@telora/daemon 0.19.47 → 0.19.74

package/dist/ci-status.js

@@ -0,0 +1,114 @@
+/**
+ * CI run-status model + merge-gate decision -- Review Gate Hardening (Reconnect
+ * CI to the loop).
+ *
+ * CI is the loop's only clean-environment instrument. The f1 defect merged three
+ * integration->main waves while `npm ci` was structurally broken because the
+ * daemon never waited on a green CI run. This module owns the SOURCE-AGNOSTIC
+ * pieces of the reconnection:
+ *   - `CiRunStatus`: the normalized status a SHA's CI run can be in. Every
+ *     concrete source (Gitea commit-status API, a git-notes status the CI
+ *     workflow writes, ...) maps onto this enum, so the decision + sensor logic
+ *     below never depend on which source is wired.
+ *   - `resolveCiMergeGate`: the pure integration->main merge decision (green ->
+ *     proceed, pending/red -> hold, unknown -> proceed). This is the AC's
+ *     test-target for the green-wait.
+ *   - `CiStatusReader`: the injected seam that READS a SHA's status. Its concrete
+ *     implementation (the credential-dependent Gitea call) is deliberately NOT
+ *     here -- it is provided by the caller. With no reader configured, the gate
+ *     never activates and the merge proceeds exactly as before (safe default).
+ *
+ * Keeping this module pure + reader-injected means the decision and sensor logic
+ * are fully unit-testable without a live registry, and the one part that needs an
+ * infra/credential decision (the concrete reader) is a single, isolated seam.
+ *
+ * @module ci-status
+ */
+/**
+ * Pure merge-gate decision: should integration->main proceed given the merged
+ * SHA's CI status? FAIL-CLOSED (Jeremy decision 2026-07-05): only an explicit
+ * green proceeds; everything else HOLDS.
+ *
+ *   green   -> proceed (the clean-environment instrument is satisfied).
+ *   pending -> HOLD (a run is in flight; wait for it to finish before merging).
+ *   red     -> HOLD (do not merge a red SHA to main).
+ *   unknown -> HOLD (no determinable green status == not green; a missing or
+ *              unreadable status ref must not let an unverified SHA reach main).
+ *
+ * NOTE: this fail-closed model only engages when a CI status READER is wired
+ * into the merge path. With no reader configured the merge path SKIPS the gate
+ * entirely (runCiMergeToMain), so a focus with CI enabled but no status source
+ * is unaffected -- the fail-closed hold applies once a reader exists and reports
+ * a non-green (or absent) status for the merged SHA.
+ */
+export function resolveCiMergeGate(status) {
+    switch (status) {
+        case 'green':
+            return { proceed: true, status, reason: 'CI green for the merged SHA' };
+        case 'pending':
+            return { proceed: false, status, reason: 'CI run pending for the merged SHA -- holding integration->main until green' };
+        case 'red':
+            return { proceed: false, status, reason: 'CI red for the merged SHA -- holding integration->main (a red run must not reach main)' };
+        case 'unknown':
+        default:
+            return { proceed: false, status: 'unknown', reason: 'CI status unavailable for the merged SHA -- holding (fail-closed: unknown != green)' };
+    }
+}
+/**
+ * Classify a git-native CI status from the set of `refs/ci-status/<sha>/<state>`
+ * ref names published for a SHA. The STATE is encoded in the ref NAME (immutable
+ * per-SHA), so no object content read is needed. FAIL-CLOSED: an empty set or an
+ * unrecognized suffix is 'unknown' (holds). A failure ref outranks a success ref
+ * (a red run must win if both somehow exist). Pure -- the caller supplies the
+ * ref names from a scoped `git ls-remote` / fetch.
+ */
+export function classifyGitNativeCiStatus(refNames) {
+    let sawGreen = false;
+    let sawPending = false;
+    for (const raw of refNames) {
+        const ref = raw.trim();
+        if (ref.endsWith('/failure') || ref.endsWith('/error') || ref.endsWith('/red'))
+            return 'red';
+        if (ref.endsWith('/success') || ref.endsWith('/green') || ref.endsWith('/passed'))
+            sawGreen = true;
+        else if (ref.endsWith('/pending') || ref.endsWith('/running') || ref.endsWith('/queued'))
+            sawPending = true;
+    }
+    if (sawGreen)
+        return 'green';
+    if (sawPending)
+        return 'pending';
+    return 'unknown';
+}
+/**
+ * Pure CI-result sensor decision: given the integration tip's CI status and
+ * whether an open ci_run_red escalation already exists, decide whether to file a
+ * new escalation, resolve the open one, or do nothing.
+ *
+ *   red   + no open  -> 'file'    (a failing run becomes signal, once).
+ *   green + open     -> 'resolve' (the branch recovered; close the escalation).
+ *   otherwise        -> 'none'    (red+open: already signalled; pending/unknown:
+ *                                  nothing actionable -- do NOT resolve on
+ *                                  unknown, that would hide an unresolved red).
+ */
+export function decideCiSensorAction(status, hasOpenRedEscalation) {
+    if (status === 'red' && !hasOpenRedEscalation)
+        return 'file';
+    if (status === 'green' && hasOpenRedEscalation)
+        return 'resolve';
+    return 'none';
+}
+export function createGitNativeCiStatusReader(lister) {
+    return async ({ sha, config }) => {
+        let refs = [];
+        try {
+            refs = lister(sha, config);
+        }
+        catch {
+            // Fail-closed: an unreachable/erroring remote must not report green.
+            refs = [];
+        }
+        return classifyGitNativeCiStatus(refs);
+    };
+}
+//# sourceMappingURL=ci-status.js.map

package/dist/ci-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-status.js","sourceRoot":"","sources":["../src/ci-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAC1E,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;QAC1H,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;QACtI,KAAK,SAAS,CAAC;QACf;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qFAAqF,EAAE,CAAC;IAChJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC9F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;IAC9G,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,SAAS,CAAC;AACnB,CAAC;AAyCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,oBAA6B;IACrF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,oBAAoB;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,MAAM,KAAK,OAAO,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAyB;IACrE,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/connect/agents.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Codex/IDE harness config writer: the seeded `AGENTS.md` block. Extracted
+ * verbatim from `../connect.ts` and re-exported from there for import
+ * stability.
+ */
+import { type AgentsMdConnectionInvariant } from '../../templates/agents-md.js';
+import type { ConnectIO } from './shared.js';
+/**
+ * Write or merge a seeded `AGENTS.md` at the repo root (Codex harness).
+ *
+ * The exact analog of `writeOrMergeClaudeMd` for the Codex operator surface:
+ * AGENTS.md is Codex's CLAUDE.md-equivalent. Same merge semantics --
+ *  - Fresh repo: writes the seeded block straight in.
+ *  - Existing AGENTS.md without the Telora delimiters: appends a delimited
+ *    block at the end; user content untouched.
+ *  - Existing AGENTS.md WITH the delimiters: replaces only the delimited block.
+ *
+ * Idempotent at the filesystem level: when the computed content equals what is
+ * already on disk, NO write occurs (no spurious mtime bump, no git churn). The
+ * daemon re-invokes this on boot to self-heal the seed block, so the
+ * unchanged-common-case must not touch the file.
+ */
+export declare function writeOrMergeAgentsMd(repoPath: string, inv: AgentsMdConnectionInvariant, io: ConnectIO): void;
+//# sourceMappingURL=agents.d.ts.map

package/dist/cli/connect/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CA0CN"}

package/dist/cli/connect/agents.js

@@ -0,0 +1,65 @@
+/**
+ * Codex/IDE harness config writer: the seeded `AGENTS.md` block. Extracted
+ * verbatim from `../connect.ts` and re-exported from there for import
+ * stability.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { TELORA_AGENTS_MD_BEGIN, TELORA_AGENTS_MD_END, renderAgentsMd, } from '../../templates/agents-md.js';
+/**
+ * Write or merge a seeded `AGENTS.md` at the repo root (Codex harness).
+ *
+ * The exact analog of `writeOrMergeClaudeMd` for the Codex operator surface:
+ * AGENTS.md is Codex's CLAUDE.md-equivalent. Same merge semantics --
+ *  - Fresh repo: writes the seeded block straight in.
+ *  - Existing AGENTS.md without the Telora delimiters: appends a delimited
+ *    block at the end; user content untouched.
+ *  - Existing AGENTS.md WITH the delimiters: replaces only the delimited block.
+ *
+ * Idempotent at the filesystem level: when the computed content equals what is
+ * already on disk, NO write occurs (no spurious mtime bump, no git churn). The
+ * daemon re-invokes this on boot to self-heal the seed block, so the
+ * unchanged-common-case must not touch the file.
+ */
+export function writeOrMergeAgentsMd(repoPath, inv, io) {
+    const path = resolve(repoPath, 'AGENTS.md');
+    const seedBlock = renderAgentsMd(inv);
+    if (!existsSync(path)) {
+        writeFileSync(path, seedBlock);
+        io.out(`Wrote ${path}.\n`);
+        return;
+    }
+    const existing = readFileSync(path, 'utf-8');
+    const beginIdx = existing.indexOf(TELORA_AGENTS_MD_BEGIN);
+    let newContent;
+    let message;
+    if (beginIdx === -1) {
+        const sep = existing.endsWith('\n') ? '\n' : '\n\n';
+        newContent = existing + sep + seedBlock;
+        message = `Appended Telora seed block to ${path}.\n`;
+    }
+    else {
+        const endIdx = existing.indexOf(TELORA_AGENTS_MD_END, beginIdx);
+        if (endIdx === -1) {
+            const sep = existing.endsWith('\n') ? '\n' : '\n\n';
+            newContent = existing + sep + seedBlock;
+            message = `Appended Telora seed block to ${path} (prior block was malformed).\n`;
+        }
+        else {
+            const after = endIdx + TELORA_AGENTS_MD_END.length;
+            const trailingNewline = existing[after] === '\n' ? 1 : 0;
+            newContent =
+                existing.slice(0, beginIdx) +
+                    seedBlock.trimEnd() +
+                    '\n' +
+                    existing.slice(after + trailingNewline);
+            message = `Refreshed Telora seed block in ${path}.\n`;
+        }
+    }
+    // Idempotency guard: skip the write entirely when nothing would change.
+    if (newContent === existing)
+        return;
+    writeFileSync(path, newContent);
+    io.out(message);
+}
+//# sourceMappingURL=agents.js.map

package/dist/cli/connect/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GAEf,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,GAAgC,EAChC,EAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;QACxC,OAAO,GAAG,iCAAiC,IAAI,KAAK,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;YACxC,OAAO,GAAG,iCAAiC,IAAI,iCAAiC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;YACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU;gBACR,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;oBAC3B,SAAS,CAAC,OAAO,EAAE;oBACnB,IAAI;oBACJ,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;YAC1C,OAAO,GAAG,kCAAkC,IAAI,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IAEpC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC"}

package/dist/cli/connect/claude.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Claude harness config writers: the seeded `CLAUDE.md` block and the
+ * `<repo>/.claude/settings.json` permissions/hooks merge. Extracted verbatim
+ * from `../connect.ts` and re-exported from there for import stability.
+ */
+import type { ConnectIO } from './shared.js';
+/**
+ * Write or merge a seeded `CLAUDE.md` at the repo root.
+ *
+ * - Fresh repo: writes the seeded block straight in.
+ * - Existing CLAUDE.md without the Telora delimiters: appends a delimited
+ *   Telora block at the end. The user's content is untouched.
+ * - Existing CLAUDE.md WITH the delimiters: replaces only the delimited
+ *   block. Re-runs are byte-identical (no churn, no duplication).
+ *
+ * Idempotent at the filesystem level: when the computed content equals what
+ * is already on disk, NO write occurs (no spurious mtime bump, no git churn).
+ * The daemon re-invokes this on every boot to self-heal the seed block, so
+ * the unchanged-common-case must not touch the file.
+ */
+export declare function writeOrMergeClaudeMd(repoPath: string, productName: string | null, io: ConnectIO): void;
+/**
+ * Write or deep-merge `<repo>/.claude/settings.json`.
+ *
+ * Fresh: writes the template directly.
+ * Existing: deep-merges our `permissions.allow` entries into the user's
+ * settings, deduplicating. All other top-level keys are untouched.
+ * Re-runs produce no diff.
+ */
+export declare function writeOrMergeClaudeSettings(repoPath: string, io: ConnectIO): void;
+//# sourceMappingURL=claude.d.ts.map

package/dist/cli/connect/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,EAAE,EAAE,SAAS,GACZ,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CA0BhF"}

package/dist/cli/connect/claude.js

@@ -0,0 +1,104 @@
+/**
+ * Claude harness config writers: the seeded `CLAUDE.md` block and the
+ * `<repo>/.claude/settings.json` permissions/hooks merge. Extracted verbatim
+ * from `../connect.ts` and re-exported from there for import stability.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { TELORA_CLAUDE_MD_BEGIN, TELORA_CLAUDE_MD_END, renderClaudeMd, } from '../../templates/claude-md.js';
+import { buildClaudeSettings, mergeClaudeSettings, } from '../../templates/claude-settings.js';
+/**
+ * Write or merge a seeded `CLAUDE.md` at the repo root.
+ *
+ * - Fresh repo: writes the seeded block straight in.
+ * - Existing CLAUDE.md without the Telora delimiters: appends a delimited
+ *   Telora block at the end. The user's content is untouched.
+ * - Existing CLAUDE.md WITH the delimiters: replaces only the delimited
+ *   block. Re-runs are byte-identical (no churn, no duplication).
+ *
+ * Idempotent at the filesystem level: when the computed content equals what
+ * is already on disk, NO write occurs (no spurious mtime bump, no git churn).
+ * The daemon re-invokes this on every boot to self-heal the seed block, so
+ * the unchanged-common-case must not touch the file.
+ */
+export function writeOrMergeClaudeMd(repoPath, productName, io) {
+    const path = resolve(repoPath, 'CLAUDE.md');
+    const seedBlock = renderClaudeMd(productName);
+    if (!existsSync(path)) {
+        writeFileSync(path, seedBlock);
+        io.out(`Wrote ${path}.\n`);
+        return;
+    }
+    const existing = readFileSync(path, 'utf-8');
+    const beginIdx = existing.indexOf(TELORA_CLAUDE_MD_BEGIN);
+    let newContent;
+    let message;
+    if (beginIdx === -1) {
+        // No prior Telora block -- append, preserving user content.
+        const sep = existing.endsWith('\n') ? '\n' : '\n\n';
+        newContent = existing + sep + seedBlock;
+        message = `Appended Telora seed block to ${path}.\n`;
+    }
+    else {
+        const endIdx = existing.indexOf(TELORA_CLAUDE_MD_END, beginIdx);
+        if (endIdx === -1) {
+            // Begin marker without end -- treat as malformed. Append a fresh block
+            // rather than risk corrupting whatever's there.
+            const sep = existing.endsWith('\n') ? '\n' : '\n\n';
+            newContent = existing + sep + seedBlock;
+            message = `Appended Telora seed block to ${path} (prior block was malformed).\n`;
+        }
+        else {
+            // Replace the existing Telora block in place.
+            const after = endIdx + TELORA_CLAUDE_MD_END.length;
+            // Trim a trailing newline after the end marker so we don't accumulate
+            // blank lines on each re-run.
+            const trailingNewline = existing[after] === '\n' ? 1 : 0;
+            newContent =
+                existing.slice(0, beginIdx) +
+                    seedBlock.trimEnd() +
+                    '\n' +
+                    existing.slice(after + trailingNewline);
+            message = `Refreshed Telora seed block in ${path}.\n`;
+        }
+    }
+    // Idempotency guard: skip the write entirely when nothing would change.
+    // This keeps the boot-time self-heal a no-op for already-current repos.
+    if (newContent === existing)
+        return;
+    writeFileSync(path, newContent);
+    io.out(message);
+}
+/**
+ * Write or deep-merge `<repo>/.claude/settings.json`.
+ *
+ * Fresh: writes the template directly.
+ * Existing: deep-merges our `permissions.allow` entries into the user's
+ * settings, deduplicating. All other top-level keys are untouched.
+ * Re-runs produce no diff.
+ */
+export function writeOrMergeClaudeSettings(repoPath, io) {
+    const dir = resolve(repoPath, '.claude');
+    const path = resolve(dir, 'settings.json');
+    const seed = buildClaudeSettings();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    let existing = null;
+    if (existsSync(path)) {
+        try {
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                existing = parsed;
+            }
+        }
+        catch (err) {
+            io.err(`Warning: existing ${path} is not valid JSON; leaving it alone: ` +
+                `${err instanceof Error ? err.message : String(err)}\n`);
+            return;
+        }
+    }
+    const merged = mergeClaudeSettings(existing, seed);
+    writeFileSync(path, JSON.stringify(merged, null, 2) + '\n');
+    io.out(existing ? `Merged Telora entries into ${path}.\n` : `Wrote ${path}.\n`);
+}
+//# sourceMappingURL=claude.js.map

package/dist/cli/connect/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,WAA0B,EAC1B,EAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,4DAA4D;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;QACxC,OAAO,GAAG,iCAAiC,IAAI,KAAK,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;YACxC,OAAO,GAAG,iCAAiC,IAAI,iCAAiC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,MAAM,KAAK,GAAG,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;YACnD,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU;gBACR,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;oBAC3B,SAAS,CAAC,OAAO,EAAE;oBACnB,IAAI;oBACJ,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;YAC1C,OAAO,GAAG,kCAAkC,IAAI,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IAEpC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,EAAa;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IAEnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,QAAQ,GAAmC,IAAI,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,MAAiC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAG,CACJ,qBAAqB,IAAI,wCAAwC;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAClF,CAAC"}

package/dist/cli/connect/cline.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Cline harness config writers: the project-level Cline rules file and the
+ * Telora MCP registration in the Cline CLI settings. Extracted verbatim from
+ * `../connect.ts` and re-exported from there for import stability.
+ */
+import type { AgentsMdConnectionInvariant } from '../../templates/agents-md.js';
+import type { ConnectIO } from './shared.js';
+/**
+ * Render a project-level Cline rules file carrying the same Telora seed
+ * discipline as CLAUDE.md / AGENTS.md. Cline CLI reads project rules from
+ * `.cline/rules/`, so this is the operator-facing context equivalent for the
+ * Cline harness.
+ */
+export declare function renderClineRules(inv: AgentsMdConnectionInvariant): string;
+/**
+ * Write the Telora Cline project rules file. The file is owned by the connect
+ * flow, so re-runs replace it wholesale; user-authored Cline rules live beside
+ * it under `.cline/rules/`.
+ */
+export declare function writeClineProjectRules(repoPath: string, inv: AgentsMdConnectionInvariant, io: ConnectIO): void;
+/**
+ * Render the Cline CLI MCP config object. Current Cline CLI documentation
+ * stores MCP settings under `~/.cline/data/settings/cline_mcp_settings.json`
+ * with a top-level `mcpServers` map.
+ *
+ * Carries the MCP profile ONLY -- never workstation identity. Like the
+ * `.mcp.json` and Codex builders, identity (`TELORA_URL` / `TELORA_TRACKER_ID`)
+ * resolves from the single source `~/.telora/daemon.json` via the MCP server's
+ * `loadCredentials()` fallback; a persisted copy here would only drift.
+ */
+export declare function renderClineMcpSettings(params: {
+    mcpServerPath: string;
+}): Record<string, unknown>;
+export declare function writeOrMergeClineMcpSettings(io: ConnectIO, params?: {
+    homeOverride?: string;
+}): void;
+//# sourceMappingURL=cline.d.ts.map

package/dist/cli/connect/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/cline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,MAAM,CAczE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CASN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAc1B;AAED,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,SAAS,EACb,MAAM,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,IAAI,CAuDN"}

package/dist/cli/connect/cline.js

@@ -0,0 +1,115 @@
+/**
+ * Cline harness config writers: the project-level Cline rules file and the
+ * Telora MCP registration in the Cline CLI settings. Extracted verbatim from
+ * `../connect.ts` and re-exported from there for import stability.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { resolveMcpServerPath } from '../../mcp-resolution.js';
+import { SEED_BODY, SEED_MCP_REGISTRATION_SENTENCE } from '../../templates/claude-md.js';
+const CLINE_MCP_REGISTRATION_SENTENCE = 'The Telora MCP server is registered in `~/.cline/data/settings/cline_mcp_settings.json`.';
+/**
+ * Render a project-level Cline rules file carrying the same Telora seed
+ * discipline as CLAUDE.md / AGENTS.md. Cline CLI reads project rules from
+ * `.cline/rules/`, so this is the operator-facing context equivalent for the
+ * Cline harness.
+ */
+export function renderClineRules(inv) {
+    const productLabel = inv.productName ? `${inv.productName} (${inv.productId})` : inv.productId;
+    const body = SEED_BODY.replace(SEED_MCP_REGISTRATION_SENTENCE, CLINE_MCP_REGISTRATION_SENTENCE);
+    return (`# Telora Workstation\n\n` +
+        `This workstation is connected to Telora. The connection invariant is recorded here for Cline CLI sessions:\n\n` +
+        `- Telora URL: ${inv.teloraUrl}\n` +
+        `- Organization: ${inv.organizationId}\n` +
+        `- Product: ${productLabel}\n\n` +
+        body);
+}
+/**
+ * Write the Telora Cline project rules file. The file is owned by the connect
+ * flow, so re-runs replace it wholesale; user-authored Cline rules live beside
+ * it under `.cline/rules/`.
+ */
+export function writeClineProjectRules(repoPath, inv, io) {
+    const dir = resolve(repoPath, '.cline', 'rules');
+    const path = resolve(dir, 'telora.md');
+    const content = renderClineRules(inv);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    if (existsSync(path) && readFileSync(path, 'utf-8') === content)
+        return;
+    writeFileSync(path, content);
+    io.out(`Wrote ${path}.\n`);
+}
+/**
+ * Render the Cline CLI MCP config object. Current Cline CLI documentation
+ * stores MCP settings under `~/.cline/data/settings/cline_mcp_settings.json`
+ * with a top-level `mcpServers` map.
+ *
+ * Carries the MCP profile ONLY -- never workstation identity. Like the
+ * `.mcp.json` and Codex builders, identity (`TELORA_URL` / `TELORA_TRACKER_ID`)
+ * resolves from the single source `~/.telora/daemon.json` via the MCP server's
+ * `loadCredentials()` fallback; a persisted copy here would only drift.
+ */
+export function renderClineMcpSettings(params) {
+    return {
+        mcpServers: {
+            telora: {
+                command: 'node',
+                args: [params.mcpServerPath],
+                env: {
+                    TELORA_MCP_PROFILE: 'human',
+                },
+                disabled: false,
+                autoApprove: [],
+            },
+        },
+    };
+}
+export function writeOrMergeClineMcpSettings(io, params = {}) {
+    let mcpServerPath;
+    try {
+        mcpServerPath = resolveMcpServerPath();
+    }
+    catch (err) {
+        io.err(`Warning: could not resolve @telora/mcp-products; skipping Cline MCP registration: ${err instanceof Error ? err.message : String(err)}\n`);
+        return;
+    }
+    const home = params.homeOverride ?? homedir();
+    const dir = resolve(home, '.cline', 'data', 'settings');
+    const path = resolve(dir, 'cline_mcp_settings.json');
+    const desired = renderClineMcpSettings({ mcpServerPath });
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    let parsed = {};
+    if (existsSync(path)) {
+        try {
+            const raw = readFileSync(path, 'utf-8');
+            const candidate = JSON.parse(raw);
+            if (candidate && typeof candidate === 'object' && !Array.isArray(candidate)) {
+                parsed = candidate;
+            }
+        }
+        catch (err) {
+            io.err(`Warning: ${path} is not valid JSON; leaving it alone: ${err instanceof Error ? err.message : String(err)}\n`);
+            return;
+        }
+    }
+    const existingServers = parsed.mcpServers && typeof parsed.mcpServers === 'object' && !Array.isArray(parsed.mcpServers)
+        ? parsed.mcpServers
+        : {};
+    const desiredServers = desired.mcpServers;
+    const next = {
+        ...parsed,
+        mcpServers: {
+            ...existingServers,
+            telora: desiredServers.telora,
+        },
+    };
+    const content = JSON.stringify(next, null, 2) + '\n';
+    if (existsSync(path) && readFileSync(path, 'utf-8') === content)
+        return;
+    writeFileSync(path, content, { mode: 0o600 });
+    io.out(`Registered Telora MCP server in ${path}.\n`);
+}
+//# sourceMappingURL=cline.js.map

package/dist/cli/connect/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../src/cli/connect/cline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAIzF,MAAM,+BAA+B,GACnC,0FAA0F,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgC;IAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAC5B,8BAA8B,EAC9B,+BAA+B,CAChC,CAAC;IACF,OAAO,CACL,0BAA0B;QAC1B,gHAAgH;QAChH,iBAAiB,GAAG,CAAC,SAAS,IAAI;QAClC,mBAAmB,GAAG,CAAC,cAAc,IAAI;QACzC,cAAc,YAAY,MAAM;QAChC,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,GAAgC,EAChC,EAAa;IAEb,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO;IACxE,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAEtC;IACC,OAAO;QACL,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;gBAC5B,GAAG,EAAE;oBACH,kBAAkB,EAAE,OAAO;iBAC5B;gBACD,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,EAAE;aAChB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,EAAa,EACb,SAAoC,EAAE;IAEtC,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,oBAAoB,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CACJ,qFACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvE,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,MAAM,GAAG,SAAoC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAG,CACJ,YAAY,IAAI,yCACd,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GACnB,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7F,CAAC,CAAE,MAAM,CAAC,UAAsC;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,cAAc,GAAG,OAAO,CAAC,UAAqC,CAAC;IACrE,MAAM,IAAI,GAAG;QACX,GAAG,MAAM;QACT,UAAU,EAAE;YACV,GAAG,eAAe;YAClB,MAAM,EAAE,cAAc,CAAC,MAAM;SAC9B;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAErD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO;IACxE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,GAAG,CAAC,mCAAmC,IAAI,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/cli/connect/codex.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Codex harness config writer: registration of the Telora MCP server in the
+ * operator's personal `~/.codex/config.toml`. Extracted verbatim from
+ * `../connect.ts` and re-exported from there for import stability.
+ */
+import type { ConnectIO } from './shared.js';
+/**
+ * Render the delimited Telora MCP block for the operator's personal
+ * `~/.codex/config.toml`. Mirrors the `.mcp.json` shape (command=node + the
+ * resolved abs path to @telora/mcp-products) but as a TOML `[mcp_servers.telora]`
+ * table, the form Codex reads. Profile is `human` (operator-interactive),
+ * matching the `.mcp.json` the Claude path writes.
+ *
+ * Carries the MCP profile ONLY -- never workstation identity. Identity
+ * (`TELORA_URL` / `TELORA_TRACKER_ID`) resolves from the single source
+ * `~/.telora/daemon.json` via the MCP server's `loadCredentials()` fallback,
+ * so a persisted copy here would only be a drift hazard. Keeping it out is the
+ * single-source invariant (the `.mcp.json` builder omits it for the same
+ * reason).
+ *
+ * Values are emitted as JSON-encoded TOML string literals, which is valid TOML
+ * for the path value we control here.
+ */
+export declare function renderCodexMcpBlock(params: {
+    mcpServerPath: string;
+}): string;
+/**
+ * Register the Telora MCP server in the operator's personal
+ * `~/.codex/config.toml` (NOT the per-product execution CODEX_HOME -- that is
+ * `codex-provision.ts`, a separate concern). This is what makes the Telora
+ * tool surface reachable from the operator's interactive Codex chat.
+ *
+ * Idempotent delimited merge, mirroring `writeOrMergeClaudeMd`: replace the
+ * `# BEGIN/END TELORA MCP` block in place if present, append it if absent,
+ * never duplicate. When the computed content equals what is on disk, NO write
+ * occurs. `homeOverride` lets tests target a temp HOME.
+ *
+ * Best-effort: if the MCP package cannot be resolved, prints a warning and
+ * returns without touching the file (the connect flow must not abort).
+ */
+export declare function writeOrMergeCodexMcpToml(io: ConnectIO, params?: {
+    homeOverride?: string;
+}): void;
+//# sourceMappingURL=codex.d.ts.map

package/dist/cli/connect/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/codex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAWT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,IAAI,CA0DN"}