@intutic/cli 1.10.1 → 2.1.0

package/dist/harness/agentFramework.js

@@ -0,0 +1,37 @@
+/**
+ * agentFramework.ts — Microsoft Agent Framework adapter (env-file config,
+ * SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Agent Framework (the
+ * AutoGen + Semantic Kernel successor, `agent-framework` /
+ * `agent-framework-core` on PyPI, imported as `agent_framework`) is a separate
+ * framework from AutoGen (autogen.ts), so it has its own adapter (TD-375).
+ * Its tools run in the agent's own Python process, so the blocking gate ships
+ * SDK-side via
+ * `intutic_clawde.gate.adapters.agent_framework.IntuticFunctionMiddleware`, a
+ * `FunctionMiddleware` that skips `call_next()` on a deny (verified live
+ * against agent-framework-core==1.20.0).
+ *
+ * "agent-framework" is a generic phrase, so detection anchors the start of the
+ * name: it must not follow a letter, digit, `-`, `_` or `.`. That matches
+ * `agent-framework`, `agent-framework-core`, `agent-framework-openai` and the
+ * `agent_framework` spelling, but not some other project's
+ * `my-agent-framework`.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+const AGENT_FRAMEWORK_TOKEN = /(?:^|[^a-z0-9_.-])agent[-_]framework(?![a-z0-9])/m;
+export const agentFrameworkAdapter = makeSdkGatedAdapter({
+    type: HarnessType.AGENT_FRAMEWORK,
+    label: 'Microsoft Agent Framework',
+    keywords: [AGENT_FRAMEWORK_TOKEN],
+    pipInstall: 'intutic-clawde[agent-framework]',
+    importLine: 'from intutic_clawde.gate.adapters.agent_framework import IntuticFunctionMiddleware',
+    usageSummary: 'Agent(middleware=[IntuticFunctionMiddleware()]) skips call_next() on a denied tool call, ' +
+        'so the tool never runs and the model receives the refusal as the tool result.',
+    docsSlug: 'microsoft-agent-framework',
+});
+//# sourceMappingURL=agentFramework.js.map

package/dist/harness/agentFramework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentFramework.js","sourceRoot":"","sources":["../../src/harness/agentFramework.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAEjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;IACvD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,2BAA2B;IAClC,QAAQ,EAAE,CAAC,qBAAqB,CAAC;IACjC,UAAU,EAAE,iCAAiC;IAC7C,UAAU,EAAE,oFAAoF;IAChG,YAAY,EACV,2FAA2F;QAC3F,+EAA+E;IACjF,QAAQ,EAAE,2BAA2B;CACtC,CAAC,CAAA"}

package/dist/harness/agentcore.d.ts

@@ -40,9 +40,12 @@
  *    commands write (confirmed via `bedrock_agentcore_starter_toolkit/cli/
  *    runtime/_configure_impl.py` and every other CLI subcommand module that
  *    reads it).
- * 5. `agentcore/agentcore.json` or `aws-targets.json` at the workspace root —
- *    the config files the npm `@aws/agentcore` CLI writes (confirmed via the
- *    literal strings in the published `dist/cli/index.mjs` bundle).
+ * 5. `agentcore/agentcore.json` or `agentcore/aws-targets.json` — the config
+ *    files the npm `@aws/agentcore` CLI writes. Both live in the project's
+ *    `agentcore/` directory, not at the root: confirmed by running
+ *    `agentcore create` (0.31.1) offline with no AWS credentials, whose real
+ *    output is vendored in `__fixtures__/agentcore-cli-0.31.1/`, and by the
+ *    `${root}/agentcore/aws-targets.json` paths in the 0.27.0 bundle.
  *
  * No ReDoS surface: every check below is a plain substring/property test
  * over locally-read files, never a regex over untrusted network input.

package/dist/harness/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAiDjD,eAAO,MAAM,gBAAgB,EAAE,eAuB9B,CAAA"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAiDjD,eAAO,MAAM,gBAAgB,EAAE,eAuB9B,CAAA"}

package/dist/harness/agentcore.js

@@ -40,9 +40,12 @@
  *    commands write (confirmed via `bedrock_agentcore_starter_toolkit/cli/
  *    runtime/_configure_impl.py` and every other CLI subcommand module that
  *    reads it).
- * 5. `agentcore/agentcore.json` or `aws-targets.json` at the workspace root —
- *    the config files the npm `@aws/agentcore` CLI writes (confirmed via the
- *    literal strings in the published `dist/cli/index.mjs` bundle).
+ * 5. `agentcore/agentcore.json` or `agentcore/aws-targets.json` — the config
+ *    files the npm `@aws/agentcore` CLI writes. Both live in the project's
+ *    `agentcore/` directory, not at the root: confirmed by running
+ *    `agentcore create` (0.31.1) offline with no AWS credentials, whose real
+ *    output is vendored in `__fixtures__/agentcore-cli-0.31.1/`, and by the
+ *    `${root}/agentcore/aws-targets.json` paths in the 0.27.0 bundle.
  *
  * No ReDoS surface: every check below is a plain substring/property test
  * over locally-read files, never a regex over untrusted network input.
@@ -56,7 +59,7 @@ import { HarnessType } from '@intutic/shared-types';
 /** Python manifests scanned for the SDK/toolkit package names. */
 const PYTHON_MANIFESTS = ['pyproject.toml', 'requirements.txt', 'uv.lock'];
 /** Config files the `agentcore` CLIs (npm + Python starter toolkit) write. */
-const CONFIG_FILE_SIGNALS = ['.bedrock_agentcore.yaml', 'agentcore/agentcore.json', 'aws-targets.json'];
+const CONFIG_FILE_SIGNALS = ['.bedrock_agentcore.yaml', 'agentcore/agentcore.json', 'agentcore/aws-targets.json'];
 async function hasAnyConfigFile(workspaceRoot) {
     for (const rel of CONFIG_FILE_SIGNALS) {
         try {

package/dist/harness/agentcore.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAEnF,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,kBAAkB,CAAU,CAAA;AAEhH,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IACnD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC1D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACtF,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAA;QACpG,OAAO,mBAAmB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,iBAAiB;IACnC,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACtD,IAAI,MAAM,uBAAuB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7D,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2DAA2D;IAC3D,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}
+{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAEnF,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,4BAA4B,CAAU,CAAA;AAE1H,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IACnD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC1D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACtF,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAA;QACpG,OAAO,mBAAmB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,iBAAiB;IACnC,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACtD,IAAI,MAAM,uBAAuB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7D,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2DAA2D;IAC3D,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}

package/dist/harness/aiSdkHarness.d.ts

@@ -10,7 +10,7 @@
  * framework, hence `requiresAnyPrefix` rather than a single required package.
  *
  * TWO DOCUMENTED LIMITATIONS carried into the generated `.env.intutic`
- * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types — see
+ * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types, re-read on 1.0.138 — see
  * `@intutic/gate/harness`'s module doc for the full record):
  *
  *   1. Tool execution is SERVER-SIDE, in Vercel Sandbox microVMs — the

package/dist/harness/aiSdkHarness.js

@@ -10,7 +10,7 @@
  * framework, hence `requiresAnyPrefix` rather than a single required package.
  *
  * TWO DOCUMENTED LIMITATIONS carried into the generated `.env.intutic`
- * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types — see
+ * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types, re-read on 1.0.138 — see
  * `@intutic/gate/harness`'s module doc for the full record):
  *
  *   1. Tool execution is SERVER-SIDE, in Vercel Sandbox microVMs — the

package/dist/harness/aiSdkWorkflow.d.ts

@@ -13,7 +13,7 @@
  * with both declares `@ai-sdk/workflow` anyway, which is the trigger.
  *
  * DOCUMENTED SEMANTICS carried into the generated `.env.intutic` (confirmed
- * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3` — see
+ * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3`, re-verified on 2.0.58 + 5.0.1 — see
  * `@intutic/gate/workflow`'s module doc for the full record): WorkflowAgent
  * has no agent-level approval option; the veto surface is per-tool
  * `needsApproval`, and a refusal thrown from it must be FatalError-compatible

package/dist/harness/aiSdkWorkflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiSdkWorkflow.d.ts","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,oBAAoB,sCAY/B,CAAA"}
+{"version":3,"file":"aiSdkWorkflow.d.ts","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,oBAAoB,sCAc/B,CAAA"}

package/dist/harness/aiSdkWorkflow.js

@@ -13,7 +13,7 @@
  * with both declares `@ai-sdk/workflow` anyway, which is the trigger.
  *
  * DOCUMENTED SEMANTICS carried into the generated `.env.intutic` (confirmed
- * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3` — see
+ * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3`, re-verified on 2.0.58 + 5.0.1 — see
  * `@intutic/gate/workflow`'s module doc for the full record): WorkflowAgent
  * has no agent-level approval option; the veto surface is per-tool
  * `needsApproval`, and a refusal thrown from it must be FatalError-compatible
@@ -29,8 +29,10 @@ export const aiSdkWorkflowAdapter = makeJsSdkGatedAdapter({
     label: 'AI SDK Workflow',
     requires: [{ name: '@ai-sdk/workflow' }],
     npmInstall: '@intutic/gate',
-    importLine: "import { intuticNeedsApproval, withIntuticApproval } from '@intutic/gate/workflow'",
-    usageSummary: 'new WorkflowAgent({ ..., tools: withIntuticApproval(tools) }) — attaches an async needsApproval ' +
+    importLine: "import { intuticApprovalStep, withIntuticApproval } from '@intutic/gate/workflow'",
+    usageSummary: 'new WorkflowAgent({ ..., tools: withIntuticApproval(tools, { step: intuticGate }) }), where ' +
+        "intuticGate is your own \"use step\" function returning intuticApprovalStep(toolName, input, { gate }) " +
+        '(needsApproval runs in the workflow sandbox, which has no Node.js). Attaches an async needsApproval ' +
         'per tool (WorkflowAgent itself has no approval option). BLOCK throws a FatalError-compatible ' +
         'refusal so the durable runtime aborts instead of retry-looping the denial; ALLOW resolves ' +
         "false (or true with { onAllow: 'human' } to keep the durable human-approval pause).",

package/dist/harness/aiSdkWorkflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"aiSdkWorkflow.js","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;IACxD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACxC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,oFAAoF;IAChG,YAAY,EACV,kGAAkG;QAClG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;IACvF,QAAQ,EAAE,iBAAiB;CAC5B,CAAC,CAAA"}
+{"version":3,"file":"aiSdkWorkflow.js","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;IACxD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACxC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,mFAAmF;IAC/F,YAAY,EACV,8FAA8F;QAC9F,yGAAyG;QACzG,sGAAsG;QACtG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;IACvF,QAAQ,EAAE,iBAAiB;CAC5B,CAAC,CAAA"}

package/dist/harness/aider.d.ts

@@ -1,9 +1,10 @@
 /**
  * aider.ts — Aider adapter (full implementation with safe YAML merge).
  *
- * Writes SOP content into .aider.conf.yml using the aiderConfigMerger
- * which safely merges proxy keys and strips dangerous auto-exec keys
- * (test-cmd, lint-cmd) that Aider auto-executes on startup.
+ * Merges proxy routing into .aider.conf.yml using the aiderConfigMerger,
+ * which keeps the user's own keys, strips dangerous auto-exec keys
+ * (test-cmd, lint-cmd) that Aider auto-executes on startup, and lists the
+ * SOP text as a read-only context file (.intutic/aider-sops.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/aider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,YAAY,EAAE,eAiC1B,CAAA"}
+{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,YAAY,EAAE,eAiC1B,CAAA"}

package/dist/harness/aider.js

@@ -1,9 +1,10 @@
 /**
  * aider.ts — Aider adapter (full implementation with safe YAML merge).
  *
- * Writes SOP content into .aider.conf.yml using the aiderConfigMerger
- * which safely merges proxy keys and strips dangerous auto-exec keys
- * (test-cmd, lint-cmd) that Aider auto-executes on startup.
+ * Merges proxy routing into .aider.conf.yml using the aiderConfigMerger,
+ * which keeps the user's own keys, strips dangerous auto-exec keys
+ * (test-cmd, lint-cmd) that Aider auto-executes on startup, and lists the
+ * SOP text as a read-only context file (.intutic/aider-sops.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -32,9 +33,9 @@ export const aiderAdapter = {
             ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
             : undefined;
         // Safe merge: strips test-cmd/lint-cmd, preserves all other user keys,
-        // injects proxy URL as openai-api-base and anthropic-api-base
-        await mergeAiderConfig(filePath, proxyUrl, sopsText);
-        return filePath;
+        // routes OpenAI (openai-api-base) and Anthropic (set-env) models through
+        // the proxy and lists the SOPs as a read-only context file.
+        return (await mergeAiderConfig(filePath, proxyUrl, sopsText)) ? filePath : null;
     },
     async readCurrentHash(workspaceRoot) {
         try {

package/dist/harness/aider.js.map

@@ -1 +1 @@
-{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAA;AAEjF,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAA;QAEb,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACpD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAA;AAEjF,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAA;QAEb,uEAAuE;QACvE,yEAAyE;QACzE,4DAA4D;QAC5D,OAAO,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/antigravity.d.ts

@@ -1,8 +1,10 @@
 /**
  * Antigravity adapter — .gemini/settings.json
  *
- * Merges SOP content into the customInstructions field of the
- * Gemini settings JSON file.
+ * Merges SOP content into the customInstructions field of the workspace's
+ * Gemini settings JSON file, and installs the Gemini CLI `BeforeTool` gate in
+ * `~/.gemini/settings.json` (see antigravityHooks.ts). A settings file that is
+ * not a plain JSON object is left alone and reported.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/antigravity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.d.ts","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,kBAAkB,EAAE,eAsDhC,CAAA"}
+{"version":3,"file":"antigravity.d.ts","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,kBAAkB,EAAE,eAqDhC,CAAA"}

package/dist/harness/antigravity.js

@@ -1,18 +1,22 @@
 /**
  * Antigravity adapter — .gemini/settings.json
  *
- * Merges SOP content into the customInstructions field of the
- * Gemini settings JSON file.
+ * Merges SOP content into the customInstructions field of the workspace's
+ * Gemini settings JSON file, and installs the Gemini CLI `BeforeTool` gate in
+ * `~/.gemini/settings.json` (see antigravityHooks.ts). A settings file that is
+ * not a plain JSON object is left alone and reported.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
 import { join } from 'node:path';
-import { access, readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { access, writeFile, rename, mkdir } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
 import { newIso } from '@intutic/id';
+import { loadCredentials } from '../config/store.js';
+import { readJsonObjectForMerge, writeAntigravityHooks } from '@intutic/sync-daemon';
 const CONFIG_FILE = '.gemini/settings.json';
 export const antigravityAdapter = {
     type: HarnessType.ANTIGRAVITY,
@@ -27,19 +31,17 @@ export const antigravityAdapter = {
         }
     },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
+        // The gate is installed even with zero SOPs: it is what refuses tool
+        // calls, and the built-in protections apply without any SOP.
+        const creds = await loadCredentials();
+        await writeAntigravityHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
         if (sops.length === 0)
             return null;
         const filePath = join(workspaceRoot, CONFIG_FILE);
         const tmpPath = filePath + '.intutic-tmp';
-        // Read existing settings or start fresh
-        let settings = {};
-        try {
-            const existing = await readFile(filePath, 'utf-8');
-            settings = JSON.parse(existing);
-        }
-        catch {
-            // No existing file — start fresh
-        }
+        const settings = await readJsonObjectForMerge(filePath);
+        if (settings === null)
+            return null;
         // Merge governance instructions
         const instructions = sops
             .map((sop) => `## ${sop.title}\n\n${sop.content}`)

package/dist/harness/antigravity.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,wCAAwC;QACxC,IAAI,QAAQ,GAA4B,EAAE,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,QAAQ,CAAC,kBAAkB,GAAG;YAC5B,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAEpF,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,qBAAqB,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAEnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAElC,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,QAAQ,CAAC,kBAAkB,GAAG;YAC5B,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/cline.d.ts

@@ -1,9 +1,15 @@
 /**
- * cline.ts — Cline adapter (full implementation).
+ * cline.ts — Cline adapter.
  *
- * Detects the Cline VS Code extension, writes Intutic governance rules
- * as .clinerules (flat file), injects the PreToolUse blocking hook into .cline/hooks/,
- * and configures the proxy base URL via VS Code settings + .env.intutic sidecar.
+ * Detects the Cline VS Code extension, writes Intutic governance rules to
+ * `.clinerules/intutic-governance.md` and installs the PreToolUse gate at
+ * `.clinerules/hooks/PreToolUse` (see clineHooks.ts — `.clinerules` is a
+ * directory so both fit; a flat `.clinerules` an earlier version wrote is
+ * converted, one the user wrote is left alone).
+ *
+ * Cline keeps its API provider and base URL in its own settings panel, not in
+ * any file this adapter can write, so routing Cline through the proxy is a
+ * manual step (see the Cline integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/cline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}

package/dist/harness/cline.js

@@ -1,29 +1,35 @@
 /**
- * cline.ts — Cline adapter (full implementation).
+ * cline.ts — Cline adapter.
  *
- * Detects the Cline VS Code extension, writes Intutic governance rules
- * as .clinerules (flat file), injects the PreToolUse blocking hook into .cline/hooks/,
- * and configures the proxy base URL via VS Code settings + .env.intutic sidecar.
+ * Detects the Cline VS Code extension, writes Intutic governance rules to
+ * `.clinerules/intutic-governance.md` and installs the PreToolUse gate at
+ * `.clinerules/hooks/PreToolUse` (see clineHooks.ts — `.clinerules` is a
+ * directory so both fit; a flat `.clinerules` an earlier version wrote is
+ * converted, one the user wrote is left alone).
+ *
+ * Cline keeps its API provider and base URL in its own settings panel, not in
+ * any file this adapter can write, so routing Cline through the proxy is a
+ * manual step (see the Cline integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
-import { access, readdir, writeFile, rename, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
+import { access, readdir, writeFile, rename } from 'node:fs/promises';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
+import { loadCredentials } from '../config/store.js';
 import { newIso } from '@intutic/id';
-import { writeClineHooks } from '@intutic/sync-daemon/harness/clineHooks';
-import { injectClineProxySettings } from './vscodeSettingsWriter.js';
-const CONFIG_FILE = '.clinerules';
+import { writeClineHooks, ensureClinerulesDirectory } from '@intutic/sync-daemon/harness/clineHooks';
+const CONFIG_FILE = '.clinerules/intutic-governance.md';
 export const clineAdapter = {
     type: HarnessType.CLINE,
     configFileName: CONFIG_FILE,
     async detect(workspaceRoot) {
-        // Check for .clinerules in workspace
+        // Check for .clinerules (file or directory) in workspace
         try {
-            await access(join(workspaceRoot, CONFIG_FILE));
+            await access(join(workspaceRoot, '.clinerules'));
             return true;
         }
         catch {
@@ -40,27 +46,28 @@ export const clineAdapter = {
         }
     },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // 1. Write .clinerules text rules
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const instructions = sops.length > 0
-            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
-            : '# Intutic governance active — no SOP rules configured yet.';
-        const content = [
-            '# Intutic Governance Rules (auto-generated)',
-            '# DO NOT EDIT — managed by intutic sync daemon',
-            `# Last sync: ${newIso()}`,
-            '',
-            instructions,
-            '',
-        ].join('\n');
-        await mkdir(dirname(filePath), { recursive: true });
-        const tmp = filePath + '.intutic-tmp';
-        await writeFile(tmp, content, 'utf-8');
-        await rename(tmp, filePath);
-        // 2. Write PreToolUse blocking hooks into .cline/hooks/
-        await writeClineHooks(workspaceRoot, proxyUrl);
-        // 3. Inject proxy URL into VS Code settings + .env.intutic sidecar
-        await injectClineProxySettings(workspaceRoot, proxyUrl);
+        // 1. Rules, as one file in the .clinerules directory Cline reads.
+        let filePath = null;
+        if (await ensureClinerulesDirectory(workspaceRoot)) {
+            filePath = join(workspaceRoot, CONFIG_FILE);
+            const instructions = sops.length > 0
+                ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
+                : '# Intutic governance active — no SOP rules configured yet.';
+            const content = [
+                '# Intutic Governance Rules (auto-generated)',
+                '# DO NOT EDIT — managed by intutic sync daemon',
+                `# Last sync: ${newIso()}`,
+                '',
+                instructions,
+                '',
+            ].join('\n');
+            const tmp = filePath + '.intutic-tmp';
+            await writeFile(tmp, content, 'utf-8');
+            await rename(tmp, filePath);
+        }
+        // 2. The PreToolUse gate in .clinerules/hooks/.
+        const creds = await loadCredentials();
+        await writeClineHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
         return filePath;
     },
     async readCurrentHash(workspaceRoot) {

package/dist/harness/cline.js.map

@@ -1 +1 @@
-{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AAEpE,MAAM,WAAW,GAAG,aAAa,CAAA;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,4DAA4D,CAAA;QAEhE,MAAM,OAAO,GAAG;YACd,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,EAAE;YACF,YAAY;YACZ,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;QACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAE3B,wDAAwD;QACxD,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAE9C,mEAAmE;QACnE,MAAM,wBAAwB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAEvD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAA;AAEpG,MAAM,WAAW,GAAG,mCAAmC,CAAA;AAEvD,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,kEAAkE;QAClE,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,IAAI,MAAM,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC5E,CAAC,CAAC,4DAA4D,CAAA;YAEhE,MAAM,OAAO,GAAG;gBACd,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,EAAE;gBACF,YAAY;gBACZ,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;YACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE7E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/codex.d.ts

@@ -1,9 +1,15 @@
 /**
- * codex.ts — Codex adapter (updated: also writes ~/.codex/config.toml).
+ * codex.ts — Codex adapter.
  *
- * In addition to the workspace .env.intutic file, writes
- * ~/.codex/config.toml with model_providers.litellm.base_url so Codex
- * routes LLM calls through the Intutic proxy even without env var sourcing.
+ * Writes three things:
+ * - `.env.intutic` in the workspace, with the proxy base URLs for shells and
+ *   scripts that source it;
+ * - `openai_base_url` in Codex's user config (`$CODEX_HOME/config.toml`,
+ *   `~/.codex/config.toml` by default), merged into the user's file, so Codex
+ *   routes LLM calls through the proxy without sourcing anything — see
+ *   codexConfigMerger.ts;
+ * - the PreToolUse gate, registered in `~/.codex/hooks.json` and the
+ *   project's `.codex/hooks.json` — see codexHooks.ts.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,YAAY,EAAE,eAkE1B,CAAA"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAcjD,eAAO,MAAM,YAAY,EAAE,eAwD1B,CAAA"}

package/dist/harness/codex.js

@@ -1,9 +1,15 @@
 /**
- * codex.ts — Codex adapter (updated: also writes ~/.codex/config.toml).
+ * codex.ts — Codex adapter.
  *
- * In addition to the workspace .env.intutic file, writes
- * ~/.codex/config.toml with model_providers.litellm.base_url so Codex
- * routes LLM calls through the Intutic proxy even without env var sourcing.
+ * Writes three things:
+ * - `.env.intutic` in the workspace, with the proxy base URLs for shells and
+ *   scripts that source it;
+ * - `openai_base_url` in Codex's user config (`$CODEX_HOME/config.toml`,
+ *   `~/.codex/config.toml` by default), merged into the user's file, so Codex
+ *   routes LLM calls through the proxy without sourcing anything — see
+ *   codexConfigMerger.ts;
+ * - the PreToolUse gate, registered in `~/.codex/hooks.json` and the
+ *   project's `.codex/hooks.json` — see codexHooks.ts.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -11,11 +17,17 @@
 import { join, dirname } from 'node:path';
 import { writeFile, rename, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { HarnessType } from '@intutic/shared-types';
+import { HarnessType, anthropicBaseUrl, openaiBaseUrl, proxyHost } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
+import { loadCredentials } from '../config/store.js';
 import { newIso } from '@intutic/id';
+import { writeCodexHooks, mergeCodexConfig } from '@intutic/sync-daemon';
 const CONFIG_FILE = '.env.intutic';
-const CODEX_CONFIG = join(homedir(), '.codex', 'config.toml');
+/** Codex's user config directory, resolved at call time so CODEX_HOME and
+ *  HOME changes (and tests that move them) are honoured. */
+function codexHome() {
+    return process.env.CODEX_HOME || join(homedir(), '.codex');
+}
 export const codexAdapter = {
     type: HarnessType.CODEX,
     configFileName: CONFIG_FILE,
@@ -45,9 +57,9 @@ export const codexAdapter = {
             `# Last sync: ${newIso()}`,
             '# Source this file: source .env.intutic',
             '',
-            `export ANTHROPIC_BASE_URL="${proxyUrl}"`,
-            `export OPENAI_BASE_URL="${proxyUrl}"`,
-            `export INTUTIC_PROXY_URL="${proxyUrl}"`,
+            `export ANTHROPIC_BASE_URL="${anthropicBaseUrl(proxyUrl)}"`,
+            `export OPENAI_BASE_URL="${openaiBaseUrl(proxyUrl)}"`,
+            `export INTUTIC_PROXY_URL="${proxyHost(proxyUrl)}"`,
             `export INTUTIC_SOP_COUNT=${sops.length}`,
             '',
         ].join('\n');
@@ -55,23 +67,13 @@ export const codexAdapter = {
         const tmpEnv = filePath + '.intutic-tmp';
         await writeFile(tmpEnv, envContent, 'utf-8');
         await rename(tmpEnv, filePath);
-        // 2. ~/.codex/config.toml — persists proxy across sessions without env sourcing
-        const codexToml = [
-            '# Intutic proxy config (auto-generated)',
-            '# DO NOT EDIT — managed by intutic sync daemon',
-            `# Last sync: ${newIso()}`,
-            '',
-            '[model_providers.litellm]',
-            `base_url = "${proxyUrl}"`,
-            '',
-            '[model_providers.openai]',
-            `base_url = "${proxyUrl}"`,
-            '',
-        ].join('\n');
-        await mkdir(dirname(CODEX_CONFIG), { recursive: true });
-        const tmpToml = CODEX_CONFIG + '.intutic-tmp';
-        await writeFile(tmpToml, codexToml, 'utf-8');
-        await rename(tmpToml, CODEX_CONFIG);
+        // 2. Codex user config — persists proxy routing across sessions without
+        //    env sourcing. Merged; a config.toml that does not parse is left alone.
+        await mergeCodexConfig(join(codexHome(), 'config.toml'), openaiBaseUrl(proxyUrl));
+        // 3. The PreToolUse gate. The routing above governs LLM egress only; the
+        //    gate is what refuses tool calls.
+        const creds = await loadCredentials();
+        await writeCodexHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
         return filePath;
     },
     async readCurrentHash(workspaceRoot) {

package/dist/harness/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAClC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,QAAQ,GAAG;YACzC,2BAA2B,QAAQ,GAAG;YACtC,6BAA6B,QAAQ,GAAG;YACxC,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;QACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE9B,gFAAgF;QAChF,MAAM,SAAS,GAAG;YAChB,yCAAyC;YACzC,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,EAAE;YACF,2BAA2B;YAC3B,eAAe,QAAQ,GAAG;YAC1B,EAAE;YACF,0BAA0B;YAC1B,eAAe,QAAQ,GAAG;YAC1B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,YAAY,GAAG,cAAc,CAAA;QAC7C,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QAEnC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAG/F,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAExE,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC;4DAC4D;AAC5D,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,gBAAgB,CAAC,QAAQ,CAAC,GAAG;YAC3D,2BAA2B,aAAa,CAAC,QAAQ,CAAC,GAAG;YACrD,6BAA6B,SAAS,CAAC,QAAQ,CAAC,GAAG;YACnD,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;QACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE9B,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEjF,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE7E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/continue.d.ts

@@ -1,10 +1,13 @@
 /**
- * continue.ts — Continue adapter (proxy URL injection).
+ * continue.ts — Continue adapter.
  *
- * Detects the Continue AI coding assistant and merges the Intutic
- * proxy URL as apiBase into each model entry in ~/.continue/config.yaml.
- * Continue has no hook system so proxy routing (Vector B) is the only
- * available governance mechanism.
+ * Detects the Continue AI coding assistant and:
+ * - sets `apiBase` on each OpenAI/Anthropic model in `~/.continue/config.yaml`
+ *   so its LLM calls reach the proxy (merged; see continueConfigMerger.ts);
+ * - installs the Continue CLI (`cn`) PreToolUse gate in
+ *   `~/.continue/settings.json` and `<repo>/.continue/settings.json` (see
+ *   continueHooks.ts). The IDE extension has no hook system, so for it proxy
+ *   routing is the only mechanism.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/continue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,eAAe,EAAE,eAiE7B,CAAA"}
+{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAWjD,eAAO,MAAM,eAAe,EAAE,eA6B7B,CAAA"}