@intutic/cli 2.2.0 → 2.3.0

package/dist/harness/openhands.js

@@ -1,9 +1,15 @@
 /**
  * openhands.ts — OpenHands adapter (full implementation with hooks + llm.base_url).
  *
- * Merges SOP content ([intutic]) and llm.base_url ([llm]) into config.toml,
- * keeping the rest of the file, and injects PreToolUse hooks via
- * .openhands/hooks.json.
+ * - rules: `.openhands/microagents/intutic-governance.md`, a repository
+ *   microagent with no triggers, which OpenHands keeps active in every
+ *   conversation (V0's `microagent.py`: "no triggers -> REPO (always
+ *   active)"; the V1 software-agent SDK loads the same directory as legacy
+ *   skills, "no keywords -> always active"). Earlier versions put the rules
+ *   in an `[intutic]` table of `config.toml`, which OpenHands never reads;
+ *   connect drops that table and disconnect removes it;
+ * - `[llm] base_url` merged into `config.toml`, keeping the rest of the file;
+ * - the PreToolUse hook in `.openhands/hooks.json`.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -15,10 +21,12 @@ import { hashFile } from '../lib/hash.js';
 import { writeOpenHandsHooks, mergeOpenHandsToml, isOpenHandsConfig } from '@intutic/sync-daemon/harness/openhandsHooks';
 import { keepOriginal } from '@intutic/sync-daemon';
 import { log } from '../lib/logger.js';
+import { writeOwnRulesFile } from './rulesFiles.js';
 const CONFIG_FILE = 'config.toml';
+const RULES_FILE = '.openhands/microagents/intutic-governance.md';
 export const openhandsAdapter = {
     type: HarnessType.OPENHANDS,
-    configFileName: CONFIG_FILE,
+    configFileName: RULES_FILE,
     // `.openhands/` is OpenHands' own per-repository directory (`setup.sh`,
     // microagents). Without it, a `config.toml` counts only when it is an
     // OpenHands configuration: the file name alone matched every Hugo site and
@@ -38,39 +46,37 @@ export const openhandsAdapter = {
             return false;
         }
     },
+    /** The .openhands/hooks.json PreToolUse hook. */
+    async installGate(workspaceRoot, proxyUrl) {
+        await writeOpenHandsHooks(workspaceRoot, proxyUrl);
+    },
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const instructions = sops.length > 0
-            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
-            : '# Intutic governance active — no SOP rules configured yet.';
-        // Merged into the user's config.toml: [llm] base_url and an [intutic]
-        // table for the SOP text; everything else is kept. A file that does not
-        // parse is left alone.
+        // Merged into the user's config.toml: [llm] base_url; everything else is
+        // kept. A file that does not parse is left alone.
+        const configPath = join(workspaceRoot, CONFIG_FILE);
         let raw = '';
         try {
-            raw = await readFile(filePath, 'utf-8');
+            raw = await readFile(configPath, 'utf-8');
         }
         catch { /* no config.toml yet */ }
-        const merged = mergeOpenHandsToml(raw, proxyUrl, instructions);
+        const merged = mergeOpenHandsToml(raw, proxyUrl);
         let written = null;
         if (merged === null) {
-            log.warn(`${filePath} is not valid TOML — left untouched`);
+            log.warn(`${configPath} is not valid TOML — left untouched`);
         }
-        else {
-            const tmpPath = filePath + '.intutic-tmp';
-            await keepOriginal(filePath, workspaceRoot);
-            await mkdir(dirname(filePath), { recursive: true });
+        else if (merged !== raw) {
+            const tmpPath = configPath + '.intutic-tmp';
+            await keepOriginal(configPath, workspaceRoot);
+            await mkdir(dirname(configPath), { recursive: true });
             await writeFile(tmpPath, merged, 'utf-8');
-            await rename(tmpPath, filePath);
-            written = filePath;
+            await rename(tmpPath, configPath);
+            written = configPath;
         }
-        // Inject .openhands/hooks.json PreToolUse hook
-        await writeOpenHandsHooks(workspaceRoot, proxyUrl);
-        return written;
+        return (await writeOwnRulesFile(workspaceRoot, RULES_FILE, sops, proxyUrl)) ?? written;
     },
     async readCurrentHash(workspaceRoot) {
         try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
+            return await hashFile(join(workspaceRoot, RULES_FILE));
         }
         catch {
             return null;

package/dist/harness/openhands.js.map

@@ -1 +1 @@
-{"version":3,"file":"openhands.js","sourceRoot":"","sources":["../../src/harness/openhands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAEtC,MAAM,WAAW,GAAG,aAAa,CAAA;AAEjC,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,WAAW;IAE3B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,wCAAwC;IACxC,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,4DAA4D,CAAA;QAEhE,sEAAsE;QACtE,wEAAwE;QACxE,uBAAuB;QACvB,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC9D,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;YACzC,MAAM,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC/B,OAAO,GAAG,QAAQ,CAAA;QACpB,CAAC;QAED,+CAA+C;QAC/C,MAAM,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAElD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"openhands.js","sourceRoot":"","sources":["../../src/harness/openhands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AACxH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,WAAW,GAAG,aAAa,CAAA;AACjC,MAAM,UAAU,GAAG,8CAA8C,CAAA;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,IAAI,EAAE,WAAW,CAAC,SAAS;IAC3B,cAAc,EAAE,UAAU;IAE1B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,wCAAwC;IACxC,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACnD,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAChD,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,qCAAqC,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;YAC3C,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACjC,OAAO,GAAG,UAAU,CAAA;QACtB,CAAC;QAED,OAAO,CAAC,MAAM,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/pi.d.ts

@@ -1,8 +1,13 @@
 /**
  * pi.ts — Pi adapter.
  *
- * Detects Pi presence and invokes the sync-daemon hooks compiler
- * to inject Intutic pre-tool use gates.
+ * Detects Pi (its `~/.pi` home, or a project's `.pi` directory) and installs
+ * the gate: an extension in `~/.pi/agent/extensions/` (see piHooks.ts).
+ *
+ * Pi loads `AGENTS.md` from its agent directory and from every directory
+ * between where it runs and the filesystem root, so the rule sets go into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts;
+ * https://github.com/earendil-works/pi/blob/6fb2e7815167e6b19006fc526d1a5d0f5f998787/packages/coding-agent/docs/configuration.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../../src/harness/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,SAAS,EAAE,eA+BvB,CAAA"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../../src/harness/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,SAAS,EAAE,eA4BvB,CAAA"}

package/dist/harness/pi.js

@@ -1,8 +1,13 @@
 /**
  * pi.ts — Pi adapter.
  *
- * Detects Pi presence and invokes the sync-daemon hooks compiler
- * to inject Intutic pre-tool use gates.
+ * Detects Pi (its `~/.pi` home, or a project's `.pi` directory) and installs
+ * the gate: an extension in `~/.pi/agent/extensions/` (see piHooks.ts).
+ *
+ * Pi loads `AGENTS.md` from its agent directory and from every directory
+ * between where it runs and the filesystem root, so the rule sets go into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts;
+ * https://github.com/earendil-works/pi/blob/6fb2e7815167e6b19006fc526d1a5d0f5f998787/packages/coding-agent/docs/configuration.md).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -12,16 +17,17 @@ import { access } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
 import { loadCredentials } from '../config/store.js';
+import { AGENTS_MD, agentsMdHash, writeAgentsMd } from './agentsMd.js';
 import { writePiHooks } from '@intutic/sync-daemon';
-const CONFIG_FILE = '.pi/hooks.json';
+/** A project's Pi configuration directory (settings, extensions, MCP servers). */
+const DETECT_FILE = '.pi';
 export const piAdapter = {
     type: HarnessType.PI,
-    configFileName: CONFIG_FILE,
+    configFileName: AGENTS_MD,
     async detect(workspaceRoot) {
         const globalPi = join(homedir(), '.pi');
-        const localPi = join(workspaceRoot, CONFIG_FILE);
+        const localPi = join(workspaceRoot, DETECT_FILE);
         try {
             if (existsSync(globalPi))
                 return true;
@@ -32,20 +38,15 @@ export const piAdapter = {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, _sops, proxyUrl) {
-        const filePath = join(workspaceRoot, CONFIG_FILE);
+    async installGate(workspaceRoot, proxyUrl) {
         const creds = await loadCredentials();
-        const workspaceId = creds?.workspaceId || 'local';
-        await writePiHooks(workspaceRoot, proxyUrl, workspaceId);
-        return filePath;
+        await writePiHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    writeConfig(workspaceRoot, sops, proxyUrl) {
+        return writeAgentsMd(workspaceRoot, sops, proxyUrl);
+    },
+    readCurrentHash(workspaceRoot) {
+        return agentsMdHash(workspaceRoot);
     },
 };
 //# sourceMappingURL=pi.js.map

package/dist/harness/pi.js.map

@@ -1 +1 @@
-{"version":3,"file":"pi.js","sourceRoot":"","sources":["../../src/harness/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAEpC,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,IAAI,EAAE,WAAW,CAAC,EAAE;IACpB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAChD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,KAAqB,EAAE,QAAgB;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,OAAO,CAAA;QACjD,MAAM,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACxD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"pi.js","sourceRoot":"","sources":["../../src/harness/pi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,kFAAkF;AAClF,MAAM,WAAW,GAAG,KAAK,CAAA;AAEzB,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,IAAI,EAAE,WAAW,CAAC,EAAE;IACpB,cAAc,EAAE,SAAS;IAEzB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QAChD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,YAAY,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC5E,CAAC;IAED,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QACvE,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrD,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC;CACF,CAAA"}

package/dist/harness/rooCode.d.ts

@@ -1,11 +1,18 @@
 /**
  * rooCode.ts — Roo Code adapter.
  *
- * Detects the Roo Code VS Code extension and writes Intutic governance rules
- * as .roorules. Roo Code has no hook system to install a tool-call gate into,
- * and keeps its API provider and base URL in its own settings panel rather
- * than in any file this adapter can write, so routing it through the proxy is
- * a manual step (see the Roo Code integration page).
+ * Detects the Roo Code VS Code extension and writes the rule sets into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts). Roo reads
+ * `AGENTS.md` at the workspace root unless `roo-cline.useAgentRules` is off,
+ * the default being on. Not `.roo/rules/`: once that directory has a file,
+ * Roo stops reading a `.roorules` or `.clinerules` the user keeps
+ * (https://github.com/RooCodeInc/Roo-Code/blob/b867ec9145750d0ae1ff7f02d35406e9bf2a0b16/src/core/prompts/sections/custom-instructions.ts).
+ * Earlier versions overwrote `.roorules`; the user's own copy comes back.
+ *
+ * Roo Code has no hook system to install a tool-call gate into, and keeps its
+ * API provider and base URL in its own settings panel rather than in any file
+ * this adapter can write, so routing it through the proxy is a manual step
+ * (see the Roo Code integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/rooCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rooCode.d.ts","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,cAAc,EAAE,eAsD5B,CAAA"}
+{"version":3,"file":"rooCode.d.ts","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,cAAc,EAAE,eA8B5B,CAAA"}

package/dist/harness/rooCode.js

@@ -1,11 +1,18 @@
 /**
  * rooCode.ts — Roo Code adapter.
  *
- * Detects the Roo Code VS Code extension and writes Intutic governance rules
- * as .roorules. Roo Code has no hook system to install a tool-call gate into,
- * and keeps its API provider and base URL in its own settings panel rather
- * than in any file this adapter can write, so routing it through the proxy is
- * a manual step (see the Roo Code integration page).
+ * Detects the Roo Code VS Code extension and writes the rule sets into the
+ * workspace's `AGENTS.md` through the shared writer (agentsMd.ts). Roo reads
+ * `AGENTS.md` at the workspace root unless `roo-cline.useAgentRules` is off,
+ * the default being on. Not `.roo/rules/`: once that directory has a file,
+ * Roo stops reading a `.roorules` or `.clinerules` the user keeps
+ * (https://github.com/RooCodeInc/Roo-Code/blob/b867ec9145750d0ae1ff7f02d35406e9bf2a0b16/src/core/prompts/sections/custom-instructions.ts).
+ * Earlier versions overwrote `.roorules`; the user's own copy comes back.
+ *
+ * Roo Code has no hook system to install a tool-call gate into, and keeps its
+ * API provider and base URL in its own settings panel rather than in any file
+ * this adapter can write, so routing it through the proxy is a manual step
+ * (see the Roo Code integration page).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -14,16 +21,14 @@ import { access, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
-import { writeOwnedFile } from '@intutic/sync-daemon';
-const CONFIG_FILE = '.roorules';
+import { AGENTS_MD, agentsMdHash, writeAgentsMd } from './agentsMd.js';
+import { retireLegacyRulesFile } from './rulesFiles.js';
+const LEGACY_FILE = '.roorules';
 export const rooCodeAdapter = {
     type: HarnessType.ROO_CODE,
-    configFileName: CONFIG_FILE,
+    configFileName: AGENTS_MD,
     async detect(workspaceRoot) {
-        // Check for .roomodes or .roorules in workspace
-        for (const marker of ['.roomodes', '.roorules']) {
+        for (const marker of ['.roomodes', LEGACY_FILE]) {
             try {
                 await access(join(workspaceRoot, marker));
                 return true;
@@ -32,41 +37,20 @@ export const rooCodeAdapter = {
                 // fall through
             }
         }
-        // Check for VS Code extension directory
         try {
-            const extensionsDir = join(homedir(), '.vscode', 'extensions');
-            const entries = await readdir(extensionsDir);
+            const entries = await readdir(join(homedir(), '.vscode', 'extensions'));
             return entries.some((entry) => entry.startsWith('rooveterinaryinc.roo-cline-'));
         }
         catch {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, sops, _proxyUrl) {
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const instructions = sops.length > 0
-            ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
-            : '# Intutic governance active — no SOP rules configured yet.';
-        const content = [
-            '# Intutic Governance Rules (auto-generated)',
-            '# DO NOT EDIT — managed by intutic sync daemon',
-            `# Last sync: ${newIso()}`,
-            '# NOTE: Roo Code has no hook system, so these rules are advisory.',
-            '# Governance is enforced via the proxy and the drift guard.',
-            '',
-            instructions,
-            '',
-        ].join('\n');
-        await writeOwnedFile(filePath, workspaceRoot, content);
-        return filePath;
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        await retireLegacyRulesFile(workspaceRoot, LEGACY_FILE);
+        return writeAgentsMd(workspaceRoot, sops, proxyUrl);
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    readCurrentHash(workspaceRoot) {
+        return agentsMdHash(workspaceRoot);
     },
 };
 //# sourceMappingURL=rooCode.js.map

package/dist/harness/rooCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"rooCode.js","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,gDAAgD;QAChD,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;gBACzC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,SAAiB;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5E,CAAC,CAAC,4DAA4D,CAAA;QAEhE,MAAM,OAAO,GAAG;YACd,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,mEAAmE;YACnE,6DAA6D;YAC7D,EAAE;YACF,YAAY;YACZ,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QAEtD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"rooCode.js","sourceRoot":"","sources":["../../src/harness/rooCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,SAAS;IAEzB,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;gBACzC,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;YACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrD,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC;CACF,CAAA"}

package/dist/harness/rulesFiles.d.ts

@@ -0,0 +1,53 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import type { SyncSopEntry } from '@intutic/shared-types';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export declare function buildSopSections(sops: SyncSopEntry[]): string;
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export declare function buildRulesBody(sops: SyncSopEntry[], proxyUrl: string, shape: 'section' | 'file'): string;
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeRulesSectionFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export declare function rulesSectionHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeOwnRulesFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string, frontMatter?: string): Promise<string | null>;
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export declare function ownRulesFileHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export declare function retireLegacyRulesFile(workspaceRoot: string, relPath: string): Promise<void>;
+//# sourceMappingURL=rulesFiles.d.ts.map

package/dist/harness/rulesFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.d.ts","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAIzD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAWxG;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASrG;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,0EAA0E;AAC1E,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMrG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F"}

package/dist/harness/rulesFiles.js

@@ -0,0 +1,106 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { retireRulesFile, rulesSectionOf, writeOwnedFile, writeRulesSection } from '@intutic/sync-daemon';
+import { hashFile, hashString } from '../lib/hash.js';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export function buildSopSections(sops) {
+    return sops
+        .map((sop) => `## ${sop.title}\n\n${sop.content}${sop.sopRef ? `\n${sop.sopRef}` : ''}`)
+        .join('\n\n---\n\n');
+}
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export function buildRulesBody(sops, proxyUrl, shape) {
+    return [
+        '# Intutic Governance Rules (auto-generated)',
+        shape === 'section'
+            ? '# DO NOT EDIT this section — managed by intutic sync daemon; edit outside the INTUTIC:RULES markers'
+            : '# DO NOT EDIT — managed by intutic sync daemon; put rules of your own in another file',
+        '',
+        `> **Proxy URL:** \`${proxyUrl}\``,
+        '',
+        buildSopSections(sops),
+    ].join('\n');
+}
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export async function writeRulesSectionFile(workspaceRoot, relPath, sops, proxyUrl) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    await writeRulesSection(filePath, workspaceRoot, buildRulesBody(sops, proxyUrl, 'section'));
+    return filePath;
+}
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export async function rulesSectionHash(workspaceRoot, relPath) {
+    let content;
+    try {
+        content = await readFile(join(workspaceRoot, relPath), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const section = rulesSectionOf(content);
+    return section === null ? null : hashString(section);
+}
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export async function writeOwnRulesFile(workspaceRoot, relPath, sops, proxyUrl, frontMatter) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    const body = `${buildRulesBody(sops, proxyUrl, 'file')}\n`;
+    const content = frontMatter ? `---\n${frontMatter.trimEnd()}\n---\n\n${body}` : body;
+    // Unchanged rule sets leave the file, and its modification time, alone.
+    if ((await readFile(filePath, 'utf-8').catch(() => null)) !== content)
+        await writeOwnedFile(filePath, workspaceRoot, content);
+    return filePath;
+}
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export async function ownRulesFileHash(workspaceRoot, relPath) {
+    try {
+        return await hashFile(join(workspaceRoot, relPath));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export function retireLegacyRulesFile(workspaceRoot, relPath) {
+    return retireRulesFile(join(workspaceRoot, relPath), workspaceRoot);
+}
+//# sourceMappingURL=rulesFiles.js.map

package/dist/harness/rulesFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.js","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACzG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACvF,IAAI,CAAC,aAAa,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,QAAgB,EAAE,KAAyB;IAC9F,OAAO;QACL,6CAA6C;QAC7C,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,qGAAqG;YACvG,CAAC,CAAC,uFAAuF;QAC3F,EAAE;QACF,sBAAsB,QAAQ,IAAI;QAClC,EAAE;QACF,gBAAgB,CAAC,IAAI,CAAC;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAC3F,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,wEAAwE;IACxE,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7H,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAe;IAC1E,OAAO,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;AACrE,CAAC"}

package/dist/harness/smolagents.d.ts

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/smolagents.js

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -27,7 +27,7 @@ export const smolagentsAdapter = makeSdkGatedAdapter({
     pipInstall: 'intutic-clawde[smolagents]',
     importLine: 'from intutic_clawde.gate.adapters.smolagents import IntuticPythonExecutor',
     usageSummary: 'IntuticPythonExecutor gates CodeAgent\'s generated code text before running it; ' +
-        'ToolCallingAgent tools are covered by @guard/guard_tools instead (see TD-377).',
+        'ToolCallingAgent tools are covered by @guard/guard_tools instead.',
     docsSlug: 'smolagents',
 });
 //# sourceMappingURL=smolagents.js.map

package/dist/harness/smolagents.js.map

@@ -1 +1 @@
-{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,gFAAgF;IAClF,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}
+{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,mEAAmE;IACrE,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}

package/dist/harness/types.d.ts

@@ -5,7 +5,6 @@
  * config to its native config file, and read the current file hash.
  *
  * HLD §3.14 — Harness Onboarding Matrix
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
@@ -13,18 +12,33 @@ import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
 export interface IHarnessAdapter {
     /** Harness type identifier. */
     readonly type: HarnessType;
-    /** Config file name relative to workspace root. */
+    /**
+     * The file drift is tracked on, relative to the workspace root: the
+     * harness's rules file when it has one in the workspace (`rulesFileOf` in
+     * `@intutic/shared-types`), else the workspace file the adapter writes; ''
+     * for none.
+     */
     readonly configFileName: string;
     /** Detect whether this harness is present in the workspace. */
     detect(workspaceRoot: string): Promise<boolean>;
     /**
-     * Write governance config to the harness's native config file.
-     * Returns the absolute path written, or null if skipped.
+     * Install what governs this harness whatever rule sets the workspace has:
+     * its tool-call gate, and the proxy routing that rides with it. The gate
+     * enforces the built-in protections, the destructive-command tier, group
+     * rules and holds, none of which need a rule set, so `intutic connect` runs
+     * this for every configured harness. Absent when the harness has no gate
+     * Intutic installs.
+     */
+    installGate?(workspaceRoot: string, proxyUrl: string): Promise<void>;
+    /**
+     * Write the rule sets into the file the harness reads as standing
+     * instructions — the one `HARNESS_RULES_FILES` names, and no other.
+     * `intutic connect` calls it only when a rule set targets the harness, or
+     * on a forced sync. Returns the absolute path written, or null if nothing
+     * was.
      */
     writeConfig(workspaceRoot: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
     /** Read SHA-256 hash of current config file content. Returns null if file doesn't exist. */
     readCurrentHash(workspaceRoot: string): Promise<string | null>;
 }
-/** Harness config file mapping for file-based harnesses. */
-export declare const HARNESS_CONFIG_FILES: Record<HarnessType, string>;
 //# sourceMappingURL=types.d.ts.map

package/dist/harness/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;OAGG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CA4F5D,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;;;OAOG;IACH,WAAW,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D"}