@intutic/cli 0.1.1 → 0.2.0

package/dist/harness/aider.js

@@ -1,17 +1,18 @@
 /**
- * Aider adapter — .aider.conf.yml
+ * aider.ts — Aider adapter (full implementation with safe YAML merge).
  *
- * Writes SOP content into the extra-instructions field of the
- * Aider YAML config file.
+ * Writes SOP content into .aider.conf.yml using the aiderConfigMerger
+ * which safely merges proxy keys and strips dangerous auto-exec keys
+ * (test-cmd, lint-cmd) that Aider auto-executes on startup.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
-import { join, dirname } from 'node:path';
-import { access, writeFile, rename, mkdir } from 'node:fs/promises';
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
+import { mergeAiderConfig } from '@intutic/sync-daemon/harness/aiderConfigMerger';
 const CONFIG_FILE = '.aider.conf.yml';
 export const aiderAdapter = {
     type: HarnessType.AIDER,
@@ -26,28 +27,13 @@ export const aiderAdapter = {
         }
     },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        if (sops.length === 0)
-            return null;
         const filePath = join(workspaceRoot, CONFIG_FILE);
-        const tmpPath = filePath + '.intutic-tmp';
-        const instructions = sops
-            .map((sop) => `## ${sop.title}\n\n${sop.content}`)
-            .join('\n\n---\n\n');
-        // YAML format — extra-instructions is a multi-line string
-        const yaml = [
-            '# Intutic Governance Rules (auto-generated)',
-            '# DO NOT EDIT — managed by intutic sync daemon',
-            `# Last sync: ${newIso()}`,
-            '',
-            `# Proxy URL: ${proxyUrl}`,
-            '',
-            'extra-instructions: |',
-            ...instructions.split('\n').map((line) => `  ${line}`),
-            '',
-        ].join('\n');
-        await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(tmpPath, yaml, 'utf-8');
-        await rename(tmpPath, filePath);
+        const sopsText = sops.length > 0
+            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
+            : undefined;
+        // Safe merge: strips test-cmd/lint-cmd, preserves all other user keys,
+        // injects proxy URL as openai-api-base and anthropic-api-base
+        await mergeAiderConfig(filePath, proxyUrl, sopsText);
         return filePath;
     },
     async readCurrentHash(workspaceRoot) {

package/dist/harness/aider.js.map

@@ -1 +1 @@
-{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,0DAA0D;QAC1D,MAAM,IAAI,GAAG;YACX,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,EAAE;YACF,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,uBAAuB;YACvB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACvC,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAA;AAEjF,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAA;QAEb,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACpD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/claudeDesktop.d.ts

@@ -0,0 +1,18 @@
+/**
+ * claudeDesktop.ts — Claude Desktop adapter (drift guard only).
+ *
+ * Claude Desktop has no hook system and no proxy override capability.
+ * Its config file (claude_desktop_config.json) is writable by any user
+ * process, so we register it with the drift watcher to detect tampering
+ * (e.g., a malicious MCP server added by another tool).
+ *
+ * writeConfig() returns null — no governance content can be injected.
+ * readCurrentHash() returns the hash of the config file so the drift
+ * watcher can detect changes and emit a governance_drift incident.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const claudeDesktopAdapter: IHarnessAdapter;
+//# sourceMappingURL=claudeDesktop.d.ts.map

package/dist/harness/claudeDesktop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeDesktop.d.ts","sourceRoot":"","sources":["../../src/harness/claudeDesktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAiBjD,eAAO,MAAM,oBAAoB,EAAE,eA2BlC,CAAA"}

package/dist/harness/claudeDesktop.js

@@ -0,0 +1,69 @@
+/**
+ * claudeDesktop.ts — Claude Desktop adapter (drift guard only).
+ *
+ * Claude Desktop has no hook system and no proxy override capability.
+ * Its config file (claude_desktop_config.json) is writable by any user
+ * process, so we register it with the drift watcher to detect tampering
+ * (e.g., a malicious MCP server added by another tool).
+ *
+ * writeConfig() returns null — no governance content can be injected.
+ * readCurrentHash() returns the hash of the config file so the drift
+ * watcher can detect changes and emit a governance_drift incident.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+/** Platform-specific path to claude_desktop_config.json. */
+function getClaudeDesktopConfigPath() {
+    switch (process.platform) {
+        case 'darwin':
+            return join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+        case 'win32':
+            return join(process.env.APPDATA ?? homedir(), 'Claude', 'claude_desktop_config.json');
+        default: // linux / WSL
+            return join(homedir(), '.config', 'Claude', 'claude_desktop_config.json');
+    }
+}
+const CONFIG_PATH = getClaudeDesktopConfigPath();
+export const claudeDesktopAdapter = {
+    type: HarnessType.CLAUDE_DESKTOP,
+    configFileName: CONFIG_PATH,
+    async detect(_workspaceRoot) {
+        // Check for /Applications/Claude.app (macOS)
+        try {
+            await access('/Applications/Claude.app');
+            return true;
+        }
+        catch { /* fall through */ }
+        // Check for the config file directly
+        try {
+            await access(CONFIG_PATH);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    /** No governance content can be injected into Claude Desktop. */
+    async writeConfig() {
+        return null;
+    },
+    /**
+     * Hash the config file so the drift watcher can detect if an
+     * unauthorized MCP server entry is added between sync cycles.
+     */
+    async readCurrentHash(_workspaceRoot) {
+        try {
+            return await hashFile(CONFIG_PATH);
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=claudeDesktop.js.map

package/dist/harness/claudeDesktop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeDesktop.js","sourceRoot":"","sources":["../../src/harness/claudeDesktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,4DAA4D;AAC5D,SAAS,0BAA0B;IACjC,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QAClG,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QACvF,SAAS,cAAc;YACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAA;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAoB;IACnD,IAAI,EAAE,WAAW,CAAC,cAAc;IAChC,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,6CAA6C;QAC7C,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC1F,qCAAqC;QACrC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IACvE,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/cline.d.ts

@@ -0,0 +1,13 @@
+/**
+ * cline.ts — Cline adapter (full implementation).
+ *
+ * Detects the Cline VS Code extension, writes Intutic governance rules
+ * as .clinerules, injects the PreToolUse blocking hook into .clinerules/hooks/,
+ * and configures the proxy base URL via VS Code settings + .env.intutic sidecar.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const clineAdapter: IHarnessAdapter;
+//# sourceMappingURL=cline.d.ts.map

package/dist/harness/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}

package/dist/harness/cline.js

@@ -0,0 +1,75 @@
+/**
+ * cline.ts — Cline adapter (full implementation).
+ *
+ * Detects the Cline VS Code extension, writes Intutic governance rules
+ * as .clinerules, injects the PreToolUse blocking hook into .clinerules/hooks/,
+ * and configures the proxy base URL via VS Code settings + .env.intutic sidecar.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { access, readdir, writeFile, rename, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+import { newIso } from '@intutic/id';
+import { writeClineHooks } from '@intutic/sync-daemon/harness/clineHooks';
+import { injectClineProxySettings } from './vscodeSettingsWriter.js';
+const CONFIG_FILE = '.clinerules';
+export const clineAdapter = {
+    type: HarnessType.CLINE,
+    configFileName: CONFIG_FILE,
+    async detect(workspaceRoot) {
+        // Check for .clinerules in workspace
+        try {
+            await access(join(workspaceRoot, CONFIG_FILE));
+            return true;
+        }
+        catch {
+            // fall through
+        }
+        // Check for VS Code extension directory
+        try {
+            const extensionsDir = join(homedir(), '.vscode', 'extensions');
+            const entries = await readdir(extensionsDir);
+            return entries.some((entry) => entry.startsWith('saoudrizwan.claude-dev-'));
+        }
+        catch {
+            return false;
+        }
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        // 1. Write .clinerules text rules
+        const filePath = join(workspaceRoot, CONFIG_FILE);
+        const instructions = sops.length > 0
+            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
+            : '# Intutic governance active — no SOP rules configured yet.';
+        const content = [
+            '# Intutic Governance Rules (auto-generated)',
+            '# DO NOT EDIT — managed by intutic sync daemon',
+            `# Last sync: ${newIso()}`,
+            '',
+            instructions,
+            '',
+        ].join('\n');
+        await mkdir(dirname(filePath), { recursive: true });
+        const tmp = filePath + '.intutic-tmp';
+        await writeFile(tmp, content, 'utf-8');
+        await rename(tmp, filePath);
+        // 2. Write PreToolUse blocking hooks into .clinerules/hooks/
+        await writeClineHooks(workspaceRoot, proxyUrl);
+        // 3. Inject proxy URL into VS Code settings + .env.intutic sidecar
+        await injectClineProxySettings(workspaceRoot, proxyUrl);
+        return filePath;
+    },
+    async readCurrentHash(workspaceRoot) {
+        try {
+            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=cline.js.map

package/dist/harness/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AAEpE,MAAM,WAAW,GAAG,aAAa,CAAA;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,4DAA4D,CAAA;QAEhE,MAAM,OAAO,GAAG;YACd,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,EAAE;YACF,YAAY;YACZ,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;QACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAE3B,6DAA6D;QAC7D,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAE9C,mEAAmE;QACnE,MAAM,wBAAwB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAEvD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/codex.d.ts

@@ -1,9 +1,9 @@
 /**
- * Codex adapter — .env.intutic
+ * codex.ts — Codex adapter (updated: also writes ~/.codex/config.toml).
  *
- * Codex uses environment variables for configuration. Since we can't
- * inject env vars into a running process, we write a .env.intutic file
- * with proxy URL variables that Codex can source.
+ * In addition to the workspace .env.intutic file, writes
+ * ~/.codex/config.toml with model_providers.litellm.base_url so Codex
+ * routes LLM calls through the Intutic proxy even without env var sourcing.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,YAAY,EAAE,eAwD1B,CAAA"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,YAAY,EAAE,eAkE1B,CAAA"}

package/dist/harness/codex.js

@@ -1,27 +1,27 @@
 /**
- * Codex adapter — .env.intutic
+ * codex.ts — Codex adapter (updated: also writes ~/.codex/config.toml).
  *
- * Codex uses environment variables for configuration. Since we can't
- * inject env vars into a running process, we write a .env.intutic file
- * with proxy URL variables that Codex can source.
+ * In addition to the workspace .env.intutic file, writes
+ * ~/.codex/config.toml with model_providers.litellm.base_url so Codex
+ * routes LLM calls through the Intutic proxy even without env var sourcing.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
 import { join, dirname } from 'node:path';
 import { writeFile, rename, mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
 import { newIso } from '@intutic/id';
 const CONFIG_FILE = '.env.intutic';
+const CODEX_CONFIG = join(homedir(), '.codex', 'config.toml');
 export const codexAdapter = {
     type: HarnessType.CODEX,
     configFileName: CONFIG_FILE,
     async detect(_workspaceRoot) {
-        // Codex detection: check for CODEX_HOME env var or codex in PATH
         if (process.env.CODEX_HOME)
             return true;
-        // Basic PATH check
         const pathDirs = (process.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':');
         try {
             const { accessSync } = await import('node:fs');
@@ -30,36 +30,48 @@ export const codexAdapter = {
                     accessSync(join(dir, 'codex'));
                     return true;
                 }
-                catch {
-                    // Not in this dir
-                }
+                catch { /* not here */ }
             }
         }
-        catch {
-            // Fallback — not detected
-        }
+        catch { /* ignore */ }
         return false;
     },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        if (sops.length === 0)
-            return null;
+        // 1. Workspace .env.intutic
         const filePath = join(workspaceRoot, CONFIG_FILE);
-        const tmpPath = filePath + '.intutic-tmp';
         const envContent = [
             '# Intutic Governance Rules (auto-generated)',
             '# DO NOT EDIT — managed by intutic sync daemon',
             `# Last sync: ${newIso()}`,
             '# Source this file: source .env.intutic',
             '',
-            `ANTHROPIC_BASE_URL=${proxyUrl}`,
-            `OPENAI_BASE_URL=${proxyUrl}`,
-            `INTUTIC_PROXY_URL=${proxyUrl}`,
-            `INTUTIC_SOP_COUNT=${sops.length}`,
+            `export ANTHROPIC_BASE_URL="${proxyUrl}"`,
+            `export OPENAI_BASE_URL="${proxyUrl}"`,
+            `export INTUTIC_PROXY_URL="${proxyUrl}"`,
+            `export INTUTIC_SOP_COUNT=${sops.length}`,
             '',
         ].join('\n');
         await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(tmpPath, envContent, 'utf-8');
-        await rename(tmpPath, filePath);
+        const tmpEnv = filePath + '.intutic-tmp';
+        await writeFile(tmpEnv, envContent, 'utf-8');
+        await rename(tmpEnv, filePath);
+        // 2. ~/.codex/config.toml — persists proxy across sessions without env sourcing
+        const codexToml = [
+            '# Intutic proxy config (auto-generated)',
+            '# DO NOT EDIT — managed by intutic sync daemon',
+            `# Last sync: ${newIso()}`,
+            '',
+            '[model_providers.litellm]',
+            `base_url = "${proxyUrl}"`,
+            '',
+            '[model_providers.openai]',
+            `base_url = "${proxyUrl}"`,
+            '',
+        ].join('\n');
+        await mkdir(dirname(CODEX_CONFIG), { recursive: true });
+        const tmpToml = CODEX_CONFIG + '.intutic-tmp';
+        await writeFile(tmpToml, codexToml, 'utf-8');
+        await rename(tmpToml, CODEX_CONFIG);
         return filePath;
     },
     async readCurrentHash(workspaceRoot) {

package/dist/harness/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,iEAAiE;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,mBAAmB;QACnB,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,sBAAsB,QAAQ,EAAE;YAChC,mBAAmB,QAAQ,EAAE;YAC7B,qBAAqB,QAAQ,EAAE;YAC/B,qBAAqB,IAAI,CAAC,MAAM,EAAE;YAClC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC7C,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAClC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,QAAQ,GAAG;YACzC,2BAA2B,QAAQ,GAAG;YACtC,6BAA6B,QAAQ,GAAG;YACxC,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;QACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE9B,gFAAgF;QAChF,MAAM,SAAS,GAAG;YAChB,yCAAyC;YACzC,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,EAAE;YACF,2BAA2B;YAC3B,eAAe,QAAQ,GAAG;YAC1B,EAAE;YACF,0BAA0B;YAC1B,eAAe,QAAQ,GAAG;YAC1B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,YAAY,GAAG,cAAc,CAAA;QAC7C,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAEnC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/continue.d.ts

@@ -0,0 +1,14 @@
+/**
+ * continue.ts — Continue adapter (proxy URL injection).
+ *
+ * Detects the Continue AI coding assistant and merges the Intutic
+ * proxy URL as apiBase into each model entry in ~/.continue/config.yaml.
+ * Continue has no hook system so proxy routing (Vector B) is the only
+ * available governance mechanism.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const continueAdapter: IHarnessAdapter;
+//# sourceMappingURL=continue.d.ts.map

package/dist/harness/continue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,eAAe,EAAE,eAgE7B,CAAA"}

package/dist/harness/continue.js

@@ -0,0 +1,97 @@
+/**
+ * continue.ts — Continue adapter (proxy URL injection).
+ *
+ * Detects the Continue AI coding assistant and merges the Intutic
+ * proxy URL as apiBase into each model entry in ~/.continue/config.yaml.
+ * Continue has no hook system so proxy routing (Vector B) is the only
+ * available governance mechanism.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { access, readdir, readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+import { newIso } from '@intutic/id';
+const home = homedir();
+const CONTINUE_DIR = join(home, '.continue');
+const CONFIG_YAML = join(CONTINUE_DIR, 'config.yaml');
+const CONFIG_JSON = join(CONTINUE_DIR, 'config.json');
+export const continueAdapter = {
+    type: HarnessType.CONTINUE,
+    configFileName: CONFIG_YAML,
+    async detect(_workspaceRoot) {
+        for (const p of [CONFIG_YAML, CONFIG_JSON]) {
+            try {
+                await access(p);
+                return true;
+            }
+            catch { /* fall through */ }
+        }
+        try {
+            const entries = await readdir(join(home, '.vscode', 'extensions'));
+            return entries.some((e) => e.startsWith('continue.continue-'));
+        }
+        catch {
+            return false;
+        }
+    },
+    async writeConfig(_workspaceRoot, _sops, proxyUrl) {
+        // Merge apiBase into each model entry in config.yaml
+        let raw = '';
+        try {
+            raw = await readFile(CONFIG_YAML, 'utf-8');
+        }
+        catch {
+            raw = '';
+        }
+        // Inject apiBase under each `- name:` model entry.
+        // Simple line-based approach that handles the common config.yaml structure.
+        const lines = raw.split('\n');
+        const result = [];
+        let inModels = false;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            result.push(line);
+            if (line.trim() === 'models:') {
+                inModels = true;
+                continue;
+            }
+            if (inModels && line.trim().startsWith('- name:')) {
+                // After each model entry start, inject apiBase if not already present
+                const next = lines[i + 1] ?? '';
+                if (!next.trim().startsWith('apiBase:')) {
+                    result.push(`  apiBase: "${proxyUrl}"`);
+                }
+            }
+            if (inModels && line.trim() && !line.startsWith(' ') && !line.trim().startsWith('-') && !line.trim().startsWith('models:')) {
+                inModels = false;
+            }
+        }
+        // If config.yaml is empty or has no models section yet, write a minimal config
+        if (!raw.includes('models:')) {
+            result.push('# Intutic proxy config (auto-generated)');
+            result.push(`# Last sync: ${newIso()}`);
+            result.push('models:');
+            result.push('  - name: "Intutic Governed Model"');
+            result.push(`    apiBase: "${proxyUrl}"`);
+        }
+        const content = result.join('\n');
+        await mkdir(CONTINUE_DIR, { recursive: true });
+        const tmp = CONFIG_YAML + '.intutic-tmp';
+        await writeFile(tmp, content, 'utf-8');
+        await rename(tmp, CONFIG_YAML);
+        return CONFIG_YAML;
+    },
+    async readCurrentHash(_workspaceRoot) {
+        try {
+            return await hashFile(CONFIG_YAML);
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=continue.js.map

package/dist/harness/continue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue.js","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;AACtB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;AAErD,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;YAClE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,QAAgB;QAC/E,qDAAqD;QACrD,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,GAAG,EAAE,CAAA;QAAC,CAAC;QAErE,mDAAmD;QACnD,4EAA4E;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEjB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAC5D,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,sEAAsE;gBACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,MAAM,CAAC,IAAI,CAAC,eAAe,QAAQ,GAAG,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3H,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;YACtD,MAAM,CAAC,IAAI,CAAC,gBAAgB,MAAM,EAAE,EAAE,CAAC,CAAA;YACvC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACtB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,QAAQ,GAAG,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,WAAW,GAAG,cAAc,CAAA;QACxC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QAC9B,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,IAAI,CAAC;YAAC,OAAO,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IAClE,CAAC;CACF,CAAA"}

package/dist/harness/cursor.d.ts

@@ -1,2 +1,14 @@
-export declare const cursorAdapter: import("./types.js").IHarnessAdapter;
+/**
+ * cursor.ts — Cursor adapter (full implementation with 3-level hooks).
+ *
+ * Replaces the minimal createMarkdownAdapter stub with a full adapter that:
+ * - Writes .cursorrules governance text (existing behaviour, kept)
+ * - Injects hooks.json at project-level AND user-level
+ * - Enterprise system-level (/etc/cursor) is handled by enterprise-install CLI
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const cursorAdapter: IHarnessAdapter;
 //# sourceMappingURL=cursor.d.ts.map

package/dist/harness/cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,aAAa,sCAA4D,CAAA"}
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,aAAa,EAAE,eAgC3B,CAAA"}

package/dist/harness/cursor.js

@@ -1,9 +1,65 @@
 /**
- * Cursor adapter — .cursorrules
+ * cursor.ts — Cursor adapter (full implementation with 3-level hooks).
+ *
+ * Replaces the minimal createMarkdownAdapter stub with a full adapter that:
+ * - Writes .cursorrules governance text (existing behaviour, kept)
+ * - Injects hooks.json at project-level AND user-level
+ * - Enterprise system-level (/etc/cursor) is handled by enterprise-install CLI
+ *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
-import { createMarkdownAdapter } from './base.js';
-export const cursorAdapter = createMarkdownAdapter(HarnessType.CURSOR, '.cursorrules');
+import { hashFile } from '../lib/hash.js';
+import { buildMarkdownContent } from './base.js';
+import { writeCursorHooks } from '@intutic/sync-daemon/harness/cursorHooks';
+import { writeFile, rename, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+const CONFIG_FILE = '.cursorrules';
+export const cursorAdapter = {
+    type: HarnessType.CURSOR,
+    configFileName: CONFIG_FILE,
+    async detect(workspaceRoot) {
+        // .cursorrules or .cursor/ directory
+        for (const marker of [CONFIG_FILE, '.cursor']) {
+            try {
+                await access(join(workspaceRoot, marker));
+                return true;
+            }
+            catch { /* fall through */ }
+        }
+        // ~/.cursor directory (user has Cursor installed)
+        try {
+            await access(join(homedir(), '.cursor'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        // 1. Write .cursorrules markdown governance text
+        const filePath = join(workspaceRoot, CONFIG_FILE);
+        const content = buildMarkdownContent(sops, proxyUrl);
+        await mkdir(dirname(filePath), { recursive: true });
+        const tmp = filePath + '.intutic-tmp';
+        await writeFile(tmp, content, 'utf-8');
+        await rename(tmp, filePath);
+        // 2. Inject hooks.json at project + user level (writeSystemLevel=false;
+        //    system level requires enterprise-install with sudo)
+        await writeCursorHooks(workspaceRoot, proxyUrl, '', false);
+        return filePath;
+    },
+    async readCurrentHash(workspaceRoot) {
+        try {
+            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+        }
+        catch {
+            return null;
+        }
+    },
+};
 //# sourceMappingURL=cursor.js.map

package/dist/harness/cursor.js.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA"}
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,WAAW,CAAC,MAAM;IACxB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,qCAAqC;QACrC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,kDAAkD;QAClD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACpD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;QACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAE3B,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAE1D,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IACvF,CAAC;CACF,CAAA"}

package/dist/harness/detector.d.ts

@@ -1,7 +1,7 @@
 /**
  * Harness detector — auto-detect which AI harnesses are present.
  *
- * Instantiates all 8 adapters and checks each for presence in
+ * Instantiates all 14 adapters and checks each for presence in
  * the workspace. Returns a DetectedHarness array for reporting.
  *
  * HLD §3.14 — Harness Onboarding Matrix