops the block clean when no customizations
+ *                 + no lower-layer override; otherwise hard-kills via
+ *                 `verifyPatterns: []` while preserving customizations).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeCommand = exports.nodeDisableCommand = exports.nodeEnableCommand = void 0;
+const commander_1 = require("commander");
+const registry_1 = require("../clients/registry");
+const config_1 = require("../lib/config");
+const output_1 = require("../lib/output");
+const cycle_toggle_1 = require("./cycle-toggle");
+function attachToggleOptions(cmd) {
+    return cmd
+        .option("-p, --project-dir <dir>", "Project directory (default: cwd).")
+        .option("-g, --global", "Write to the global config (~/.ironbee/config.json) instead of the project.")
+        .option("--local", "Write to the gitignored project-local override (<project>/.ironbee/config.local.json). Mutually exclusive with --global.")
+        .option("--client <name>", `Only update guidance md files for this client (${(0, registry_1.clientNames)()}), or "all". Default: every registered client (per-file existsSync gate skips uninstalled ones).`);
+}
+exports.nodeEnableCommand = attachToggleOptions(new commander_1.Command("enable"))
+    .description("Enable the Node.js runtime debug cycle. Writes a minimal `{ \"node\": {} }` block — code defaults (server/api/routes paths) flow in at runtime; `config.json` stays minimal. Refuses (warn + no-op) when the cycle is already enabled at this layer.")
+    .action((opts) => {
+    try {
+        const projectDir = opts.projectDir ?? process.cwd();
+        const target = (0, config_1.resolveConfigTargetFromFlags)(opts);
+        (0, cycle_toggle_1.applyEnableCycle)("node", projectDir, target, opts.client);
+    }
+    catch (e) {
+        console.error(`${output_1.pc.red("✗")}  ${e instanceof Error ? e.message : e}`);
+        process.exit(1);
+    }
+});
+exports.nodeDisableCommand = attachToggleOptions(new commander_1.Command("disable"))
+    .description("Disable the Node.js runtime debug cycle. With no customizations + no lower-layer override, drops the entire `node` block. Otherwise writes `verifyPatterns: []` (load-bearing hard kill; preserves `alwaysRequired` / `evidencePaths` / `additionalVerifyPatterns`).")
+    .action((opts) => {
+    try {
+        const projectDir = opts.projectDir ?? process.cwd();
+        const target = (0, config_1.resolveConfigTargetFromFlags)(opts);
+        (0, cycle_toggle_1.applyDisableCycle)("node", projectDir, target, opts.client);
+    }
+    catch (e) {
+        console.error(`${output_1.pc.red("✗")}  ${e instanceof Error ? e.message : e}`);
+        process.exit(1);
+    }
+});
+exports.nodeCommand = new commander_1.Command("node")
+    .description("Manage the Node.js runtime debug cycle (V8 inspector probes via the `node-devtools` MCP, `ndt_*` tools).")
+    .addCommand(exports.nodeEnableCommand)
+    .addCommand(exports.nodeDisableCommand);
+//# sourceMappingURL=node.js.map

package/dist/commands/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/commands/node.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,yCAAoC;AACpC,kDAAkD;AAClD,0CAA2E;AAC3E,0CAAmC;AACnC,iDAAqE;AASrE,SAAS,mBAAmB,CAAC,GAAY;IACrC,OAAO,GAAG;SACL,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;SACtE,MAAM,CAAC,cAAc,EAAE,6EAA6E,CAAC;SACrG,MAAM,CAAC,SAAS,EAAE,0HAA0H,CAAC;SAC7I,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,IAAA,sBAAW,GAAE,kGAAkG,CAAC,CAAC;AACtM,CAAC;AAEY,QAAA,iBAAiB,GAAY,mBAAmB,CAAC,IAAI,mBAAO,CAAC,QAAQ,CAAC,CAAC;KAC/E,WAAW,CAAC,sPAAsP,CAAC;KACnQ,MAAM,CAAC,CAAC,IAAmB,EAAQ,EAAE;IAClC,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAiB,IAAA,qCAA4B,EAAC,IAAI,CAAC,CAAC;QAChE,IAAA,+BAAgB,EAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEM,QAAA,kBAAkB,GAAY,mBAAmB,CAAC,IAAI,mBAAO,CAAC,SAAS,CAAC,CAAC;KACjF,WAAW,CAAC,sQAAsQ,CAAC;KACnR,MAAM,CAAC,CAAC,IAAmB,EAAQ,EAAE;IAClC,IAAI,CAAC;QACD,MAAM,UAAU,GAAW,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAiB,IAAA,qCAA4B,EAAC,IAAI,CAAC,CAAC;QAChE,IAAA,gCAAiB,EAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEM,QAAA,WAAW,GAAY,IAAI,mBAAO,CAAC,MAAM,CAAC;KAClD,WAAW,CAAC,0GAA0G,CAAC;KACvH,UAAU,CAAC,yBAAiB,CAAC;KAC7B,UAAU,CAAC,0BAAkB,CAAC,CAAC"}

package/dist/commands/verification-toggle.d.ts

@@ -30,6 +30,7 @@
  *   - Session lifecycle / activity / tool_call telemetry continues to
  *     flow to the collector — only enforcement is suppressed.
  */
+import { ConfigTarget } from "../lib/config";
 /**
  * Apply the `enable` flag to client artifacts and persist the config.
  * Order: artifacts → config (see file header for why).
@@ -37,11 +38,27 @@
  * Exported so both `enable-verification` and `disable-verification` commands
  * call the same code path; the only difference is the `enable` arg.
  *
+ * `target` selects which config layer to write:
+ *   - `"project"` (default for the CLI) — committed `<project>/.ironbee/config.json`.
+ *   - `"global"`  (`-g` / `--global`) — `~/.ironbee/config.json`.
+ *   - `"local"`   (`--local`) — gitignored `<project>/.ironbee/config.local.json`.
+ *
  * `clientName` controls which clients receive new artifacts:
  *   - "all" → every registered client
  *   - <name> → just that one (throws on unknown name)
  *   - undefined → detected clients; falls back to the first registered client
  *     when nothing is detected (matches `install.ts`).
+ *
+ * Cross-layer awareness:
+ *   - The no-op check uses both the targeted layer's value AND the merged
+ *     effective value. If both already match `enable`, we bail (real no-op).
+ *   - If the targeted layer already matches `enable` but the merged effective
+ *     state disagrees, a higher-priority layer is shadowing the change. We
+ *     don't touch artifacts — the user has another layer carrying the value;
+ *     we print exactly which layer overrides and how to clear it. Without
+ *     this guard, the function would silently no-op while leaving the
+ *     installed artifacts in the shadowing layer's state, which is the
+ *     surprising behavior we want to avoid.
  */
-export declare function applyVerificationToggle(enable: boolean, projectDir: string, useGlobal: boolean, clientName?: string): void;
+export declare function applyVerificationToggle(enable: boolean, projectDir: string, target: ConfigTarget, clientName?: string): void;
 //# sourceMappingURL=verification-toggle.d.ts.map

package/dist/commands/verification-toggle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-toggle.d.ts","sourceRoot":"","sources":["../../src/commands/verification-toggle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAyCH;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,EAClB,UAAU,CAAC,EAAE,MAAM,GACpB,IAAI,CAgDN"}
+{"version":3,"file":"verification-toggle.d.ts","sourceRoot":"","sources":["../../src/commands/verification-toggle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,EAEH,YAAY,EAKf,MAAM,eAAe,CAAC;AA0EvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,EACpB,UAAU,CAAC,EAAE,MAAM,GACpB,IAAI,CA2EN"}