@intutic/cli 1.9.0 → 1.10.1

package/dist/harness/openaiAgents.d.ts

@@ -0,0 +1,40 @@
+/**
+ * openaiAgents.ts — OpenAI Agents SDK adapter (env-file config, SDK-side
+ * gate) covering BOTH ecosystems the SDK ships in, following the LangChain
+ * dual-ecosystem precedent (see HarnessType.LANGCHAIN's doc comment in
+ * shared-types/enums.ts) — except that unlike LangChain, BOTH sides have a
+ * shipped gate here, so detection AND config cover both:
+ *
+ *   * Python (`openai-agents` on PyPI): same shape as langgraph.ts (see
+ *     sdkGatedAdapter.ts). Tools run as plain Python callables inside the
+ *     agent's own process — no on-disk hook/config file exists to gate a
+ *     call, so the blocking gate ships SDK-side via
+ *     `intutic_clawde.gate.adapters.openai_agents.intutic_tool_guardrail`, a
+ *     `@tool_input_guardrail` that runs before the tool executes and can
+ *     reject the call via `ToolGuardrailFunctionOutput.reject_content()` —
+ *     the SDK's own documented veto point (verified live against
+ *     openai-agents==0.20.0).
+ *   * TypeScript (`@openai/agents` on npm, plus its `-core`/`-openai`/
+ *     `-realtime`/`-extensions` sub-packages — all matched by the
+ *     `@openai/agents` prefix rule, same mechanism as vercelAiSdk.ts's
+ *     `@ai-sdk/` prefix): the gate ships in `@intutic/gate/openai`
+ *     (packages/gate-js), the same tool-input-guardrail veto point verified
+ *     against @openai/agents@0.16.1 (guardrails exist since
+ *     @openai/agents-core 0.3.8) — see that module's doc for the MCP
+ *     materialization gotcha and the tracing-exporter DLP caveat its
+ *     `installOpenAiGate()` closes.
+ *
+ * `writeConfig` writes the SAME proxy env vars either way (the `openai`
+ * clients of both ecosystems honour `OPENAI_BASE_URL`); only the SDK-gate
+ * pointer comment differs. A workspace detected as TypeScript-only gets the
+ * `@intutic/gate/openai` pointer; Python-only gets the Python pointer; a
+ * monorepo with both gets the Python file with the TypeScript pointer
+ * appended (TD-408 item 5 — until 2026-09-22 the TS half was only reachable
+ * through the docs page).
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const openaiAgentsAdapter: IHarnessAdapter;
+//# sourceMappingURL=openaiAgents.d.ts.map

package/dist/harness/openaiAgents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openaiAgents.d.ts","sourceRoot":"","sources":["../../src/harness/openaiAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAuCjD,eAAO,MAAM,mBAAmB,EAAE,eAwCjC,CAAA"}

package/dist/harness/openaiAgents.js

@@ -0,0 +1,107 @@
+/**
+ * openaiAgents.ts — OpenAI Agents SDK adapter (env-file config, SDK-side
+ * gate) covering BOTH ecosystems the SDK ships in, following the LangChain
+ * dual-ecosystem precedent (see HarnessType.LANGCHAIN's doc comment in
+ * shared-types/enums.ts) — except that unlike LangChain, BOTH sides have a
+ * shipped gate here, so detection AND config cover both:
+ *
+ *   * Python (`openai-agents` on PyPI): same shape as langgraph.ts (see
+ *     sdkGatedAdapter.ts). Tools run as plain Python callables inside the
+ *     agent's own process — no on-disk hook/config file exists to gate a
+ *     call, so the blocking gate ships SDK-side via
+ *     `intutic_clawde.gate.adapters.openai_agents.intutic_tool_guardrail`, a
+ *     `@tool_input_guardrail` that runs before the tool executes and can
+ *     reject the call via `ToolGuardrailFunctionOutput.reject_content()` —
+ *     the SDK's own documented veto point (verified live against
+ *     openai-agents==0.20.0).
+ *   * TypeScript (`@openai/agents` on npm, plus its `-core`/`-openai`/
+ *     `-realtime`/`-extensions` sub-packages — all matched by the
+ *     `@openai/agents` prefix rule, same mechanism as vercelAiSdk.ts's
+ *     `@ai-sdk/` prefix): the gate ships in `@intutic/gate/openai`
+ *     (packages/gate-js), the same tool-input-guardrail veto point verified
+ *     against @openai/agents@0.16.1 (guardrails exist since
+ *     @openai/agents-core 0.3.8) — see that module's doc for the MCP
+ *     materialization gotcha and the tracing-exporter DLP caveat its
+ *     `installOpenAiGate()` closes.
+ *
+ * `writeConfig` writes the SAME proxy env vars either way (the `openai`
+ * clients of both ecosystems honour `OPENAI_BASE_URL`); only the SDK-gate
+ * pointer comment differs. A workspace detected as TypeScript-only gets the
+ * `@intutic/gate/openai` pointer; Python-only gets the Python pointer; a
+ * monorepo with both gets the Python file with the TypeScript pointer
+ * appended (TD-408 item 5 — until 2026-09-22 the TS half was only reachable
+ * through the docs page).
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { appendFile } from 'node:fs/promises';
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+import { makeJsSdkGatedAdapter } from './jsSdkGatedAdapter.js';
+/** The Python side — unchanged from this adapter's original single-ecosystem
+ *  shape, and still the default `writeConfig` text (see module doc). */
+const pythonAdapter = makeSdkGatedAdapter({
+    type: HarnessType.OPENAI_AGENTS,
+    label: 'OpenAI Agents SDK',
+    keywords: ['openai-agents'],
+    pipInstall: 'intutic-clawde[openai-agents]',
+    importLine: 'from intutic_clawde.gate.adapters.openai_agents import intutic_tool_guardrail',
+    usageSummary: 'intutic_tool_guardrail, attached via function_tool(tool_input_guardrails=[...]), ' +
+        'refuses denied calls before the tool body runs.',
+    docsSlug: 'openai-agents',
+});
+/** The TypeScript side — package.json-dep detection (any `@openai/agents*`
+ *  package; the meta-package alone is enough, and `-core`-only installs are
+ *  matched too) plus the `@intutic/gate/openai` pointer comment. No
+ *  `minMajor` floor: the guardrail veto point predates every version the
+ *  meta-package `@openai/agents` ever shipped as latest in 2026, and the
+ *  docs page states the >=0.3.8 core floor explicitly. */
+const jsAdapter = makeJsSdkGatedAdapter({
+    type: HarnessType.OPENAI_AGENTS,
+    label: 'OpenAI Agents SDK (TypeScript)',
+    requires: [],
+    requiresPrefix: '@openai/agents',
+    npmInstall: '@intutic/gate',
+    importLine: "import { installOpenAiGate, wrapAgent } from '@intutic/gate/openai'",
+    usageSummary: 'installOpenAiGate() + wrapAgent(agent) — tool input guardrails refuse denied calls before ' +
+        'the tool body runs, mcpServers-derived tools included. installOpenAiGate() also disables ' +
+        'the SDK tracing exporter, which posts tool I/O to a hardcoded api.openai.com endpoint ' +
+        'that bypasses OPENAI_BASE_URL.',
+    docsSlug: 'openai-agents',
+});
+export const openaiAgentsAdapter = {
+    type: HarnessType.OPENAI_AGENTS,
+    configFileName: '.env.intutic',
+    async detect(workspaceRoot) {
+        return (await pythonAdapter.detect(workspaceRoot)) || (await jsAdapter.detect(workspaceRoot));
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        const [python, js] = await Promise.all([
+            pythonAdapter.detect(workspaceRoot),
+            jsAdapter.detect(workspaceRoot),
+        ]);
+        if (js && !python) {
+            return jsAdapter.writeConfig(workspaceRoot, sops, proxyUrl);
+        }
+        const filePath = await pythonAdapter.writeConfig(workspaceRoot, sops, proxyUrl);
+        if (filePath && js) {
+            // Both ecosystems in one workspace (TD-408 item 5): the file is the
+            // Python adapter's, so its pointer named only the Python gate and the
+            // TypeScript half of the monorepo was left to find `@intutic/gate`
+            // through the docs page. Say it here too.
+            await appendFile(filePath, [
+                '# This workspace also carries `@openai/agents` (TypeScript). Its tools run in',
+                '# your own Node process; the blocking gate for that half ships SDK-side too:',
+                '#   npm install @intutic/gate',
+                "#   import { installOpenAiGate, wrapAgent } from '@intutic/gate/openai'",
+                '# See https://docs.intutic.ai/integrations/openai-agents',
+                '',
+            ].join('\n'), 'utf-8');
+        }
+        return filePath;
+    },
+    // Both sides write the identical file path; either delegate reads it.
+    readCurrentHash: (workspaceRoot) => pythonAdapter.readCurrentHash(workspaceRoot),
+};
+//# sourceMappingURL=openaiAgents.js.map

package/dist/harness/openaiAgents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openaiAgents.js","sourceRoot":"","sources":["../../src/harness/openaiAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D;wEACwE;AACxE,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACxC,IAAI,EAAE,WAAW,CAAC,aAAa;IAC/B,KAAK,EAAE,mBAAmB;IAC1B,QAAQ,EAAE,CAAC,eAAe,CAAC;IAC3B,UAAU,EAAE,+BAA+B;IAC3C,UAAU,EAAE,+EAA+E;IAC3F,YAAY,EACV,mFAAmF;QACnF,iDAAiD;IACnD,QAAQ,EAAE,eAAe;CAC1B,CAAC,CAAA;AAEF;;;;;0DAK0D;AAC1D,MAAM,SAAS,GAAG,qBAAqB,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC,aAAa;IAC/B,KAAK,EAAE,gCAAgC;IACvC,QAAQ,EAAE,EAAE;IACZ,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,qEAAqE;IACjF,YAAY,EACV,4FAA4F;QAC5F,2FAA2F;QAC3F,wFAAwF;QACxF,gCAAgC;IAClC,QAAQ,EAAE,eAAe;CAC1B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD,IAAI,EAAE,WAAW,CAAC,aAAa;IAC/B,cAAc,EAAE,cAAc;IAE9B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,OAAO,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ;QAC7C,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;YACnC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC;SAChC,CAAC,CAAA;QACF,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC/E,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACnB,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,0CAA0C;YAC1C,MAAM,UAAU,CACd,QAAQ,EACR;gBACE,+EAA+E;gBAC/E,8EAA8E;gBAC9E,+BAA+B;gBAC/B,yEAAyE;gBACzE,0DAA0D;gBAC1D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,sEAAsE;IACtE,eAAe,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,aAAa,CAAC;CACjF,CAAA"}

package/dist/harness/opencode.d.ts

@@ -0,0 +1,24 @@
+/**
+ * opencode.ts — OpenCode adapter (npm `opencode-ai` 1.x / `@opencode/cli` 2.x,
+ * binary `opencode`).
+ *
+ * OpenCode is a terminal coding agent whose instructions file is `AGENTS.md`
+ * (project, with a `CLAUDE.md` fallback, and `~/.config/opencode/AGENTS.md`)
+ * — delivered here through the shared markdown builder every other
+ * `AGENTS.md`/`CLAUDE.md` harness uses, so it grows no rules format of its
+ * own.
+ *
+ * The governance-critical half is a **plugin**, not a hook file: OpenCode
+ * loads `.opencode/plugins/*.js` into its own process and runs the plugin's
+ * `tool.execute.before` hook (1.x) / `tool execute.before` hook (2.x) before
+ * every tool call; throwing refuses the call. That plugin is generated by
+ * `@intutic/sync-daemon`'s `openCodeHooks.ts`, the same split Muse and Grok
+ * use for their hook writers. `opencode.json` is not written — see the
+ * writer's module doc.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const opencodeAdapter: IHarnessAdapter;
+//# sourceMappingURL=opencode.d.ts.map

package/dist/harness/opencode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../src/harness/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAajD,eAAO,MAAM,eAAe,EAAE,eA6D7B,CAAA"}

package/dist/harness/opencode.js

@@ -0,0 +1,97 @@
+/**
+ * opencode.ts — OpenCode adapter (npm `opencode-ai` 1.x / `@opencode/cli` 2.x,
+ * binary `opencode`).
+ *
+ * OpenCode is a terminal coding agent whose instructions file is `AGENTS.md`
+ * (project, with a `CLAUDE.md` fallback, and `~/.config/opencode/AGENTS.md`)
+ * — delivered here through the shared markdown builder every other
+ * `AGENTS.md`/`CLAUDE.md` harness uses, so it grows no rules format of its
+ * own.
+ *
+ * The governance-critical half is a **plugin**, not a hook file: OpenCode
+ * loads `.opencode/plugins/*.js` into its own process and runs the plugin's
+ * `tool.execute.before` hook (1.x) / `tool execute.before` hook (2.x) before
+ * every tool call; throwing refuses the call. That plugin is generated by
+ * `@intutic/sync-daemon`'s `openCodeHooks.ts`, the same split Muse and Grok
+ * use for their hook writers. `opencode.json` is not written — see the
+ * writer's module doc.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { join, dirname } from 'node:path';
+import { access, writeFile, rename, mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { HarnessType } from '@intutic/shared-types';
+import { hashFile } from '../lib/hash.js';
+import { buildMarkdownContent } from './base.js';
+import { writeOpenCodeHooks } from '@intutic/sync-daemon/harness/openCodeHooks';
+/** Workspace-relative rules file. OpenCode reads this, falling back to CLAUDE.md. */
+const CONFIG_FILE = 'AGENTS.md';
+/** `$OPENCODE_CONFIG_DIR` or `~/.config/opencode` — the user-level config dir. */
+function openCodeConfigDir() {
+    return process.env.OPENCODE_CONFIG_DIR || join(homedir(), '.config', 'opencode');
+}
+export const opencodeAdapter = {
+    type: HarnessType.OPENCODE,
+    configFileName: CONFIG_FILE,
+    async detect(workspaceRoot) {
+        // 1. Project-local `.opencode/` directory or `opencode.json{,c}`. Not
+        //    AGENTS.md alone — Muse and Grok read the same file.
+        for (const marker of ['.opencode', 'opencode.json', 'opencode.jsonc']) {
+            try {
+                await access(join(workspaceRoot, marker));
+                return true;
+            }
+            catch { /* not here */ }
+        }
+        // 2. User-level config dir — installed but never run in this workspace.
+        try {
+            await access(openCodeConfigDir());
+            return true;
+        }
+        catch { /* not here */ }
+        // 3. `opencode` (or the 2.x line's `opencode2`) binary on PATH.
+        const pathDirs = (process.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':');
+        try {
+            const { accessSync } = await import('node:fs');
+            for (const dir of pathDirs) {
+                for (const bin of ['opencode', 'opencode2']) {
+                    try {
+                        accessSync(join(dir, bin));
+                        return true;
+                    }
+                    catch { /* not here */ }
+                }
+            }
+        }
+        catch { /* ignore */ }
+        return false;
+    },
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        const agentsPath = join(workspaceRoot, CONFIG_FILE);
+        // 1. AGENTS.md rules file — same "skip when there is nothing to write"
+        //    convention every markdown adapter uses.
+        if (sops.length > 0) {
+            const content = buildMarkdownContent(sops, proxyUrl);
+            await mkdir(dirname(agentsPath), { recursive: true });
+            const tmp = agentsPath + '.intutic-tmp';
+            await writeFile(tmp, content, 'utf-8');
+            await rename(tmp, agentsPath);
+        }
+        // 2. The plugin gate. `intutic connect` has no workspace id in scope —
+        //    same limitation `museAdapter` has — the sync daemon re-runs this
+        //    with a real one on the next cycle.
+        await writeOpenCodeHooks(workspaceRoot, proxyUrl, '');
+        return agentsPath;
+    },
+    async readCurrentHash(workspaceRoot) {
+        try {
+            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=opencode.js.map

package/dist/harness/opencode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../../src/harness/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAE/E,qFAAqF;AACrF,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,kFAAkF;AAClF,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,sEAAsE;QACtE,yDAAyD;QACzD,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;gBACzC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAE1B,gEAAgE;QAChE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;wBAAC,OAAO,IAAI,CAAA;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEnD,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;YACvC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACtC,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/B,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,wCAAwC;QACxC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAErD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/pydanticAi.d.ts

@@ -0,0 +1,19 @@
+/**
+ * pydanticAi.ts — Pydantic AI adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Detected via
+ * `pydantic-ai` or `pydantic-ai-slim` (the substring "pydantic-ai" matches
+ * both).
+ *
+ * The blocking gate ships SDK-side via
+ * `intutic_clawde.gate.adapters.pydantic_ai.IntuticWrapperToolset`, a
+ * Pydantic AI `WrapperToolset.call_tool` override, plus a `guard_agent(agent)`
+ * convenience helper wrapping every toolset already on an `Agent` in one
+ * call — verified live against pydantic-ai-slim==2.31.1 by driving a real
+ * `Agent.run_sync()` through `pydantic_ai.models.function.FunctionModel`.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const pydanticAiAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=pydanticAi.d.ts.map

package/dist/harness/pydanticAi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pydanticAi.d.ts","sourceRoot":"","sources":["../../src/harness/pydanticAi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,eAAO,MAAM,iBAAiB,sCAU5B,CAAA"}

package/dist/harness/pydanticAi.js

@@ -0,0 +1,30 @@
+/**
+ * pydanticAi.ts — Pydantic AI adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Detected via
+ * `pydantic-ai` or `pydantic-ai-slim` (the substring "pydantic-ai" matches
+ * both).
+ *
+ * The blocking gate ships SDK-side via
+ * `intutic_clawde.gate.adapters.pydantic_ai.IntuticWrapperToolset`, a
+ * Pydantic AI `WrapperToolset.call_tool` override, plus a `guard_agent(agent)`
+ * convenience helper wrapping every toolset already on an `Agent` in one
+ * call — verified live against pydantic-ai-slim==2.31.1 by driving a real
+ * `Agent.run_sync()` through `pydantic_ai.models.function.FunctionModel`.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+export const pydanticAiAdapter = makeSdkGatedAdapter({
+    type: HarnessType.PYDANTIC_AI,
+    label: 'Pydantic AI',
+    keywords: ['pydantic-ai'], // matches "pydantic-ai" and "pydantic-ai-slim"
+    pipInstall: 'intutic-clawde[pydantic-ai]',
+    importLine: 'from intutic_clawde.gate.adapters.pydantic_ai import guard_agent',
+    usageSummary: 'guard_agent(agent) wraps every toolset on the Agent; a blocked call raises ModelRetry ' +
+        'before the tool body runs.',
+    docsSlug: 'pydantic-ai',
+});
+//# sourceMappingURL=pydanticAi.js.map

package/dist/harness/pydanticAi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pydanticAi.js","sourceRoot":"","sources":["../../src/harness/pydanticAi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,+CAA+C;IAC1E,UAAU,EAAE,6BAA6B;IACzC,UAAU,EAAE,kEAAkE;IAC9E,YAAY,EACV,wFAAwF;QACxF,4BAA4B;IAC9B,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAA"}

package/dist/harness/sdkGatedAdapter.d.ts

@@ -0,0 +1,55 @@
+/**
+ * sdkGatedAdapter.ts — shared builder for harness adapters whose blocking
+ * gate ships SDK-side in intutic-clawde, with no on-disk hook/config file to
+ * write a tool-call gate into.
+ *
+ * LangGraph was the first of this family (see langgraph.ts) and is left as a
+ * hand-written adapter since it predates this file; every adapter added
+ * since is built from this shared factory instead of being hand-copied.
+ * Copy-pasting harness writers is a proven defect generator in this codebase
+ * — see gateBody.ts's module doc for the four production defects traced to
+ * divergent hand-copies of one piece of logic — so the detect/writeConfig
+ * shape below is defined once and each framework supplies only what
+ * distinguishes it: its manifest keywords and the comment text pointing
+ * developers at its intutic-clawde adapter module.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { HarnessType } from '@intutic/shared-types';
+import type { IHarnessAdapter } from './types.js';
+/**
+ * A manifest match test. A plain string is a case-insensitive substring test
+ * (fine for distinctive package names like "crewai" or "google-adk"); a
+ * RegExp is tested against the lower-cased manifest content directly, for
+ * names short enough to false-positive as a substring (e.g. "ag2" inside
+ * "flag2" or a version string) — see ag2.ts.
+ */
+export type ManifestMatcher = string | RegExp;
+export interface SdkGatedFrameworkSpec {
+    /** HarnessType enum value this adapter detects/configures. */
+    type: HarnessType;
+    /** Display name used in the generated comment, e.g. "CrewAI". */
+    label: string;
+    /** A manifest matching ANY of these is a detection hit. */
+    keywords: readonly ManifestMatcher[];
+    /** Dependency manifests scanned for a match. Defaults to the langgraph.ts set. */
+    manifestFiles?: readonly string[];
+    /**
+     * `pip install <pipInstall>` shown in the generated comment — the extra
+     * name included, e.g. `"intutic-clawde[crewai]"`. Bare `"intutic-clawde"`
+     * for a framework with no dedicated adapter module yet (its tools are
+     * governed through the framework-agnostic `@guard`/`guard_tools` helpers
+     * in the meantime).
+     */
+    pipInstall: string;
+    /** The intutic_clawde.gate(.adapters.<x>) import line shown in the comment. */
+    importLine: string;
+    /** One line (no leading "# ") summarising how the imported symbol vetoes a call. */
+    usageSummary: string;
+    /** apps/docs/integrations/<slug> */
+    docsSlug: string;
+}
+/** Builds an `IHarnessAdapter` for one SDK-gated framework from its spec. */
+export declare function makeSdkGatedAdapter(spec: SdkGatedFrameworkSpec): IHarnessAdapter;
+//# sourceMappingURL=sdkGatedAdapter.d.ts.map

package/dist/harness/sdkGatedAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkGatedAdapter.d.ts","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAE7C,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,IAAI,EAAE,WAAW,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;IACpC,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAOD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAwDhF"}

package/dist/harness/sdkGatedAdapter.js

@@ -0,0 +1,85 @@
+/**
+ * sdkGatedAdapter.ts — shared builder for harness adapters whose blocking
+ * gate ships SDK-side in intutic-clawde, with no on-disk hook/config file to
+ * write a tool-call gate into.
+ *
+ * LangGraph was the first of this family (see langgraph.ts) and is left as a
+ * hand-written adapter since it predates this file; every adapter added
+ * since is built from this shared factory instead of being hand-copied.
+ * Copy-pasting harness writers is a proven defect generator in this codebase
+ * — see gateBody.ts's module doc for the four production defects traced to
+ * divergent hand-copies of one piece of logic — so the detect/writeConfig
+ * shape below is defined once and each framework supplies only what
+ * distinguishes it: its manifest keywords and the comment text pointing
+ * developers at its intutic-clawde adapter module.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { join, dirname } from 'node:path';
+import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { hashFile } from '../lib/hash.js';
+import { newIso } from '@intutic/id';
+const CONFIG_FILE = '.env.intutic';
+/** Dependency manifests scanned by default — same three langgraph.ts uses. */
+const DEFAULT_MANIFEST_FILES = ['pyproject.toml', 'requirements.txt', 'uv.lock'];
+function matches(content, keywords) {
+    const lower = content.toLowerCase();
+    return keywords.some((k) => (typeof k === 'string' ? lower.includes(k) : k.test(lower)));
+}
+/** Builds an `IHarnessAdapter` for one SDK-gated framework from its spec. */
+export function makeSdkGatedAdapter(spec) {
+    const manifestFiles = spec.manifestFiles ?? DEFAULT_MANIFEST_FILES;
+    return {
+        type: spec.type,
+        configFileName: CONFIG_FILE,
+        async detect(workspaceRoot) {
+            for (const manifest of manifestFiles) {
+                try {
+                    const content = await readFile(join(workspaceRoot, manifest), 'utf-8');
+                    if (matches(content, spec.keywords))
+                        return true;
+                }
+                catch { /* manifest not present */ }
+            }
+            return false;
+        },
+        async writeConfig(workspaceRoot, sops, proxyUrl) {
+            const filePath = join(workspaceRoot, CONFIG_FILE);
+            const envContent = [
+                '# Intutic Governance Rules (auto-generated)',
+                '# DO NOT EDIT — managed by intutic sync daemon',
+                `# Last sync: ${newIso()}`,
+                '# Source this file: source .env.intutic',
+                '',
+                `export ANTHROPIC_BASE_URL="${proxyUrl}"`,
+                `export OPENAI_BASE_URL="${proxyUrl}"`,
+                `export INTUTIC_PROXY_URL="${proxyUrl}"`,
+                `export INTUTIC_SOP_COUNT=${sops.length}`,
+                '',
+                `# These env vars govern LLM egress only. ${spec.label} tools run in your own`,
+                '# Python process, where no config or hook file can gate them — the',
+                '# blocking tool gate ships SDK-side:',
+                `#   pip install ${spec.pipInstall}`,
+                `#   ${spec.importLine}`,
+                `# ${spec.usageSummary}`,
+                `# See https://docs.intutic.ai/integrations/${spec.docsSlug}`,
+                '',
+            ].join('\n');
+            await mkdir(dirname(filePath), { recursive: true });
+            const tmpEnv = filePath + '.intutic-tmp';
+            await writeFile(tmpEnv, envContent, 'utf-8');
+            await rename(tmpEnv, filePath);
+            return filePath;
+        },
+        async readCurrentHash(workspaceRoot) {
+            try {
+                return await hashFile(join(workspaceRoot, CONFIG_FILE));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=sdkGatedAdapter.js.map

package/dist/harness/sdkGatedAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkGatedAdapter.js","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAGrE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAoCzF,SAAS,OAAO,CAAC,OAAe,EAAE,QAAoC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAA;IAElE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,WAAW;QAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;oBACtE,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;wBAAE,OAAO,IAAI,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG;gBACjB,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,yCAAyC;gBACzC,EAAE;gBACF,8BAA8B,QAAQ,GAAG;gBACzC,2BAA2B,QAAQ,GAAG;gBACtC,6BAA6B,QAAQ,GAAG;gBACxC,4BAA4B,IAAI,CAAC,MAAM,EAAE;gBACzC,EAAE;gBACF,4CAA4C,IAAI,CAAC,KAAK,wBAAwB;gBAC9E,oEAAoE;gBACpE,sCAAsC;gBACtC,mBAAmB,IAAI,CAAC,UAAU,EAAE;gBACpC,OAAO,IAAI,CAAC,UAAU,EAAE;gBACxB,KAAK,IAAI,CAAC,YAAY,EAAE;gBACxB,8CAA8C,IAAI,CAAC,QAAQ,EAAE;gBAC7D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;YACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAE9B,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/harness/smolagents.d.ts

@@ -0,0 +1,22 @@
+/**
+ * smolagents.ts — smolagents adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Detected via the
+ * `smolagents` package name.
+ *
+ * `ToolCallingAgent`'s tools are plain callables — `@guard`/`guard_tools`
+ * govern them directly (guard_tools was extended to duck-type `.forward`,
+ * since a smolagents `Tool` is otherwise `callable` on its own `__call__`
+ * and would have been silently replaced with a bare wrapper function,
+ * losing its schema — see framework.py's doc). `CodeAgent` has no discrete
+ * tool calls at all; its choke point is the generated Python CODE STRING,
+ * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
+ * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
+ * driving a real `CodeAgent.run()` end to end. See that module's doc (and
+ * TD-377) for what governing code TEXT does and does not cover.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const smolagentsAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=smolagents.d.ts.map

package/dist/harness/smolagents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smolagents.d.ts","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,eAAO,MAAM,iBAAiB,sCAU5B,CAAA"}

package/dist/harness/smolagents.js

@@ -0,0 +1,33 @@
+/**
+ * smolagents.ts — smolagents adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Detected via the
+ * `smolagents` package name.
+ *
+ * `ToolCallingAgent`'s tools are plain callables — `@guard`/`guard_tools`
+ * govern them directly (guard_tools was extended to duck-type `.forward`,
+ * since a smolagents `Tool` is otherwise `callable` on its own `__call__`
+ * and would have been silently replaced with a bare wrapper function,
+ * losing its schema — see framework.py's doc). `CodeAgent` has no discrete
+ * tool calls at all; its choke point is the generated Python CODE STRING,
+ * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
+ * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
+ * driving a real `CodeAgent.run()` end to end. See that module's doc (and
+ * TD-377) for what governing code TEXT does and does not cover.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+export const smolagentsAdapter = makeSdkGatedAdapter({
+    type: HarnessType.SMOLAGENTS,
+    label: 'smolagents',
+    keywords: ['smolagents'],
+    pipInstall: 'intutic-clawde[smolagents]',
+    importLine: 'from intutic_clawde.gate.adapters.smolagents import IntuticPythonExecutor',
+    usageSummary: 'IntuticPythonExecutor gates CodeAgent\'s generated code text before running it; ' +
+        'ToolCallingAgent tools are covered by @guard/guard_tools instead (see TD-377).',
+    docsSlug: 'smolagents',
+});
+//# sourceMappingURL=smolagents.js.map

package/dist/harness/smolagents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,gFAAgF;IAClF,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}

package/dist/harness/strands.d.ts

@@ -0,0 +1,22 @@
+/**
+ * strands.ts — AWS Strands Agents adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Strands tools are
+ * plain decorated callables (or MCP-materialised `MCPAgentTool`s) in the
+ * agent's own Python process — no on-disk hook/config file exists to gate a
+ * call, so the blocking gate ships SDK-side via
+ * `intutic_clawde.gate.adapters.strands.IntuticHookProvider`, built on
+ * Strands' own documented `BeforeToolCallEvent.cancel_tool` veto (verified
+ * live against strands-agents==1.52.0).
+ *
+ * Egress caveat, unique so far in this family: Strands' DEFAULT model
+ * provider is Bedrock, whose SigV4-signed boto3 traffic the Intutic proxy
+ * cannot terminate — the ANTHROPIC_BASE_URL/OPENAI_BASE_URL vars the shared
+ * `.env.intutic` writes only take effect if the user selects the Anthropic/
+ * OpenAI/LiteLLM providers instead. See apps/docs/integrations/strands.md.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const strandsAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=strands.d.ts.map

package/dist/harness/strands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strands.d.ts","sourceRoot":"","sources":["../../src/harness/strands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,eAAO,MAAM,cAAc,sCAYzB,CAAA"}

package/dist/harness/strands.js

@@ -0,0 +1,35 @@
+/**
+ * strands.ts — AWS Strands Agents adapter (env-file config, SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Strands tools are
+ * plain decorated callables (or MCP-materialised `MCPAgentTool`s) in the
+ * agent's own Python process — no on-disk hook/config file exists to gate a
+ * call, so the blocking gate ships SDK-side via
+ * `intutic_clawde.gate.adapters.strands.IntuticHookProvider`, built on
+ * Strands' own documented `BeforeToolCallEvent.cancel_tool` veto (verified
+ * live against strands-agents==1.52.0).
+ *
+ * Egress caveat, unique so far in this family: Strands' DEFAULT model
+ * provider is Bedrock, whose SigV4-signed boto3 traffic the Intutic proxy
+ * cannot terminate — the ANTHROPIC_BASE_URL/OPENAI_BASE_URL vars the shared
+ * `.env.intutic` writes only take effect if the user selects the Anthropic/
+ * OpenAI/LiteLLM providers instead. See apps/docs/integrations/strands.md.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+export const strandsAdapter = makeSdkGatedAdapter({
+    type: HarnessType.STRANDS,
+    label: 'Strands Agents',
+    // Matches strands-agents, strands-agents-tools, and the bedrock-agentcore
+    // `strands-agents` extra — all of which imply the framework is in use.
+    keywords: ['strands-agents'],
+    pipInstall: 'intutic-clawde[strands]',
+    importLine: 'from intutic_clawde.gate.adapters.strands import IntuticHookProvider',
+    usageSummary: 'Agent(hooks=[IntuticHookProvider()]) cancels denied tool calls via Strands’ own ' +
+        'BeforeToolCallEvent.cancel_tool before the tool body runs (MCP tools included).',
+    docsSlug: 'strands',
+});
+//# sourceMappingURL=strands.js.map

package/dist/harness/strands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strands.js","sourceRoot":"","sources":["../../src/harness/strands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;IAChD,IAAI,EAAE,WAAW,CAAC,OAAO;IACzB,KAAK,EAAE,gBAAgB;IACvB,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC5B,UAAU,EAAE,yBAAyB;IACrC,UAAU,EAAE,sEAAsE;IAClF,YAAY,EACV,kFAAkF;QAClF,iFAAiF;IACnF,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAA"}