@intutic/cli 1.10.0 → 2.0.0

package/dist/harness/jsSdkGatedAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsSdkGatedAdapter.d.ts","sourceRoot":"","sources":["../../src/harness/jsSdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD;;;;;;;sCAOsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,8DAA8D;IAC9D,IAAI,EAAE,WAAW,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACzC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAYD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,uBAAuB,GAAG,eAAe,CAkFpF"}

package/dist/harness/jsSdkGatedAdapter.js

@@ -0,0 +1,139 @@
+/**
+ * jsSdkGatedAdapter.ts — shared builder for harness adapters whose blocking
+ * gate ships SDK-side in `@intutic/gate` (packages/gate-js), with no on-disk
+ * hook/config file to write a tool-call gate into.
+ *
+ * The JS/TS-native counterpart of `sdkGatedAdapter.ts` (Wave 1's Python
+ * builder — see its module doc for why a shared factory exists instead of
+ * hand-copying one adapter per framework: the same defect-generator argument
+ * applies here). Two differences from the Python version drive most of this
+ * file's shape:
+ *
+ *   1. **Manifest format.** Python's manifests (`pyproject.toml`,
+ *      `requirements.txt`, `uv.lock`) are scanned as raw text for a
+ *      case-insensitive substring/regex match. `package.json` is scanned as
+ *      structured JSON — `dependencies`/`devDependencies`/`peerDependencies`
+ *      — because a JS/TS framework detection needs a VERSION check (the
+ *      Vercel AI SDK's `toolApproval` veto point is a v6+ API; the same
+ *      package name existed at lower majors with a materially different
+ *      surface), which a plain substring test cannot express.
+ *   2. **The pointer comment.** Python frameworks point at
+ *      `pip install intutic-clawde[...]` and a `from intutic_clawde...`
+ *      import. These point at `npm install @intutic/gate` and an
+ *      `import { ... } from '@intutic/gate/<subpath>'` line instead — the
+ *      env file's prose says "your own Node.js process", not "your own
+ *      Python process".
+ *
+ * @module
+ */
+import { join, dirname } from 'node:path';
+import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { hashFile } from '../lib/hash.js';
+import { newIso } from '@intutic/id';
+const CONFIG_FILE = '.env.intutic';
+function isDigit(c) {
+    return c >= '0' && c <= '9';
+}
+/**
+ * Leading major version from a semver range string, without regex — plain
+ * linear scans over the (short, locally-authored) range string, matching
+ * `gate.ts`'s `trimTrailingSlashes`/`trimLeadingSlashes` style rather than
+ * an unbounded-quantifier regex. Handles the common range prefixes
+ * (`^`, `~`, `>=`, `<=`, `>`, `<`, `=`, a leading `v`, whitespace) by simply
+ * skipping every non-digit character before the first digit run. Returns
+ * `null` when no leading digit run exists at all (`"workspace:*"`,
+ * `"latest"`, `"*"`, a git/URL range).
+ */
+export function leadingMajorVersion(range) {
+    let i = 0;
+    while (i < range.length && !isDigit(range[i]))
+        i++;
+    let j = i;
+    while (j < range.length && isDigit(range[j]))
+        j++;
+    if (j === i)
+        return null;
+    return parseInt(range.slice(i, j), 10);
+}
+function allDeps(manifest) {
+    return { ...manifest.peerDependencies, ...manifest.devDependencies, ...manifest.dependencies };
+}
+/** Builds an `IHarnessAdapter` for one JS/TS SDK-gated framework from its spec. */
+export function makeJsSdkGatedAdapter(spec) {
+    return {
+        type: spec.type,
+        configFileName: CONFIG_FILE,
+        async detect(workspaceRoot) {
+            let manifest;
+            try {
+                const raw = await readFile(join(workspaceRoot, 'package.json'), 'utf-8');
+                manifest = JSON.parse(raw);
+            }
+            catch {
+                return false; // no package.json, or unparseable — not a JS/TS workspace we can read
+            }
+            const deps = allDeps(manifest);
+            for (const req of spec.requires) {
+                const range = deps[req.name];
+                if (range === undefined)
+                    return false;
+                if (req.minMajor !== undefined) {
+                    const major = leadingMajorVersion(range);
+                    if (major === null || major < req.minMajor)
+                        return false;
+                }
+            }
+            if (spec.requiresPrefix !== undefined) {
+                const hasPrefixed = Object.keys(deps).some((name) => name.startsWith(spec.requiresPrefix));
+                if (!hasPrefixed)
+                    return false;
+            }
+            if (spec.requiresAnyPrefix !== undefined) {
+                const hasAny = Object.keys(deps).some((name) => spec.requiresAnyPrefix.some((prefix) => name.startsWith(prefix)));
+                if (!hasAny)
+                    return false;
+            }
+            return true;
+        },
+        async writeConfig(workspaceRoot, sops, proxyUrl) {
+            const filePath = join(workspaceRoot, CONFIG_FILE);
+            const preamble = spec.envPreamble ?? [
+                `These env vars govern LLM egress only. ${spec.label} tools run in your own`,
+                'Node.js process, where no config or hook file can gate them — the',
+                'blocking tool gate ships SDK-side:',
+            ];
+            const envContent = [
+                '# Intutic Governance Rules (auto-generated)',
+                '# DO NOT EDIT — managed by intutic sync daemon',
+                `# Last sync: ${newIso()}`,
+                '# Source this file: source .env.intutic',
+                '',
+                `export ANTHROPIC_BASE_URL="${proxyUrl}"`,
+                `export OPENAI_BASE_URL="${proxyUrl}"`,
+                `export INTUTIC_PROXY_URL="${proxyUrl}"`,
+                `export INTUTIC_SOP_COUNT=${sops.length}`,
+                '',
+                ...preamble.map((line) => `# ${line}`),
+                `#   npm install ${spec.npmInstall}`,
+                `#   ${spec.importLine}`,
+                `# ${spec.usageSummary}`,
+                `# See https://docs.intutic.ai/integrations/${spec.docsSlug}`,
+                '',
+            ].join('\n');
+            await mkdir(dirname(filePath), { recursive: true });
+            const tmpEnv = filePath + '.intutic-tmp';
+            await writeFile(tmpEnv, envContent, 'utf-8');
+            await rename(tmpEnv, filePath);
+            return filePath;
+        },
+        async readCurrentHash(workspaceRoot) {
+            try {
+                return await hashFile(join(workspaceRoot, CONFIG_FILE));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=jsSdkGatedAdapter.js.map

package/dist/harness/jsSdkGatedAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsSdkGatedAdapter.js","sourceRoot":"","sources":["../../src/harness/jsSdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAGrE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AA8DlC,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAA;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAA;IAClD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxC,CAAC;AAQD,SAAS,OAAO,CAAC,QAAyB;IACxC,OAAO,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAA;AAChG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IACjE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,WAAW;QAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,IAAI,QAAyB,CAAA;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;gBACxE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA,CAAC,sEAAsE;YACrF,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;YAE9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC5B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAA;gBACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;oBACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC,QAAQ;wBAAE,OAAO,KAAK,CAAA;gBAC1D,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAe,CAAC,CAAC,CAAA;gBAC3F,IAAI,CAAC,WAAW;oBAAE,OAAO,KAAK,CAAA;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,IAAI,CAAC,iBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAClE,CAAA;gBACD,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAA;YAC3B,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI;gBACnC,0CAA0C,IAAI,CAAC,KAAK,wBAAwB;gBAC5E,mEAAmE;gBACnE,oCAAoC;aACrC,CAAA;YACD,MAAM,UAAU,GAAG;gBACjB,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,yCAAyC;gBACzC,EAAE;gBACF,8BAA8B,QAAQ,GAAG;gBACzC,2BAA2B,QAAQ,GAAG;gBACtC,6BAA6B,QAAQ,GAAG;gBACxC,4BAA4B,IAAI,CAAC,MAAM,EAAE;gBACzC,EAAE;gBACF,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBACtC,mBAAmB,IAAI,CAAC,UAAU,EAAE;gBACpC,OAAO,IAAI,CAAC,UAAU,EAAE;gBACxB,KAAK,IAAI,CAAC,YAAY,EAAE;gBACxB,8CAA8C,IAAI,CAAC,QAAQ,EAAE;gBAC7D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;YACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAE9B,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/harness/langchain.d.ts

@@ -0,0 +1,22 @@
+/**
+ * langchain.ts — LangChain adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts): writes .env.intutic
+ * with proxy base-URL env vars, plus a comment pointing at the SDK-side tool
+ * gate — LangChain has no on-disk hook/config file either, since its tools
+ * run as plain Python callables/objects in the agent's own process.
+ *
+ * Detection is Python-only on purpose. LangChain ships in both the Python
+ * (`langchain`/`langchain-core`) and JS/TS (`langchain` npm package)
+ * ecosystems, and the HarnessType.LANGCHAIN enum member covers both for
+ * *detection* purposes (see its doc comment in shared-types/enums.ts) — but
+ * this env-adapter only writes Python env vars, matching the
+ * `intutic_clawde.gate.adapters.langchain` gate it points at. A JS/TS
+ * tool-call gate for LangChain.js is a `@intutic/gate` TypeScript package
+ * concern for a later phase, not this adapter.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const langchainAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=langchain.d.ts.map

package/dist/harness/langchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.d.ts","sourceRoot":"","sources":["../../src/harness/langchain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,eAAO,MAAM,gBAAgB,sCAU3B,CAAA"}

package/dist/harness/langchain.js

@@ -0,0 +1,33 @@
+/**
+ * langchain.ts — LangChain adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts): writes .env.intutic
+ * with proxy base-URL env vars, plus a comment pointing at the SDK-side tool
+ * gate — LangChain has no on-disk hook/config file either, since its tools
+ * run as plain Python callables/objects in the agent's own process.
+ *
+ * Detection is Python-only on purpose. LangChain ships in both the Python
+ * (`langchain`/`langchain-core`) and JS/TS (`langchain` npm package)
+ * ecosystems, and the HarnessType.LANGCHAIN enum member covers both for
+ * *detection* purposes (see its doc comment in shared-types/enums.ts) — but
+ * this env-adapter only writes Python env vars, matching the
+ * `intutic_clawde.gate.adapters.langchain` gate it points at. A JS/TS
+ * tool-call gate for LangChain.js is a `@intutic/gate` TypeScript package
+ * concern for a later phase, not this adapter.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+export const langchainAdapter = makeSdkGatedAdapter({
+    type: HarnessType.LANGCHAIN,
+    label: 'LangChain',
+    keywords: ['langchain'], // matches "langchain" and "langchain-core"
+    pipInstall: 'intutic-clawde[langchain]',
+    importLine: 'from intutic_clawde.gate.adapters.langchain import IntuticMiddleware',
+    usageSummary: 'IntuticMiddleware.wrap_tool_call (LangChain v1.x AgentMiddleware) — or guard_tools ' +
+        'for pre-1.0 LangChain — refuses denied calls before the tool body runs.',
+    docsSlug: 'langchain',
+});
+//# sourceMappingURL=langchain.js.map

package/dist/harness/langchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.js","sourceRoot":"","sources":["../../src/harness/langchain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IAClD,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,2CAA2C;IACpE,UAAU,EAAE,2BAA2B;IACvC,UAAU,EAAE,sEAAsE;IAClF,YAAY,EACV,qFAAqF;QACrF,yEAAyE;IAC3E,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAA"}

package/dist/harness/langgraph.d.ts

@@ -0,0 +1,22 @@
+/**
+ * langgraph.ts — LangGraph adapter (env-file config, SDK-side gate).
+ *
+ * Writes the workspace .env.intutic file with proxy base-URL env vars so
+ * LangGraph's ChatOpenAI/ChatAnthropic clients route LLM calls through the
+ * Intutic proxy. Trace attribution comes from the `x-intutic-harness:
+ * langgraph` header the SDK sends (honoured by the proxy since 0583ef74).
+ *
+ * Unlike hook-based harnesses, LangGraph has NO on-disk config or hook file
+ * the sync daemon can write a tool-call gate into: tools are plain Python
+ * callables inside the agent's own process. The blocking gate ships SDK-side
+ * in `intutic-clawde` (`intutic_clawde.gate`, python-raise contract), which
+ * evaluates the policy snapshot + A3 SOP argPattern rules in-process before
+ * the tool body runs — so the env file this adapter writes also carries a
+ * comment block pointing developers at that gate.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const langgraphAdapter: IHarnessAdapter;
+//# sourceMappingURL=langgraph.d.ts.map

package/dist/harness/langgraph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../src/harness/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,gBAAgB,EAAE,eAqD9B,CAAA"}

package/dist/harness/langgraph.js

@@ -0,0 +1,80 @@
+/**
+ * langgraph.ts — LangGraph adapter (env-file config, SDK-side gate).
+ *
+ * Writes the workspace .env.intutic file with proxy base-URL env vars so
+ * LangGraph's ChatOpenAI/ChatAnthropic clients route LLM calls through the
+ * Intutic proxy. Trace attribution comes from the `x-intutic-harness:
+ * langgraph` header the SDK sends (honoured by the proxy since 0583ef74).
+ *
+ * Unlike hook-based harnesses, LangGraph has NO on-disk config or hook file
+ * the sync daemon can write a tool-call gate into: tools are plain Python
+ * callables inside the agent's own process. The blocking gate ships SDK-side
+ * in `intutic-clawde` (`intutic_clawde.gate`, python-raise contract), which
+ * evaluates the policy snapshot + A3 SOP argPattern rules in-process before
+ * the tool body runs — so the env file this adapter writes also carries a
+ * comment block pointing developers at that gate.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { join, dirname } from 'node:path';
+import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+import { newIso } from '@intutic/id';
+const CONFIG_FILE = '.env.intutic';
+/** Dependency manifests scanned for a langgraph/langchain dependency. */
+const MANIFEST_FILES = ['pyproject.toml', 'requirements.txt', 'uv.lock'];
+export const langgraphAdapter = {
+    type: HarnessType.LANGGRAPH,
+    configFileName: CONFIG_FILE,
+    async detect(workspaceRoot) {
+        for (const manifest of MANIFEST_FILES) {
+            try {
+                const content = await readFile(join(workspaceRoot, manifest), 'utf-8');
+                const lower = content.toLowerCase();
+                if (lower.includes('langgraph') || lower.includes('langchain'))
+                    return true;
+            }
+            catch { /* manifest not present */ }
+        }
+        return false;
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        const filePath = join(workspaceRoot, CONFIG_FILE);
+        const envContent = [
+            '# Intutic Governance Rules (auto-generated)',
+            '# DO NOT EDIT — managed by intutic sync daemon',
+            `# Last sync: ${newIso()}`,
+            '# Source this file: source .env.intutic',
+            '',
+            `export ANTHROPIC_BASE_URL="${proxyUrl}"`,
+            `export OPENAI_BASE_URL="${proxyUrl}"`,
+            `export INTUTIC_PROXY_URL="${proxyUrl}"`,
+            `export INTUTIC_SOP_COUNT=${sops.length}`,
+            '',
+            '# These env vars govern LLM egress only. LangGraph tools run in your own',
+            '# Python process, where no config or hook file can gate them — the',
+            '# blocking tool gate ships SDK-side:',
+            '#   pip install intutic-clawde',
+            '#   from intutic_clawde.gate import guard_tools',
+            '# guard_tools(tools) refuses denied calls by raising, before the tool',
+            '# body runs. See https://docs.intutic.ai/integrations/langgraph',
+            '',
+        ].join('\n');
+        await mkdir(dirname(filePath), { recursive: true });
+        const tmpEnv = filePath + '.intutic-tmp';
+        await writeFile(tmpEnv, envContent, 'utf-8');
+        await rename(tmpEnv, filePath);
+        return filePath;
+    },
+    async readCurrentHash(workspaceRoot) {
+        try {
+            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=langgraph.js.map

package/dist/harness/langgraph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../src/harness/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,yEAAyE;AACzE,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAA;AAExE,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;gBACtE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;gBACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,OAAO,IAAI,CAAA;YAC7E,CAAC;YAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,QAAQ,GAAG;YACzC,2BAA2B,QAAQ,GAAG;YACtC,6BAA6B,QAAQ,GAAG;YACxC,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;YACF,0EAA0E;YAC1E,oEAAoE;YACpE,sCAAsC;YACtC,gCAAgC;YAChC,iDAAiD;YACjD,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;QACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE9B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/mastra.d.ts

@@ -0,0 +1,21 @@
+/**
+ * mastra.ts — Mastra adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts's Python-side siblings (see
+ * jsSdkGatedAdapter.ts), but JS/TS-native: detected via `@mastra/core` in
+ * `package.json` (any version — the `beforeToolCall` hook this points at
+ * has been present since early 1.x), and points at
+ * `@intutic/gate/mastra`'s `intuticHooks()` rather than an `intutic-clawde`
+ * import.
+ *
+ * TAMPER NOTE: Mastra's per-call `hooks` option (passed to `.generate()`/
+ * `.stream()`) OVERRIDES agent-level hooks entirely rather than merging with
+ * them — a caller who passes their own `hooks` at call time silently
+ * disables this gate. See `@intutic/gate/mastra`'s module doc and
+ * `gateRegistry.ts`'s `mastra` NO_GATE row for the full, confirmed record.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const mastraAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=mastra.d.ts.map

package/dist/harness/mastra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mastra.d.ts","sourceRoot":"","sources":["../../src/harness/mastra.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,eAAO,MAAM,aAAa,sCAWxB,CAAA"}

package/dist/harness/mastra.js

@@ -0,0 +1,33 @@
+/**
+ * mastra.ts — Mastra adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts's Python-side siblings (see
+ * jsSdkGatedAdapter.ts), but JS/TS-native: detected via `@mastra/core` in
+ * `package.json` (any version — the `beforeToolCall` hook this points at
+ * has been present since early 1.x), and points at
+ * `@intutic/gate/mastra`'s `intuticHooks()` rather than an `intutic-clawde`
+ * import.
+ *
+ * TAMPER NOTE: Mastra's per-call `hooks` option (passed to `.generate()`/
+ * `.stream()`) OVERRIDES agent-level hooks entirely rather than merging with
+ * them — a caller who passes their own `hooks` at call time silently
+ * disables this gate. See `@intutic/gate/mastra`'s module doc and
+ * `gateRegistry.ts`'s `mastra` NO_GATE row for the full, confirmed record.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeJsSdkGatedAdapter } from './jsSdkGatedAdapter.js';
+export const mastraAdapter = makeJsSdkGatedAdapter({
+    type: HarnessType.MASTRA,
+    label: 'Mastra',
+    requires: [{ name: '@mastra/core' }],
+    npmInstall: '@intutic/gate',
+    importLine: "import { intuticHooks } from '@intutic/gate/mastra'",
+    usageSummary: "new Agent({ ..., hooks: intuticHooks() }) — Mastra's beforeToolCall veto point, run for " +
+        'every tool in the assembled tool dictionary (MCP-sourced tools included). NOTE: per-call ' +
+        '`hooks` on .generate()/.stream() OVERRIDE this, not merge with it — see the module doc.',
+    docsSlug: 'mastra',
+});
+//# sourceMappingURL=mastra.js.map

package/dist/harness/mastra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mastra.js","sourceRoot":"","sources":["../../src/harness/mastra.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;IACjD,IAAI,EAAE,WAAW,CAAC,MAAM;IACxB,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACpC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,qDAAqD;IACjE,YAAY,EACV,0FAA0F;QAC1F,2FAA2F;QAC3F,yFAAyF;IAC3F,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAA"}

package/dist/harness/muse.d.ts

@@ -0,0 +1,22 @@
+/**
+ * muse.ts — Meta "Muse Code" adapter (binary `muse`, model Muse Spark).
+ *
+ * Muse Code is a CLI harness, beta since 2026-08-05. Its rules/instructions
+ * file is `AGENTS.md` (it falls back to `CLAUDE.md` when that is absent) —
+ * this codebase has no dedicated "AGENTS.md content builder" of its own to
+ * reuse; the shared markdown content path every text-rules harness already
+ * uses (`buildMarkdownContent`, the same function Claude Code's `CLAUDE.md`
+ * adapter calls) is what gets reused here, so Muse does not grow a second
+ * rules format.
+ *
+ * The governance-critical half — the PreToolUse/PermissionRequest hook
+ * registration and the MCP `mcp_servers` proxy-wrap — is delegated to
+ * `@intutic/sync-daemon`'s `museHooks.ts`, the same split Goose's adapter
+ * uses for its plugin installation.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const museAdapter: IHarnessAdapter;
+//# sourceMappingURL=muse.d.ts.map

package/dist/harness/muse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"muse.d.ts","sourceRoot":"","sources":["../../src/harness/muse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAYjD,eAAO,MAAM,WAAW,EAAE,eA2DzB,CAAA"}

package/dist/harness/muse.js

@@ -0,0 +1,92 @@
+/**
+ * muse.ts — Meta "Muse Code" adapter (binary `muse`, model Muse Spark).
+ *
+ * Muse Code is a CLI harness, beta since 2026-08-05. Its rules/instructions
+ * file is `AGENTS.md` (it falls back to `CLAUDE.md` when that is absent) —
+ * this codebase has no dedicated "AGENTS.md content builder" of its own to
+ * reuse; the shared markdown content path every text-rules harness already
+ * uses (`buildMarkdownContent`, the same function Claude Code's `CLAUDE.md`
+ * adapter calls) is what gets reused here, so Muse does not grow a second
+ * rules format.
+ *
+ * The governance-critical half — the PreToolUse/PermissionRequest hook
+ * registration and the MCP `mcp_servers` proxy-wrap — is delegated to
+ * `@intutic/sync-daemon`'s `museHooks.ts`, the same split Goose's adapter
+ * uses for its plugin installation.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { join, dirname } from 'node:path';
+import { access, writeFile, rename, mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+import { buildMarkdownContent } from './base.js';
+import { writeMuseHooks } from '@intutic/sync-daemon/harness/museHooks';
+/** Workspace-relative rules file. Muse reads this, falling back to CLAUDE.md. */
+const CONFIG_FILE = 'AGENTS.md';
+/** `~/.config/muse/settings.json` — carries `schema_version`, `mcp_servers`,
+ *  and (once `museHooks.ts` has run) `managed_hooks_path`. */
+const MUSE_SETTINGS = join(homedir(), '.config', 'muse', 'settings.json');
+export const museAdapter = {
+    type: HarnessType.MUSE_CODE,
+    configFileName: CONFIG_FILE,
+    async detect(workspaceRoot) {
+        // 1. Project-local `.muse/` directory.
+        try {
+            await access(join(workspaceRoot, '.muse'));
+            return true;
+        }
+        catch { /* not here */ }
+        // 2. User-level settings.json — installed but never run in this workspace.
+        try {
+            await access(MUSE_SETTINGS);
+            return true;
+        }
+        catch { /* not here */ }
+        // 3. `muse` binary on PATH.
+        const pathDirs = (process.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':');
+        try {
+            const { accessSync } = await import('node:fs');
+            for (const dir of pathDirs) {
+                try {
+                    accessSync(join(dir, 'muse'));
+                    return true;
+                }
+                catch { /* not here */ }
+            }
+        }
+        catch { /* ignore */ }
+        return false;
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        const agentsPath = join(workspaceRoot, CONFIG_FILE);
+        // 1. AGENTS.md rules file — same "skip when there is nothing to write"
+        //    convention `createMarkdownAdapter` uses; unlike Goose, Muse DOES
+        //    have a rules file, so sops are not ignored here.
+        if (sops.length > 0) {
+            const content = buildMarkdownContent(sops, proxyUrl);
+            await mkdir(dirname(agentsPath), { recursive: true });
+            const tmp = agentsPath + '.intutic-tmp';
+            await writeFile(tmp, content, 'utf-8');
+            await rename(tmp, agentsPath);
+        }
+        // 2. PreToolUse/PermissionRequest hooks (project .muse/hooks.json +
+        //    managed_hooks_path merge into ~/.config/muse/settings.json).
+        //    `intutic connect` has no workspace id in scope — same limitation
+        //    `gooseAdapter` has — the sync daemon re-runs this with a real one
+        //    on the next cycle.
+        await writeMuseHooks(workspaceRoot, proxyUrl, '');
+        return agentsPath;
+    },
+    async readCurrentHash(workspaceRoot) {
+        try {
+            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=muse.js.map

package/dist/harness/muse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"muse.js","sourceRoot":"","sources":["../../src/harness/muse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAA;AAEvE,iFAAiF;AACjF,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B;8DAC8D;AAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAE1B,2EAA2E;QAC3E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAE1B,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEnD,uEAAuE;QACvE,sEAAsE;QACtE,sDAAsD;QACtD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;YACvC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACtC,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/B,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,cAAc,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAEjD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/n8n.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"n8n.d.ts","sourceRoot":"","sources":["../../src/harness/n8n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkBjD,eAAO,MAAM,UAAU,EAAE,eAuGxB,CAAA"}
+{"version":3,"file":"n8n.d.ts","sourceRoot":"","sources":["../../src/harness/n8n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAwEjD,eAAO,MAAM,UAAU,EAAE,eAoIxB,CAAA"}

package/dist/harness/n8n.js

@@ -60,6 +60,7 @@ export const n8nAdapter = {
                 return 'n8n:no_workflows';
             }
             // 2. Inject parameters into variables of each workflow
+            let updated = 0;
             for (const w of workflows) {
                 const detailRes = await fetch(`${n8nUrl}/api/v1/workflows/${w.id}`, {
                     headers: getHeaders(),
@@ -68,22 +69,46 @@ export const n8nAdapter = {
                 if (!detailRes.ok)
                     continue;
                 const detail = (await detailRes.json());
-                const settings = detail.settings || {};
-                const variables = settings.variables || {};
-                // Inject Intutic values
-                variables.intutic_proxy_url = proxyUrl;
-                variables.intutic_governance_rules = sopsMarkdown;
-                settings.variables = variables;
-                detail.settings = settings;
+                // Inject Intutic values, preserving the workflow's own settings and
+                // any variables it already had.
+                const settings = {
+                    ...detail.settings,
+                    variables: {
+                        ...detail.settings?.variables,
+                        intutic_proxy_url: proxyUrl,
+                        intutic_governance_rules: sopsMarkdown,
+                    },
+                };
+                // Only the writable fields — see N8nWorkflowUpdateBody. Echoing the
+                // whole GET payload back (which is what this used to do) is rejected
+                // by the API's additionalProperties check.
+                const body = {
+                    name: detail.name ?? w.name ?? 'Untitled',
+                    nodes: detail.nodes ?? [],
+                    connections: detail.connections ?? {},
+                    settings,
+                };
+                if (detail.staticData !== undefined) {
+                    body.staticData = detail.staticData;
+                }
                 // Save updated workflow
-                await fetch(`${n8nUrl}/api/v1/workflows/${w.id}`, {
+                const updateRes = await fetch(`${n8nUrl}/api/v1/workflows/${w.id}`, {
                     method: 'PUT',
                     headers: getHeaders(),
-                    body: JSON.stringify(detail),
+                    body: JSON.stringify(body),
                     signal: AbortSignal.timeout(5000),
                 });
+                if (!updateRes.ok) {
+                    console.warn(`[n8n-adapter] workflow ${w.id} was not updated: HTTP ${updateRes.status} ${updateRes.statusText}`);
+                    continue;
+                }
+                updated++;
             }
-            return `n8n:${workflows.length}_workflows`;
+            // Reporting a write that every workflow rejected as a success left the
+            // sync daemon recording a config version it had never applied.
+            if (updated === 0)
+                return null;
+            return `n8n:${updated}_workflows`;
         }
         catch (err) {
             console.warn(`[n8n-adapter] failed to sync parameters:`, err);
@@ -112,7 +137,7 @@ export const n8nAdapter = {
             if (!detailRes.ok)
                 return null;
             const detail = (await detailRes.json());
-            const rules = detail.settings?.variables?.intutic_governance_rules || '';
+            const rules = detail.settings?.variables?.intutic_governance_rules ?? '';
             if (!rules)
                 return null;
             return createHash('sha256').update(rules, 'utf-8').digest('hex');

package/dist/harness/n8n.js.map

@@ -1 +1 @@
-{"version":3,"file":"n8n.js","sourceRoot":"","sources":["../../src/harness/n8n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,iCAAiC;AACjC,SAAS,iBAAiB,CAAC,IAAoB;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAA;AAC1F,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAA;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;IACtD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC,IAAI,EAAE,WAAW,CAAC,GAAG;IACrB,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACzF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,IAAoB,EAAE,QAAgB;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAE5C,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;gBACxD,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;YACpE,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAmD,CAAA;YACzF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;YAErC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,kBAAkB,CAAA;YAC3B,CAAC;YAED,uDAAuD;YACvD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE;oBAClE,OAAO,EAAE,UAAU,EAAE;oBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;iBAClC,CAAC,CAAA;gBAEF,IAAI,CAAC,SAAS,CAAC,EAAE;oBAAE,SAAQ;gBAE3B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAQ,CAAA;gBAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;gBACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;gBAE1C,wBAAwB;gBACxB,SAAS,CAAC,iBAAiB,GAAG,QAAQ,CAAA;gBACtC,SAAS,CAAC,wBAAwB,GAAG,YAAY,CAAA;gBACjD,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;gBAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;gBAE1B,wBAAwB;gBACxB,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE;oBAChD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,UAAU,EAAE;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;oBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,OAAO,SAAS,CAAC,MAAM,YAAY,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;gBACxD,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAE5B,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAqC,CAAA;YAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;YACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvC,2DAA2D;YAC3D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,OAAO,EAAE,EAAE;gBACrE,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAE9B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAQ,CAAA;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,wBAAwB,IAAI,EAAE,CAAA;YACxE,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"n8n.js","sourceRoot":"","sources":["../../src/harness/n8n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AA0DnD,iCAAiC;AACjC,SAAS,iBAAiB,CAAC,IAAoB;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAA;AAC1F,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAA;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;IACtD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC,IAAI,EAAE,WAAW,CAAC,GAAG;IACrB,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACzF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,IAAoB,EAAE,QAAgB;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAE5C,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;gBACxD,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;YACpE,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAA;YAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;YAErC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,kBAAkB,CAAA;YAC3B,CAAC;YAED,uDAAuD;YACvD,IAAI,OAAO,GAAG,CAAC,CAAA;YACf,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE;oBAClE,OAAO,EAAE,UAAU,EAAE;oBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;iBAClC,CAAC,CAAA;gBAEF,IAAI,CAAC,SAAS,CAAC,EAAE;oBAAE,SAAQ;gBAE3B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAsB,CAAA;gBAE5D,oEAAoE;gBACpE,gCAAgC;gBAChC,MAAM,QAAQ,GAAwB;oBACpC,GAAG,MAAM,CAAC,QAAQ;oBAClB,SAAS,EAAE;wBACT,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,wBAAwB,EAAE,YAAY;qBACvC;iBACF,CAAA;gBAED,oEAAoE;gBACpE,qEAAqE;gBACrE,2CAA2C;gBAC3C,MAAM,IAAI,GAA0B;oBAClC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,UAAU;oBACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;oBACrC,QAAQ;iBACT,CAAA;gBACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;gBACrC,CAAC;gBAED,wBAAwB;gBACxB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE;oBAClE,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,UAAU,EAAE;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;iBAClC,CAAC,CAAA;gBAEF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CACV,0BAA0B,CAAC,CAAC,EAAE,0BAA0B,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,CACnG,CAAA;oBACD,SAAQ;gBACV,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC;YAED,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAE9B,OAAO,OAAO,OAAO,YAAY,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;gBACxD,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAE5B,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAA;YAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;YACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvC,2DAA2D;YAC3D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,OAAO,EAAE,EAAE;gBACrE,OAAO,EAAE,UAAU,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YAEF,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YAE9B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAsB,CAAA;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,wBAAwB,IAAI,EAAE,CAAA;YACxE,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}