@intutic/cli 2.0.0 → 2.2.0

package/dist/config/paths.js

@@ -7,6 +7,7 @@
  * LLD #8 — Sync Daemon / CLI
  * @module
  */
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 /**
@@ -71,14 +72,53 @@ export function getTracesLogDir() {
 export function getIntegrityPath(workspaceRoot) {
     return join(workspaceRoot, '.intutic', 'integrity.json');
 }
+const LOCAL_CONTROL_PLANE_URL = 'http://localhost:3001';
+const HOSTED_CONTROL_PLANE_URL = 'https://api.intutic.ai';
 /**
- * Resolve the control plane URL.
- * If --dev flag or INTUTIC_DEV=1 env var, use localhost:3001.
+ * The control plane `intutic login` saved with the credentials, or undefined.
+ *
+ * Read straight from the credentials file rather than through
+ * `loadCredentials()`: only the URL is needed, it is never a secret, and this
+ * keeps resolution synchronous and free of keychain access.
+ */
+export function storedControlPlaneUrl() {
+    try {
+        const creds = JSON.parse(readFileSync(getCredentialsPath(), 'utf-8'));
+        return typeof creds.controlPlaneUrl === 'string' && creds.controlPlaneUrl ? creds.controlPlaneUrl : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Trims trailing `/` without a regex (see `commands/exec.ts` for why). */
+function trimTrailingSlashes(s) {
+    let end = s.length;
+    while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    return s.slice(0, end);
+}
+/**
+ * Resolve the control plane URL, first match wins:
+ *
+ * 1. a flag: `--control-plane-url` (`flagUrl`), or `--dev` (`devMode`, which
+ *    some callers also set from a workspace initialised with `--dev`)
+ * 2. the environment: `INTUTIC_CONTROL_PLANE_URL`, or `INTUTIC_DEV=1`
+ * 3. the URL `intutic login` saved with the credentials (`useStored: false`
+ *    skips it, for credentials supplied on the command line instead)
+ * 4. the hosted control plane
+ *
+ * Every command resolves through here, so a self-hosted control plane named
+ * once — at login, or in the environment — is the one every later command
+ * talks to. Before, only localhost or the hosted URL were reachable, and the
+ * saved URL was ignored.
  */
-export function resolveControlPlaneUrl(devMode) {
-    const isDev = devMode || process.env.INTUTIC_DEV === '1';
-    return isDev
-        ? 'http://localhost:3001'
-        : 'https://api.intutic.ai';
+export function resolveControlPlaneUrl(devMode, opts = {}) {
+    const url = opts.flagUrl ||
+        (devMode ? LOCAL_CONTROL_PLANE_URL : undefined) ||
+        process.env.INTUTIC_CONTROL_PLANE_URL ||
+        (process.env.INTUTIC_DEV === '1' ? LOCAL_CONTROL_PLANE_URL : undefined) ||
+        (opts.useStored === false ? undefined : storedControlPlaneUrl()) ||
+        HOSTED_CONTROL_PLANE_URL;
+    return trimTrailingSlashes(url);
 }
 //# sourceMappingURL=paths.js.map

package/dist/config/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC5C,6CAA6C;QAC7C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACpD,CAAC;IACD,kBAAkB;IAClB,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAA;AAClD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB;IACtD,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAA;IACxD,OAAO,KAAK;QACV,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,wBAAwB,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC5C,6CAA6C;QAC7C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACpD,CAAC;IACD,kBAAkB;IAClB,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAA;AAClD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,uBAAuB,GAAG,uBAAuB,CAAA;AACvD,MAAM,wBAAwB,GAAG,wBAAwB,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAkC,CAAA;QACtG,OAAO,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiB,EACjB,OAAkD,EAAE;IAEpD,MAAM,GAAG,GACP,IAAI,CAAC,OAAO;QACZ,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;QAChE,wBAAwB,CAAA;IAC1B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC"}

package/dist/harness/agentFramework.d.ts

@@ -0,0 +1,25 @@
+/**
+ * agentFramework.ts — Microsoft Agent Framework adapter (env-file config,
+ * SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Agent Framework (the
+ * AutoGen + Semantic Kernel successor, `agent-framework` /
+ * `agent-framework-core` on PyPI, imported as `agent_framework`) is a separate
+ * framework from AutoGen (autogen.ts), so it has its own adapter (TD-375).
+ * Its tools run in the agent's own Python process, so the blocking gate ships
+ * SDK-side via
+ * `intutic_clawde.gate.adapters.agent_framework.IntuticFunctionMiddleware`, a
+ * `FunctionMiddleware` that skips `call_next()` on a deny (verified live
+ * against agent-framework-core==1.20.0).
+ *
+ * "agent-framework" is a generic phrase, so detection anchors the start of the
+ * name: it must not follow a letter, digit, `-`, `_` or `.`. That matches
+ * `agent-framework`, `agent-framework-core`, `agent-framework-openai` and the
+ * `agent_framework` spelling, but not some other project's
+ * `my-agent-framework`.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+export declare const agentFrameworkAdapter: import("./types.js").IHarnessAdapter;
+//# sourceMappingURL=agentFramework.d.ts.map

package/dist/harness/agentFramework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentFramework.d.ts","sourceRoot":"","sources":["../../src/harness/agentFramework.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,eAAO,MAAM,qBAAqB,sCAUhC,CAAA"}

package/dist/harness/agentFramework.js

@@ -0,0 +1,37 @@
+/**
+ * agentFramework.ts — Microsoft Agent Framework adapter (env-file config,
+ * SDK-side gate).
+ *
+ * Same shape as langgraph.ts (see sdkGatedAdapter.ts). Agent Framework (the
+ * AutoGen + Semantic Kernel successor, `agent-framework` /
+ * `agent-framework-core` on PyPI, imported as `agent_framework`) is a separate
+ * framework from AutoGen (autogen.ts), so it has its own adapter (TD-375).
+ * Its tools run in the agent's own Python process, so the blocking gate ships
+ * SDK-side via
+ * `intutic_clawde.gate.adapters.agent_framework.IntuticFunctionMiddleware`, a
+ * `FunctionMiddleware` that skips `call_next()` on a deny (verified live
+ * against agent-framework-core==1.20.0).
+ *
+ * "agent-framework" is a generic phrase, so detection anchors the start of the
+ * name: it must not follow a letter, digit, `-`, `_` or `.`. That matches
+ * `agent-framework`, `agent-framework-core`, `agent-framework-openai` and the
+ * `agent_framework` spelling, but not some other project's
+ * `my-agent-framework`.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+import { makeSdkGatedAdapter } from './sdkGatedAdapter.js';
+const AGENT_FRAMEWORK_TOKEN = /(?:^|[^a-z0-9_.-])agent[-_]framework(?![a-z0-9])/m;
+export const agentFrameworkAdapter = makeSdkGatedAdapter({
+    type: HarnessType.AGENT_FRAMEWORK,
+    label: 'Microsoft Agent Framework',
+    keywords: [AGENT_FRAMEWORK_TOKEN],
+    pipInstall: 'intutic-clawde[agent-framework]',
+    importLine: 'from intutic_clawde.gate.adapters.agent_framework import IntuticFunctionMiddleware',
+    usageSummary: 'Agent(middleware=[IntuticFunctionMiddleware()]) skips call_next() on a denied tool call, ' +
+        'so the tool never runs and the model receives the refusal as the tool result.',
+    docsSlug: 'microsoft-agent-framework',
+});
+//# sourceMappingURL=agentFramework.js.map

package/dist/harness/agentFramework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentFramework.js","sourceRoot":"","sources":["../../src/harness/agentFramework.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAEjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;IACvD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,2BAA2B;IAClC,QAAQ,EAAE,CAAC,qBAAqB,CAAC;IACjC,UAAU,EAAE,iCAAiC;IAC7C,UAAU,EAAE,oFAAoF;IAChG,YAAY,EACV,2FAA2F;QAC3F,+EAA+E;IACjF,QAAQ,EAAE,2BAA2B;CACtC,CAAC,CAAA"}

package/dist/harness/agentcore.d.ts

@@ -40,9 +40,12 @@
  *    commands write (confirmed via `bedrock_agentcore_starter_toolkit/cli/
  *    runtime/_configure_impl.py` and every other CLI subcommand module that
  *    reads it).
- * 5. `agentcore/agentcore.json` or `aws-targets.json` at the workspace root —
- *    the config files the npm `@aws/agentcore` CLI writes (confirmed via the
- *    literal strings in the published `dist/cli/index.mjs` bundle).
+ * 5. `agentcore/agentcore.json` or `agentcore/aws-targets.json` — the config
+ *    files the npm `@aws/agentcore` CLI writes. Both live in the project's
+ *    `agentcore/` directory, not at the root: confirmed by running
+ *    `agentcore create` (0.31.1) offline with no AWS credentials, whose real
+ *    output is vendored in `__fixtures__/agentcore-cli-0.31.1/`, and by the
+ *    `${root}/agentcore/aws-targets.json` paths in the 0.27.0 bundle.
  *
  * No ReDoS surface: every check below is a plain substring/property test
  * over locally-read files, never a regex over untrusted network input.

package/dist/harness/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAiDjD,eAAO,MAAM,gBAAgB,EAAE,eAuB9B,CAAA"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAiDjD,eAAO,MAAM,gBAAgB,EAAE,eAuB9B,CAAA"}

package/dist/harness/agentcore.js

@@ -40,9 +40,12 @@
  *    commands write (confirmed via `bedrock_agentcore_starter_toolkit/cli/
  *    runtime/_configure_impl.py` and every other CLI subcommand module that
  *    reads it).
- * 5. `agentcore/agentcore.json` or `aws-targets.json` at the workspace root —
- *    the config files the npm `@aws/agentcore` CLI writes (confirmed via the
- *    literal strings in the published `dist/cli/index.mjs` bundle).
+ * 5. `agentcore/agentcore.json` or `agentcore/aws-targets.json` — the config
+ *    files the npm `@aws/agentcore` CLI writes. Both live in the project's
+ *    `agentcore/` directory, not at the root: confirmed by running
+ *    `agentcore create` (0.31.1) offline with no AWS credentials, whose real
+ *    output is vendored in `__fixtures__/agentcore-cli-0.31.1/`, and by the
+ *    `${root}/agentcore/aws-targets.json` paths in the 0.27.0 bundle.
  *
  * No ReDoS surface: every check below is a plain substring/property test
  * over locally-read files, never a regex over untrusted network input.
@@ -56,7 +59,7 @@ import { HarnessType } from '@intutic/shared-types';
 /** Python manifests scanned for the SDK/toolkit package names. */
 const PYTHON_MANIFESTS = ['pyproject.toml', 'requirements.txt', 'uv.lock'];
 /** Config files the `agentcore` CLIs (npm + Python starter toolkit) write. */
-const CONFIG_FILE_SIGNALS = ['.bedrock_agentcore.yaml', 'agentcore/agentcore.json', 'aws-targets.json'];
+const CONFIG_FILE_SIGNALS = ['.bedrock_agentcore.yaml', 'agentcore/agentcore.json', 'agentcore/aws-targets.json'];
 async function hasAnyConfigFile(workspaceRoot) {
     for (const rel of CONFIG_FILE_SIGNALS) {
         try {

package/dist/harness/agentcore.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAEnF,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,kBAAkB,CAAU,CAAA;AAEhH,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IACnD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC1D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACtF,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAA;QACpG,OAAO,mBAAmB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,iBAAiB;IACnC,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACtD,IAAI,MAAM,uBAAuB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7D,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2DAA2D;IAC3D,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}
+{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../src/harness/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAEnF,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,4BAA4B,CAAU,CAAA;AAE1H,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IACnD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC1D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACtF,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAA;QACpG,OAAO,mBAAmB,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,iBAAiB;IACnC,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACtD,IAAI,MAAM,uBAAuB,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7D,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2DAA2D;IAC3D,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}

package/dist/harness/agenticOrchestrator.d.ts

@@ -10,11 +10,9 @@
  * flag: "Available: claude, codex, opencode"). Each feature runs in its own
  * `git worktree` under `~/.agentic-orchestrator/worktrees/` (confirmed via
  * the project's own README), the same "one workflow, one worktree" shape
- * Xirp uses — so the sync daemon's existing worktree propagation
- * (`services/sync-daemon/src/lib/gitWorktrees.ts`) already covers these
- * worktrees too, with no changes needed: `git worktree list --porcelain`
- * enumerates every worktree of a watched repo regardless of where under the
- * filesystem it lives.
+ * Xirp uses, and covered the same way: by each backend's user-level hook
+ * registration, which applies in every worktree. `intutic connect` writes
+ * project-level files only into the checkout it runs in.
  *
  * Unlike Xirp, this project's facts were LIVE-VERIFIED against the real
  * released artifact, not just its README: the actual `agentico` binary

package/dist/harness/agenticOrchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agenticOrchestrator.d.ts","sourceRoot":"","sources":["../../src/harness/agenticOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,0BAA0B,EAAE,eAyDxC,CAAA"}
+{"version":3,"file":"agenticOrchestrator.d.ts","sourceRoot":"","sources":["../../src/harness/agenticOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,0BAA0B,EAAE,eAyDxC,CAAA"}

package/dist/harness/agenticOrchestrator.js

@@ -10,11 +10,9 @@
  * flag: "Available: claude, codex, opencode"). Each feature runs in its own
  * `git worktree` under `~/.agentic-orchestrator/worktrees/` (confirmed via
  * the project's own README), the same "one workflow, one worktree" shape
- * Xirp uses — so the sync daemon's existing worktree propagation
- * (`services/sync-daemon/src/lib/gitWorktrees.ts`) already covers these
- * worktrees too, with no changes needed: `git worktree list --porcelain`
- * enumerates every worktree of a watched repo regardless of where under the
- * filesystem it lives.
+ * Xirp uses, and covered the same way: by each backend's user-level hook
+ * registration, which applies in every worktree. `intutic connect` writes
+ * project-level files only into the checkout it runs in.
  *
  * Unlike Xirp, this project's facts were LIVE-VERIFIED against the real
  * released artifact, not just its README: the actual `agentico` binary

package/dist/harness/agenticOrchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"agenticOrchestrator.js","sourceRoot":"","sources":["../../src/harness/agenticOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,sEAAsE;AACtE,MAAM,kCAAkC,GAAG,uBAAuB,CAAA;AAClE;yEACyE;AACzE,MAAM,6BAA6B,GAAG,4BAA4B,CAAA;AAElE,MAAM,CAAC,MAAM,0BAA0B,GAAoB;IACzD,IAAI,EAAE,WAAW,CAAC,oBAAoB;IACtC,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kCAAkC,CAAC,CAAC,CAAA;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,uEAAuE;QACvE,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;gBACjC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,0EAA0E;IAC1E,oEAAoE;IACpE,oDAAoD;IACpD,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}
+{"version":3,"file":"agenticOrchestrator.js","sourceRoot":"","sources":["../../src/harness/agenticOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,sEAAsE;AACtE,MAAM,kCAAkC,GAAG,uBAAuB,CAAA;AAClE;yEACyE;AACzE,MAAM,6BAA6B,GAAG,4BAA4B,CAAA;AAElE,MAAM,CAAC,MAAM,0BAA0B,GAAoB;IACzD,IAAI,EAAE,WAAW,CAAC,oBAAoB;IACtC,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kCAAkC,CAAC,CAAC,CAAA;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,uEAAuE;QACvE,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;gBACjC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,0EAA0E;IAC1E,oEAAoE;IACpE,oDAAoD;IACpD,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}

package/dist/harness/aiSdkHarness.d.ts

@@ -10,7 +10,7 @@
  * framework, hence `requiresAnyPrefix` rather than a single required package.
  *
  * TWO DOCUMENTED LIMITATIONS carried into the generated `.env.intutic`
- * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types — see
+ * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types, re-read on 1.0.138 — see
  * `@intutic/gate/harness`'s module doc for the full record):
  *
  *   1. Tool execution is SERVER-SIDE, in Vercel Sandbox microVMs — the

package/dist/harness/aiSdkHarness.js

@@ -10,7 +10,7 @@
  * framework, hence `requiresAnyPrefix` rather than a single required package.
  *
  * TWO DOCUMENTED LIMITATIONS carried into the generated `.env.intutic`
- * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types — see
+ * (both confirmed against `@ai-sdk/harness@1.0.75`'s shipped types, re-read on 1.0.138 — see
  * `@intutic/gate/harness`'s module doc for the full record):
  *
  *   1. Tool execution is SERVER-SIDE, in Vercel Sandbox microVMs — the

package/dist/harness/aiSdkWorkflow.d.ts

@@ -13,7 +13,7 @@
  * with both declares `@ai-sdk/workflow` anyway, which is the trigger.
  *
  * DOCUMENTED SEMANTICS carried into the generated `.env.intutic` (confirmed
- * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3` — see
+ * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3`, re-verified on 2.0.58 + 5.0.1 — see
  * `@intutic/gate/workflow`'s module doc for the full record): WorkflowAgent
  * has no agent-level approval option; the veto surface is per-tool
  * `needsApproval`, and a refusal thrown from it must be FatalError-compatible

package/dist/harness/aiSdkWorkflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aiSdkWorkflow.d.ts","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,oBAAoB,sCAY/B,CAAA"}
+{"version":3,"file":"aiSdkWorkflow.d.ts","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,oBAAoB,sCAc/B,CAAA"}

package/dist/harness/aiSdkWorkflow.js

@@ -13,7 +13,7 @@
  * with both declares `@ai-sdk/workflow` anyway, which is the trigger.
  *
  * DOCUMENTED SEMANTICS carried into the generated `.env.intutic` (confirmed
- * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3` — see
+ * against `@ai-sdk/workflow@1.0.69` + `workflow@4.8.3`, re-verified on 2.0.58 + 5.0.1 — see
  * `@intutic/gate/workflow`'s module doc for the full record): WorkflowAgent
  * has no agent-level approval option; the veto surface is per-tool
  * `needsApproval`, and a refusal thrown from it must be FatalError-compatible
@@ -29,8 +29,10 @@ export const aiSdkWorkflowAdapter = makeJsSdkGatedAdapter({
     label: 'AI SDK Workflow',
     requires: [{ name: '@ai-sdk/workflow' }],
     npmInstall: '@intutic/gate',
-    importLine: "import { intuticNeedsApproval, withIntuticApproval } from '@intutic/gate/workflow'",
-    usageSummary: 'new WorkflowAgent({ ..., tools: withIntuticApproval(tools) }) — attaches an async needsApproval ' +
+    importLine: "import { intuticApprovalStep, withIntuticApproval } from '@intutic/gate/workflow'",
+    usageSummary: 'new WorkflowAgent({ ..., tools: withIntuticApproval(tools, { step: intuticGate }) }), where ' +
+        "intuticGate is your own \"use step\" function returning intuticApprovalStep(toolName, input, { gate }) " +
+        '(needsApproval runs in the workflow sandbox, which has no Node.js). Attaches an async needsApproval ' +
         'per tool (WorkflowAgent itself has no approval option). BLOCK throws a FatalError-compatible ' +
         'refusal so the durable runtime aborts instead of retry-looping the denial; ALLOW resolves ' +
         "false (or true with { onAllow: 'human' } to keep the durable human-approval pause).",

package/dist/harness/aiSdkWorkflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"aiSdkWorkflow.js","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;IACxD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACxC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,oFAAoF;IAChG,YAAY,EACV,kGAAkG;QAClG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;IACvF,QAAQ,EAAE,iBAAiB;CAC5B,CAAC,CAAA"}
+{"version":3,"file":"aiSdkWorkflow.js","sourceRoot":"","sources":["../../src/harness/aiSdkWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;IACxD,IAAI,EAAE,WAAW,CAAC,eAAe;IACjC,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACxC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,mFAAmF;IAC/F,YAAY,EACV,8FAA8F;QAC9F,yGAAyG;QACzG,sGAAsG;QACtG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;IACvF,QAAQ,EAAE,iBAAiB;CAC5B,CAAC,CAAA"}

package/dist/harness/aider.d.ts

@@ -1,9 +1,10 @@
 /**
  * aider.ts — Aider adapter (full implementation with safe YAML merge).
  *
- * Writes SOP content into .aider.conf.yml using the aiderConfigMerger
- * which safely merges proxy keys and strips dangerous auto-exec keys
- * (test-cmd, lint-cmd) that Aider auto-executes on startup.
+ * Merges proxy routing into .aider.conf.yml using the aiderConfigMerger,
+ * which keeps the user's own keys, strips dangerous auto-exec keys
+ * (test-cmd, lint-cmd) that Aider auto-executes on startup, and lists the
+ * SOP text as a read-only context file (.intutic/aider-sops.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/aider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,YAAY,EAAE,eAiC1B,CAAA"}
+{"version":3,"file":"aider.d.ts","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,YAAY,EAAE,eAiC1B,CAAA"}

package/dist/harness/aider.js

@@ -1,9 +1,10 @@
 /**
  * aider.ts — Aider adapter (full implementation with safe YAML merge).
  *
- * Writes SOP content into .aider.conf.yml using the aiderConfigMerger
- * which safely merges proxy keys and strips dangerous auto-exec keys
- * (test-cmd, lint-cmd) that Aider auto-executes on startup.
+ * Merges proxy routing into .aider.conf.yml using the aiderConfigMerger,
+ * which keeps the user's own keys, strips dangerous auto-exec keys
+ * (test-cmd, lint-cmd) that Aider auto-executes on startup, and lists the
+ * SOP text as a read-only context file (.intutic/aider-sops.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -32,9 +33,9 @@ export const aiderAdapter = {
             ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
             : undefined;
         // Safe merge: strips test-cmd/lint-cmd, preserves all other user keys,
-        // injects proxy URL as openai-api-base and anthropic-api-base
-        await mergeAiderConfig(filePath, proxyUrl, sopsText);
-        return filePath;
+        // routes OpenAI (openai-api-base) and Anthropic (set-env) models through
+        // the proxy and lists the SOPs as a read-only context file.
+        return (await mergeAiderConfig(filePath, proxyUrl, sopsText)) ? filePath : null;
     },
     async readCurrentHash(workspaceRoot) {
         try {

package/dist/harness/aider.js.map

@@ -1 +1 @@
-{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAA;AAEjF,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAA;QAEb,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACpD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"aider.js","sourceRoot":"","sources":["../../src/harness/aider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAA;AAEjF,MAAM,WAAW,GAAG,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAA;QAEb,uEAAuE;QACvE,yEAAyE;QACzE,4DAA4D;QAC5D,OAAO,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/antigravity.d.ts

@@ -1,8 +1,10 @@
 /**
  * Antigravity adapter — .gemini/settings.json
  *
- * Merges SOP content into the customInstructions field of the
- * Gemini settings JSON file.
+ * Merges SOP content into the customInstructions field of the workspace's
+ * Gemini settings JSON file, and installs the Gemini CLI `BeforeTool` gate in
+ * `~/.gemini/settings.json` (see antigravityHooks.ts). A settings file that is
+ * not a plain JSON object is left alone and reported.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/antigravity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.d.ts","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,kBAAkB,EAAE,eAsDhC,CAAA"}
+{"version":3,"file":"antigravity.d.ts","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,kBAAkB,EAAE,eAsDhC,CAAA"}

package/dist/harness/antigravity.js

@@ -1,18 +1,22 @@
 /**
  * Antigravity adapter — .gemini/settings.json
  *
- * Merges SOP content into the customInstructions field of the
- * Gemini settings JSON file.
+ * Merges SOP content into the customInstructions field of the workspace's
+ * Gemini settings JSON file, and installs the Gemini CLI `BeforeTool` gate in
+ * `~/.gemini/settings.json` (see antigravityHooks.ts). A settings file that is
+ * not a plain JSON object is left alone and reported.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
 import { join } from 'node:path';
-import { access, readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { access, writeFile, rename, mkdir } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
 import { newIso } from '@intutic/id';
+import { loadCredentials } from '../config/store.js';
+import { keepOriginal, readJsonObjectForMerge, writeAntigravityHooks } from '@intutic/sync-daemon';
 const CONFIG_FILE = '.gemini/settings.json';
 export const antigravityAdapter = {
     type: HarnessType.ANTIGRAVITY,
@@ -27,19 +31,18 @@ export const antigravityAdapter = {
         }
     },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
+        // The gate is installed even with zero SOPs: it is what refuses tool
+        // calls, and the built-in protections apply without any SOP.
+        const creds = await loadCredentials();
+        await writeAntigravityHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
         if (sops.length === 0)
             return null;
         const filePath = join(workspaceRoot, CONFIG_FILE);
         const tmpPath = filePath + '.intutic-tmp';
-        // Read existing settings or start fresh
-        let settings = {};
-        try {
-            const existing = await readFile(filePath, 'utf-8');
-            settings = JSON.parse(existing);
-        }
-        catch {
-            // No existing file — start fresh
-        }
+        await keepOriginal(filePath, workspaceRoot);
+        const settings = await readJsonObjectForMerge(filePath);
+        if (settings === null)
+            return null;
         // Merge governance instructions
         const instructions = sops
             .map((sop) => `## ${sop.title}\n\n${sop.content}`)

package/dist/harness/antigravity.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,wCAAwC;QACxC,IAAI,QAAQ,GAA4B,EAAE,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,QAAQ,CAAC,kBAAkB,GAAG;YAC5B,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAElG,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,qBAAqB,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAEnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,MAAM,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAElC,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,QAAQ,CAAC,kBAAkB,GAAG;YAC5B,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/base.d.ts

@@ -9,7 +9,11 @@
  */
 import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
 import type { IHarnessAdapter } from './types.js';
-/** Build markdown content from SOPs (Cursor, Claude Code, Windsurf). */
+/**
+ * Build markdown content from SOPs (Cursor, Claude Code, Windsurf). Each SOP
+ * the control plane synced ends with its `sop://` pointer comment, which maps
+ * the rules in the file back to the SOP that produced them.
+ */
 export declare function buildMarkdownContent(sops: SyncSopEntry[], proxyUrl: string): string;
 /**
  * Create a file-based harness adapter for markdown-style config files.

package/dist/harness/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAejD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,GACrB,eAAe,CAiCjB"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAgBjD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,MAAM,GACrB,eAAe,CA8BjB"}

package/dist/harness/base.js

@@ -8,10 +8,10 @@
  * @module
  */
 import { join } from 'node:path';
-import { access, writeFile, rename, mkdir } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { access } from 'node:fs/promises';
 import { hashFile } from '../lib/hash.js';
 import { newIso } from '@intutic/id';
+import { writeOwnedFile } from '@intutic/sync-daemon';
 /** Header prepended to all governance config files. */
 function buildHeader() {
     return [
@@ -22,12 +22,16 @@ function buildHeader() {
         '',
     ].join('\n');
 }
-/** Build markdown content from SOPs (Cursor, Claude Code, Windsurf). */
+/**
+ * Build markdown content from SOPs (Cursor, Claude Code, Windsurf). Each SOP
+ * the control plane synced ends with its `sop://` pointer comment, which maps
+ * the rules in the file back to the SOP that produced them.
+ */
 export function buildMarkdownContent(sops, proxyUrl) {
     const header = buildHeader();
     const proxySection = `> **Proxy URL:** \`${proxyUrl}\`\n\n`;
     const sopSections = sops
-        .map((sop) => `## ${sop.title}\n\n${sop.content}`)
+        .map((sop) => `## ${sop.title}\n\n${sop.content}${sop.sopRef ? `\n${sop.sopRef}` : ''}`)
         .join('\n\n---\n\n');
     return header + proxySection + sopSections + '\n';
 }
@@ -53,11 +57,8 @@ export function createMarkdownAdapter(type, configFileName) {
             if (sops.length === 0)
                 return null;
             const filePath = join(workspaceRoot, configFileName);
-            const tmpPath = filePath + '.intutic-tmp';
             const content = buildMarkdownContent(sops, proxyUrl);
-            await mkdir(dirname(filePath), { recursive: true });
-            await writeFile(tmpPath, content, 'utf-8');
-            await rename(tmpPath, filePath);
+            await writeOwnedFile(filePath, workspaceRoot, content);
             return filePath;
         },
         async readCurrentHash(workspaceRoot) {

package/dist/harness/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,uDAAuD;AACvD,SAAS,WAAW;IAClB,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,QAAQ,QAAQ,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI;SACrB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;SACjD,IAAI,CAAC,aAAa,CAAC,CAAA;IACtB,OAAO,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,IAAI,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAiB,EACjB,cAAsB;IAEtB,OAAO;QACL,IAAI;QACJ,cAAc;QAEd,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;YACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC/B,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/harness/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,uDAAuD;AACvD,SAAS,WAAW;IAClB,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,QAAQ,QAAQ,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI;SACrB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACvF,IAAI,CAAC,aAAa,CAAC,CAAA;IACtB,OAAO,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,IAAI,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAiB,EACjB,cAAsB;IAEtB,OAAO;QACL,IAAI;QACJ,cAAc;QAEd,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;YACtD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/harness/cline.d.ts

@@ -1,9 +1,15 @@
 /**
- * cline.ts — Cline adapter (full implementation).
+ * cline.ts — Cline adapter.
  *
- * Detects the Cline VS Code extension, writes Intutic governance rules
- * as .clinerules (flat file), injects the PreToolUse blocking hook into .cline/hooks/,
- * and configures the proxy base URL via VS Code settings + .env.intutic sidecar.
+ * Detects the Cline VS Code extension, writes Intutic governance rules to
+ * `.clinerules/intutic-governance.md` and installs the PreToolUse gate at
+ * `.clinerules/hooks/PreToolUse` (see clineHooks.ts — `.clinerules` is a
+ * directory so both fit; a flat `.clinerules` an earlier version wrote is
+ * converted, one the user wrote is left alone).
+ *
+ * Cline keeps its API provider and base URL in its own settings panel, not in
+ * any file this adapter can write, so routing Cline through the proxy is a
+ * manual step (see the Cline integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/cline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}