@intutic/cli 2.1.0 → 2.3.0

package/dist/harness/rooCode.d.ts

@@ -1,11 +1,18 @@
 /**
  * rooCode.ts — Roo Code adapter.
  *
- * Detects the Roo Code VS Code extension and writes Intutic governance rules
- * as .roorules. Roo Code has no hook system to install a tool-call gate into,
- * and keeps its API provider and base URL in its own settings panel rather
- * than in any file this adapter can write, so routing it through the proxy is
- * a manual step (see the Roo Code integration page).
+ * Detects the Roo Code VS Code extension and writes the rule sets into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts). Roo reads
+ * `AGENTS.md` at the workspace root unless `roo-cline.useAgentRules` is off,
+ * the default being on. Not `.roo/rules/`: once that directory has a file,
+ * Roo stops reading a `.roorules` or `.clinerules` the user keeps
+ * (https://github.com/RooCodeInc/Roo-Code/blob/b867ec9145750d0ae1ff7f02d35406e9bf2a0b16/src/core/prompts/sections/custom-instructions.ts).
+ * Earlier versions overwrote `.roorules`; the user's own copy comes back.
+ *
+ * Roo Code has no hook system to install a tool-call gate into, and keeps its
+ * API provider and base URL in its own settings panel rather than in any file
+ * this adapter can write, so routing it through the proxy is a manual step
+ * (see the Roo Code integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/rooCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rooCode.d.ts","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,cAAc,EAAE,eAyD5B,CAAA"}
+{"version":3,"file":"rooCode.d.ts","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,cAAc,EAAE,eA8B5B,CAAA"}

package/dist/harness/rooCode.js

@@ -1,28 +1,34 @@
 /**
  * rooCode.ts — Roo Code adapter.
  *
- * Detects the Roo Code VS Code extension and writes Intutic governance rules
- * as .roorules. Roo Code has no hook system to install a tool-call gate into,
- * and keeps its API provider and base URL in its own settings panel rather
- * than in any file this adapter can write, so routing it through the proxy is
- * a manual step (see the Roo Code integration page).
+ * Detects the Roo Code VS Code extension and writes the rule sets into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts). Roo reads
+ * `AGENTS.md` at the workspace root unless `roo-cline.useAgentRules` is off,
+ * the default being on. Not `.roo/rules/`: once that directory has a file,
+ * Roo stops reading a `.roorules` or `.clinerules` the user keeps
+ * (https://github.com/RooCodeInc/Roo-Code/blob/b867ec9145750d0ae1ff7f02d35406e9bf2a0b16/src/core/prompts/sections/custom-instructions.ts).
+ * Earlier versions overwrote `.roorules`; the user's own copy comes back.
+ *
+ * Roo Code has no hook system to install a tool-call gate into, and keeps its
+ * API provider and base URL in its own settings panel rather than in any file
+ * this adapter can write, so routing it through the proxy is a manual step
+ * (see the Roo Code integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
-import { access, readdir, writeFile, rename, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
+import { access, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
-const CONFIG_FILE = '.roorules';
+import { AGENTS_MD, agentsMdHash, writeAgentsMd } from './agentsMd.js';
+import { retireLegacyRulesFile } from './rulesFiles.js';
+const LEGACY_FILE = '.roorules';
 export const rooCodeAdapter = {
     type: HarnessType.ROO_CODE,
-    configFileName: CONFIG_FILE,
+    configFileName: AGENTS_MD,
     async detect(workspaceRoot) {
-        // Check for .roomodes or .roorules in workspace
-        for (const marker of ['.roomodes', '.roorules']) {
+        for (const marker of ['.roomodes', LEGACY_FILE]) {
             try {
                 await access(join(workspaceRoot, marker));
                 return true;
@@ -31,44 +37,20 @@ export const rooCodeAdapter = {
                 // fall through
             }
         }
-        // Check for VS Code extension directory
         try {
-            const extensionsDir = join(homedir(), '.vscode', 'extensions');
-            const entries = await readdir(extensionsDir);
+            const entries = await readdir(join(homedir(), '.vscode', 'extensions'));
             return entries.some((entry) => entry.startsWith('rooveterinaryinc.roo-cline-'));
         }
         catch {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, sops, _proxyUrl) {
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const instructions = sops.length > 0
-            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
-            : '# Intutic governance active — no SOP rules configured yet.';
-        const content = [
-            '# Intutic Governance Rules (auto-generated)',
-            '# DO NOT EDIT — managed by intutic sync daemon',
-            `# Last sync: ${newIso()}`,
-            '# NOTE: Roo Code has no hook system, so these rules are advisory.',
-            '# Governance is enforced via the proxy and the drift guard.',
-            '',
-            instructions,
-            '',
-        ].join('\n');
-        await mkdir(dirname(filePath), { recursive: true });
-        const tmp = filePath + '.intutic-tmp';
-        await writeFile(tmp, content, 'utf-8');
-        await rename(tmp, filePath);
-        return filePath;
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        await retireLegacyRulesFile(workspaceRoot, LEGACY_FILE);
+        return writeAgentsMd(workspaceRoot, sops, proxyUrl);
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    readCurrentHash(workspaceRoot) {
+        return agentsMdHash(workspaceRoot);
     },
 };
 //# sourceMappingURL=rooCode.js.map

package/dist/harness/rooCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"rooCode.js","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,gDAAgD;QAChD,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;gBACzC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,SAAiB;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,4DAA4D,CAAA;QAEhE,MAAM,OAAO,GAAG;YACd,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,mEAAmE;YACnE,6DAA6D;YAC7D,EAAE;YACF,YAAY;YACZ,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;QACrC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAE3B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"rooCode.js","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,SAAS;IAEzB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;gBACzC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;YACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrD,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC;CACF,CAAA"}

package/dist/harness/rulesFiles.d.ts

@@ -0,0 +1,53 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import type { SyncSopEntry } from '@intutic/shared-types';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export declare function buildSopSections(sops: SyncSopEntry[]): string;
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export declare function buildRulesBody(sops: SyncSopEntry[], proxyUrl: string, shape: 'section' | 'file'): string;
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeRulesSectionFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export declare function rulesSectionHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeOwnRulesFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string, frontMatter?: string): Promise<string | null>;
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export declare function ownRulesFileHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export declare function retireLegacyRulesFile(workspaceRoot: string, relPath: string): Promise<void>;
+//# sourceMappingURL=rulesFiles.d.ts.map

package/dist/harness/rulesFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.d.ts","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAIzD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAWxG;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASrG;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,0EAA0E;AAC1E,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMrG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F"}

package/dist/harness/rulesFiles.js

@@ -0,0 +1,106 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { retireRulesFile, rulesSectionOf, writeOwnedFile, writeRulesSection } from '@intutic/sync-daemon';
+import { hashFile, hashString } from '../lib/hash.js';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export function buildSopSections(sops) {
+    return sops
+        .map((sop) => `## ${sop.title}\n\n${sop.content}${sop.sopRef ? `\n${sop.sopRef}` : ''}`)
+        .join('\n\n---\n\n');
+}
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export function buildRulesBody(sops, proxyUrl, shape) {
+    return [
+        '# Intutic Governance Rules (auto-generated)',
+        shape === 'section'
+            ? '# DO NOT EDIT this section — managed by intutic sync daemon; edit outside the INTUTIC:RULES markers'
+            : '# DO NOT EDIT — managed by intutic sync daemon; put rules of your own in another file',
+        '',
+        `> **Proxy URL:** \`${proxyUrl}\``,
+        '',
+        buildSopSections(sops),
+    ].join('\n');
+}
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export async function writeRulesSectionFile(workspaceRoot, relPath, sops, proxyUrl) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    await writeRulesSection(filePath, workspaceRoot, buildRulesBody(sops, proxyUrl, 'section'));
+    return filePath;
+}
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export async function rulesSectionHash(workspaceRoot, relPath) {
+    let content;
+    try {
+        content = await readFile(join(workspaceRoot, relPath), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const section = rulesSectionOf(content);
+    return section === null ? null : hashString(section);
+}
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export async function writeOwnRulesFile(workspaceRoot, relPath, sops, proxyUrl, frontMatter) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    const body = `${buildRulesBody(sops, proxyUrl, 'file')}\n`;
+    const content = frontMatter ? `---\n${frontMatter.trimEnd()}\n---\n\n${body}` : body;
+    // Unchanged rule sets leave the file, and its modification time, alone.
+    if ((await readFile(filePath, 'utf-8').catch(() => null)) !== content)
+        await writeOwnedFile(filePath, workspaceRoot, content);
+    return filePath;
+}
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export async function ownRulesFileHash(workspaceRoot, relPath) {
+    try {
+        return await hashFile(join(workspaceRoot, relPath));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export function retireLegacyRulesFile(workspaceRoot, relPath) {
+    return retireRulesFile(join(workspaceRoot, relPath), workspaceRoot);
+}
+//# sourceMappingURL=rulesFiles.js.map

package/dist/harness/rulesFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.js","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACzG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACvF,IAAI,CAAC,aAAa,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,QAAgB,EAAE,KAAyB;IAC9F,OAAO;QACL,6CAA6C;QAC7C,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,qGAAqG;YACvG,CAAC,CAAC,uFAAuF;QAC3F,EAAE;QACF,sBAAsB,QAAQ,IAAI;QAClC,EAAE;QACF,gBAAgB,CAAC,IAAI,CAAC;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAC3F,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,wEAAwE;IACxE,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7H,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAe;IAC1E,OAAO,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;AACrE,CAAC"}

package/dist/harness/sdkGatedAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdkGatedAdapter.d.ts","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,uBAAuB,CAAA;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAE7C,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,IAAI,EAAE,WAAW,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;IACpC,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAOD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAwDhF"}
+{"version":3,"file":"sdkGatedAdapter.d.ts","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,uBAAuB,CAAA;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAUjD;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAE7C,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,IAAI,EAAE,WAAW,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;IACpC,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAOD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAqDhF"}

package/dist/harness/sdkGatedAdapter.js

@@ -16,11 +16,12 @@
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
-import { join, dirname } from 'node:path';
-import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
 import { anthropicBaseUrl, openaiBaseUrl, proxyHost } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
 import { newIso } from '@intutic/id';
+import { writeOwnedFile } from '@intutic/sync-daemon';
 const CONFIG_FILE = '.env.intutic';
 /** Dependency manifests scanned by default — same three langgraph.ts uses. */
 const DEFAULT_MANIFEST_FILES = ['pyproject.toml', 'requirements.txt', 'uv.lock'];
@@ -67,10 +68,7 @@ export function makeSdkGatedAdapter(spec) {
                 `# See https://docs.intutic.ai/integrations/${spec.docsSlug}`,
                 '',
             ].join('\n');
-            await mkdir(dirname(filePath), { recursive: true });
-            const tmpEnv = filePath + '.intutic-tmp';
-            await writeFile(tmpEnv, envContent, 'utf-8');
-            await rename(tmpEnv, filePath);
+            await writeOwnedFile(filePath, workspaceRoot, envContent);
             return filePath;
         },
         async readCurrentHash(workspaceRoot) {

package/dist/harness/sdkGatedAdapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdkGatedAdapter.js","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAoCzF,SAAS,OAAO,CAAC,OAAe,EAAE,QAAoC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAA;IAElE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,WAAW;QAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;oBACtE,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;wBAAE,OAAO,IAAI,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG;gBACjB,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,yCAAyC;gBACzC,EAAE;gBACF,8BAA8B,gBAAgB,CAAC,QAAQ,CAAC,GAAG;gBAC3D,2BAA2B,aAAa,CAAC,QAAQ,CAAC,GAAG;gBACrD,6BAA6B,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACnD,4BAA4B,IAAI,CAAC,MAAM,EAAE;gBACzC,EAAE;gBACF,4CAA4C,IAAI,CAAC,KAAK,wBAAwB;gBAC9E,oEAAoE;gBACpE,sCAAsC;gBACtC,mBAAmB,IAAI,CAAC,UAAU,EAAE;gBACpC,OAAO,IAAI,CAAC,UAAU,EAAE;gBACxB,KAAK,IAAI,CAAC,YAAY,EAAE;gBACxB,8CAA8C,IAAI,CAAC,QAAQ,EAAE;gBAC7D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAA;YACxC,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAE9B,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"sdkGatedAdapter.js","sourceRoot":"","sources":["../../src/harness/sdkGatedAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAA;AAoCzF,SAAS,OAAO,CAAC,OAAe,EAAE,QAAoC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAA;IAElE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,WAAW;QAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;YAChC,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;oBACtE,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;wBAAE,OAAO,IAAI,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;YAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG;gBACjB,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,yCAAyC;gBACzC,EAAE;gBACF,8BAA8B,gBAAgB,CAAC,QAAQ,CAAC,GAAG;gBAC3D,2BAA2B,aAAa,CAAC,QAAQ,CAAC,GAAG;gBACrD,6BAA6B,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACnD,4BAA4B,IAAI,CAAC,MAAM,EAAE;gBACzC,EAAE;gBACF,4CAA4C,IAAI,CAAC,KAAK,wBAAwB;gBAC9E,oEAAoE;gBACpE,sCAAsC;gBACtC,mBAAmB,IAAI,CAAC,UAAU,EAAE;gBACpC,OAAO,IAAI,CAAC,UAAU,EAAE;gBACxB,KAAK,IAAI,CAAC,YAAY,EAAE;gBACxB,8CAA8C,IAAI,CAAC,QAAQ,EAAE;gBAC7D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;YAEzD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,aAAqB;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/harness/smolagents.d.ts

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/smolagents.js

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -27,7 +27,7 @@ export const smolagentsAdapter = makeSdkGatedAdapter({
     pipInstall: 'intutic-clawde[smolagents]',
     importLine: 'from intutic_clawde.gate.adapters.smolagents import IntuticPythonExecutor',
     usageSummary: 'IntuticPythonExecutor gates CodeAgent\'s generated code text before running it; ' +
-        'ToolCallingAgent tools are covered by @guard/guard_tools instead (see TD-377).',
+        'ToolCallingAgent tools are covered by @guard/guard_tools instead.',
     docsSlug: 'smolagents',
 });
 //# sourceMappingURL=smolagents.js.map

package/dist/harness/smolagents.js.map

@@ -1 +1 @@
-{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,gFAAgF;IAClF,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}
+{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,mEAAmE;IACrE,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}

package/dist/harness/types.d.ts

@@ -5,7 +5,6 @@
  * config to its native config file, and read the current file hash.
  *
  * HLD §3.14 — Harness Onboarding Matrix
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
@@ -13,18 +12,33 @@ import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
 export interface IHarnessAdapter {
     /** Harness type identifier. */
     readonly type: HarnessType;
-    /** Config file name relative to workspace root. */
+    /**
+     * The file drift is tracked on, relative to the workspace root: the
+     * harness's rules file when it has one in the workspace (`rulesFileOf` in
+     * `@intutic/shared-types`), else the workspace file the adapter writes; ''
+     * for none.
+     */
     readonly configFileName: string;
     /** Detect whether this harness is present in the workspace. */
     detect(workspaceRoot: string): Promise<boolean>;
     /**
-     * Write governance config to the harness's native config file.
-     * Returns the absolute path written, or null if skipped.
+     * Install what governs this harness whatever rule sets the workspace has:
+     * its tool-call gate, and the proxy routing that rides with it. The gate
+     * enforces the built-in protections, the destructive-command tier, group
+     * rules and holds, none of which need a rule set, so `intutic connect` runs
+     * this for every configured harness. Absent when the harness has no gate
+     * Intutic installs.
+     */
+    installGate?(workspaceRoot: string, proxyUrl: string): Promise<void>;
+    /**
+     * Write the rule sets into the file the harness reads as standing
+     * instructions — the one `HARNESS_RULES_FILES` names, and no other.
+     * `intutic connect` calls it only when a rule set targets the harness, or
+     * on a forced sync. Returns the absolute path written, or null if nothing
+     * was.
      */
     writeConfig(workspaceRoot: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
     /** Read SHA-256 hash of current config file content. Returns null if file doesn't exist. */
     readCurrentHash(workspaceRoot: string): Promise<string | null>;
 }
-/** Harness config file mapping for file-based harnesses. */
-export declare const HARNESS_CONFIG_FILES: Record<HarnessType, string>;
 //# sourceMappingURL=types.d.ts.map

package/dist/harness/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;OAGG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CA4F5D,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;;;OAOG;IACH,WAAW,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D"}

package/dist/harness/types.js

@@ -5,101 +5,7 @@
  * config to its native config file, and read the current file hash.
  *
  * HLD §3.14 — Harness Onboarding Matrix
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
-/** Harness config file mapping for file-based harnesses. */
-export const HARNESS_CONFIG_FILES = {
-    'cursor': '.cursorrules',
-    'claude-code': 'CLAUDE.md',
-    'antigravity': '.gemini/settings.json',
-    'windsurf': '.windsurfrules',
-    'aider': '.aider.conf.yml',
-    'openhands': 'config.toml',
-    'codex': '.env.intutic',
-    'n8n': '', // Phase 2 — TD-037: API call, not file write
-    'openclaw': '.openclaw/openclaw.json',
-    'hermes': '.hermes/config.yaml',
-    'pi': '.pi/hooks.json',
-    'github-copilot': '.github/copilot-instructions.md',
-    'cline': '',
-    'roo-code': '',
-    'continue': '',
-    'claude-desktop': '',
-    'goose': '',
-    'open-webui': '',
-    'langgraph': '.env.intutic',
-    // Muse Code reads AGENTS.md (falling back to CLAUDE.md) — see muse.ts.
-    'muse-code': 'AGENTS.md',
-    // AGENTS.md is Grok Build's native rules file — the same cross-tool
-    // convention Codex/Amp read. Delivered via the generic markdown formatter
-    // (`buildMarkdownContent`/`formatMarkdown`) every `---`-separated rules
-    // file in this codebase already shares (Cursor, Claude Code, Windsurf,
-    // GitHub Copilot) — not a bespoke format.
-    'grok': 'AGENTS.md',
-    // OpenCode reads AGENTS.md (CLAUDE.md fallback) — see opencode.ts. The gate
-    // is the plugin `openCodeHooks.ts` generates, not this file.
-    'opencode': 'AGENTS.md',
-    // dsh has no workspace-relative rules file in the research this phase could
-    // verify — its config lives entirely under $DSH_HOME (profiles/*/cordis.patch.yml,
-    // settings.yaml), not the project workspace. Empty, matching goose/cline/
-    // continue/claude-desktop/open-webui's precedent for "no single canonical
-    // file" harnesses; dsh.ts's own adapter resolves its real paths directly.
-    'dsh': '',
-    // Xirp writes no config of its own — see xirp.ts's module doc. It
-    // orchestrates other already-gated harnesses (Claude Code, Codex,
-    // Antigravity/Gemini CLI), whose own adapters do the real writing.
-    'xirp': '',
-    // Agentic Orchestrator writes no config of its own — see
-    // agenticOrchestrator.ts's module doc. It orchestrates other CLI backends
-    // (Claude Code, Codex, OpenCode), whose own adapters do the real writing.
-    'agentic-orchestrator': '',
-    // Wave 1 SDK-gated frameworks — same rationale as langgraph above: no
-    // on-disk hook/config file exists to gate tool calls, so each of these
-    // writes .env.intutic (proxy base-URL vars + an SDK-gate pointer comment).
-    'langchain': '.env.intutic',
-    'crewai': '.env.intutic',
-    'autogen': '.env.intutic',
-    'ag2': '.env.intutic',
-    'google-adk': '.env.intutic',
-    'openai-agents': '.env.intutic',
-    'pydantic-ai': '.env.intutic',
-    'smolagents': '.env.intutic',
-    // A4: AWS Strands Agents — same Python SDK-gated rationale as the Wave 1
-    // family above (gate ships in intutic_clawde.gate.adapters.strands).
-    'strands': '.env.intutic',
-    // TD-375: Microsoft Agent Framework — same Python SDK-gated rationale
-    // (gate ships in intutic_clawde.gate.adapters.agent_framework).
-    'agent-framework': '.env.intutic',
-    // T2: JS/TS SDK-gated frameworks — same rationale as the Wave 1 Python
-    // family above, but the blocking gate ships in @intutic/gate
-    // (packages/gate-js) rather than intutic-clawde.
-    'mastra': '.env.intutic',
-    'vercel-ai-sdk': '.env.intutic',
-    // eve (Vercel, PREVIEW) — same JS/TS SDK-gated family; detection is a
-    // compound `eve` dep + `agent/` directory check — see eve.ts.
-    'eve': '.env.intutic',
-    // TrueForge (embedded-library mode only — see trueforge.ts's module doc
-    // and the HarnessType.TRUEFORGE doc comment); same JS/TS SDK-gated family.
-    'trueforge': '.env.intutic',
-    // A3: Vercel platform-agent runtimes — same @intutic/gate family. Note the
-    // env vars are weaker still for ai-sdk-harness (tool execution is
-    // server-side in Vercel Sandbox microVMs; see aiSdkHarness.ts's module doc
-    // and the envPreamble override it carries).
-    'ai-sdk-harness': '.env.intutic',
-    'ai-sdk-workflow': '.env.intutic',
-    // B2: AWS Bedrock AgentCore Runtime — hosts the customer's own framework
-    // code unchanged; the actual tool-call gate belongs to whichever
-    // already-supported framework adapter that code uses (Strands, LangGraph,
-    // ...), same 'delegated'/no-file-of-its-own shape as xirp/
-    // agentic-orchestrator above. See agentcore.ts's module doc.
-    'agentcore-runtime': '',
-    // B3: TrueForge, standalone/hosted server (see the HarnessType.TRUEFORGE_SERVER
-    // doc comment) — no CLI adapter exists for this row at all: it is an
-    // operator-configured deployment, not a package.json dependency of
-    // whatever repo `intutic init` runs against, so there is nothing for this
-    // detector to find and no config file to write. Governed entirely by
-    // services/trueforge-bridge instead (GateKind: 'bridge').
-    'trueforge-server': '',
-};
+export {};
 //# sourceMappingURL=types.js.map

package/dist/harness/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,uBAAuB;IACtC,UAAU,EAAE,gBAAgB;IAC5B,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,EAAE,EAAE,6CAA6C;IACxD,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,qBAAqB;IAC/B,IAAI,EAAE,gBAAgB;IACtB,gBAAgB,EAAE,iCAAiC;IACnD,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,gBAAgB,EAAE,EAAE;IACpB,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,EAAE;IAChB,WAAW,EAAE,cAAc;IAC3B,uEAAuE;IACvE,WAAW,EAAE,WAAW;IACxB,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,0CAA0C;IAC1C,MAAM,EAAE,WAAW;IACnB,4EAA4E;IAC5E,6DAA6D;IAC7D,UAAU,EAAE,WAAW;IACvB,4EAA4E;IAC5E,mFAAmF;IACnF,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,KAAK,EAAE,EAAE;IACT,kEAAkE;IAClE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,EAAE,EAAE;IACV,yDAAyD;IACzD,0EAA0E;IAC1E,0EAA0E;IAC1E,sBAAsB,EAAE,EAAE;IAC1B,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,cAAc;IAC3B,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,cAAc;IACzB,KAAK,EAAE,cAAc;IACrB,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,cAAc;IAC/B,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,cAAc;IAC5B,yEAAyE;IACzE,qEAAqE;IACrE,SAAS,EAAE,cAAc;IACzB,sEAAsE;IACtE,gEAAgE;IAChE,iBAAiB,EAAE,cAAc;IACjC,uEAAuE;IACvE,6DAA6D;IAC7D,iDAAiD;IACjD,QAAQ,EAAE,cAAc;IACxB,eAAe,EAAE,cAAc;IAC/B,sEAAsE;IACtE,8DAA8D;IAC9D,KAAK,EAAE,cAAc;IACrB,wEAAwE;IACxE,2EAA2E;IAC3E,WAAW,EAAE,cAAc;IAC3B,2EAA2E;IAC3E,kEAAkE;IAClE,2EAA2E;IAC3E,4CAA4C;IAC5C,gBAAgB,EAAE,cAAc;IAChC,iBAAiB,EAAE,cAAc;IACjC,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,2DAA2D;IAC3D,6DAA6D;IAC7D,mBAAmB,EAAE,EAAE;IACvB,gFAAgF;IAChF,qEAAqE;IACrE,mEAAmE;IACnE,0EAA0E;IAC1E,qEAAqE;IACrE,0DAA0D;IAC1D,kBAAkB,EAAE,EAAE;CACvB,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/harness/windsurf.d.ts

@@ -1,10 +1,15 @@
 /**
  * windsurf.ts — Windsurf adapter (full implementation with hooks + TLS MITM proxy config).
  *
- * Writes .windsurfrules governance text and injects Cascade hook scripts
+ * Writes the rule sets to `.windsurf/rules/intutic-governance.md` with
+ * `trigger: always_on`, which Cascade includes in every message
+ * (https://docs.devin.ai/desktop/cascade/memories, where Windsurf's rules
+ * docs now live; `.windsurfrules`, which earlier versions overwrote, is the
+ * legacy single file, and the user's own copy of it comes back), and injects
+ * Cascade hook scripts
  * at user-level (~/.codeium/windsurf/hooks.json) and workspace-level
  * (.windsurf/hooks.json), merged with any hooks already there. Also merges
- * HTTP proxy settings into ~/.codeium/windsurf/settings.json, and switches
+ * HTTP proxy settings into Windsurf's user settings.json, and switches
  * the IDE HTTP proxy of every JetBrains IDE where the Windsurf plugin is set
  * up, so Windsurf's AI traffic goes through the Intutic TLS MITM proxy.
  *

package/dist/harness/windsurf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAWjD,eAAO,MAAM,eAAe,EAAE,eAkC7B,CAAA"}
+{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,eAAe,EAAE,eA4B7B,CAAA"}