@intutic/cli 2.2.0 → 2.4.0

package/dist/harness/antigravity.js

@@ -1,72 +1,62 @@
 /**
- * Antigravity adapter — .gemini/settings.json
+ * Antigravity adapter — Google Antigravity and Gemini CLI.
  *
- * Merges SOP content into the customInstructions field of the workspace's
- * Gemini settings JSON file, and installs the Gemini CLI `BeforeTool` gate in
- * `~/.gemini/settings.json` (see antigravityHooks.ts). A settings file that is
- * not a plain JSON object is left alone and reported.
+ * Google's terminal agent was Gemini CLI until Antigravity CLI replaced it
+ * for individual users in 2026; enterprise and API-key users keep Gemini
+ * CLI. Both live under `~/.gemini`, and this one harness governs both:
+ *
+ * - the Antigravity gate (app, IDE and CLI): a `PreToolUse` hook in
+ *   `~/.gemini/config/hooks.json` (see antigravityCliHooks.ts);
+ * - the Gemini CLI gate: a `BeforeTool` hook in `~/.gemini/settings.json`
+ *   (see antigravityHooks.ts);
+ * - rules: a marked section of the workspace's `GEMINI.md`, the context file
+ *   both products load as persistent instructions (see rulesSection.ts).
+ *   Gemini CLI reads `GEMINI.md` from the workspace up to the git root (its
+ *   `context.fileName` setting can rename it); Antigravity reads `GEMINI.md`
+ *   and `AGENTS.md` in every directory from the file it works on up to the
+ *   workspace root. Neither reads a `customInstructions` key in
+ *   `.gemini/settings.json`, where earlier versions put the rules;
+ *   `intutic disconnect` removes that key.
+ *
+ * A hooks file that is not a plain JSON object is left alone and reported.
+ *
+ * The two gates report under their own gate ids, `antigravity` and
+ * `gemini-cli` (gateIdentity.ts in @intutic/shared-types), so the control
+ * plane can tell the products apart; the harness stays one.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
-import { join } from 'node:path';
-import { access, writeFile, rename, mkdir } from 'node:fs/promises';
-import { dirname } from 'node:path';
 import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { newIso } from '@intutic/id';
 import { loadCredentials } from '../config/store.js';
-import { keepOriginal, readJsonObjectForMerge, writeAntigravityHooks } from '@intutic/sync-daemon';
-const CONFIG_FILE = '.gemini/settings.json';
+import { antigravityGateIdentities, writeAntigravityCliHooks, writeAntigravityHooks } from '@intutic/sync-daemon';
+import { rulesSectionHash, writeRulesSectionFile } from './rulesFiles.js';
+const CONFIG_FILE = 'GEMINI.md';
 export const antigravityAdapter = {
     type: HarnessType.ANTIGRAVITY,
     configFileName: CONFIG_FILE,
+    /**
+     * Either product, found the way the sync daemon finds it for the agent
+     * report and the AI inventory (antigravityProducts.ts): Antigravity's
+     * app-data directories or a project `.agents/hooks.json`; Gemini CLI's
+     * `gemini` on PATH, a project `.gemini` directory or its own
+     * `~/.gemini/settings.json`. A plain Gemini CLI install with no `.gemini`
+     * in the workspace is found by the binary and the settings file.
+     */
     async detect(workspaceRoot) {
-        try {
-            await access(join(workspaceRoot, '.gemini'));
-            return true;
-        }
-        catch {
-            return false;
-        }
+        return (await antigravityGateIdentities(workspaceRoot)).length > 0;
+    },
+    async installGate(workspaceRoot, proxyUrl) {
+        const workspaceId = (await loadCredentials())?.workspaceId || 'local';
+        await writeAntigravityCliHooks(workspaceRoot, proxyUrl, workspaceId);
+        await writeAntigravityHooks(workspaceRoot, proxyUrl, workspaceId);
     },
-    async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // The gate is installed even with zero SOPs: it is what refuses tool
-        // calls, and the built-in protections apply without any SOP.
-        const creds = await loadCredentials();
-        await writeAntigravityHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
-        if (sops.length === 0)
-            return null;
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const tmpPath = filePath + '.intutic-tmp';
-        await keepOriginal(filePath, workspaceRoot);
-        const settings = await readJsonObjectForMerge(filePath);
-        if (settings === null)
-            return null;
-        // Merge governance instructions
-        const instructions = sops
-            .map((sop) => `## ${sop.title}\n\n${sop.content}`)
-            .join('\n\n---\n\n');
-        settings.customInstructions = [
-            '# Intutic Governance Rules (auto-generated)',
-            `# DO NOT EDIT — managed by intutic sync daemon`,
-            `# Last sync: ${newIso()}`,
-            `# Proxy URL: ${proxyUrl}`,
-            '',
-            instructions,
-        ].join('\n');
-        await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(tmpPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-        await rename(tmpPath, filePath);
-        return filePath;
+    writeConfig(workspaceRoot, sops, proxyUrl) {
+        return writeRulesSectionFile(workspaceRoot, CONFIG_FILE, sops, proxyUrl);
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    /** The section only: the user's own edits elsewhere in `GEMINI.md` are not drift. */
+    readCurrentHash(workspaceRoot) {
+        return rulesSectionHash(workspaceRoot, CONFIG_FILE);
     },
 };
 //# sourceMappingURL=antigravity.js.map

package/dist/harness/antigravity.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAElG,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,qBAAqB,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAEnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QAEzC,MAAM,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAElC,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI;aACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,aAAa,CAAC,CAAA;QAEtB,QAAQ,CAAC,kBAAkB,GAAG;YAC5B,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,gBAAgB,QAAQ,EAAE;YAC1B,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../../src/harness/antigravity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACjH,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAEzE,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,WAAW;IAE3B;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,OAAO,CAAC,MAAM,yBAAyB,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,WAAW,GAAG,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,WAAW,IAAI,OAAO,CAAA;QACrE,MAAM,wBAAwB,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACpE,MAAM,qBAAqB,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;IACnE,CAAC;IAED,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QACvE,OAAO,qBAAqB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED,qFAAqF;IACrF,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;CACF,CAAA"}

package/dist/harness/autogen.d.ts

@@ -15,7 +15,7 @@
  * calls never go through the runtime at all, so for `AssistantAgent`-based
  * code the framework-agnostic `@guard`/`guard_tools` helpers (governing the
  * tool objects directly) remain the applicable coverage, same as before this
- * adapter existed (see TD-374).
+ * adapter existed.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/autogen.js

@@ -15,7 +15,7 @@
  * calls never go through the runtime at all, so for `AssistantAgent`-based
  * code the framework-agnostic `@guard`/`guard_tools` helpers (governing the
  * tool objects directly) remain the applicable coverage, same as before this
- * adapter existed (see TD-374).
+ * adapter existed.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -28,7 +28,7 @@ export const autogenAdapter = makeSdkGatedAdapter({
     keywords: ['autogen-agentchat', 'autogen-core', 'autogen-ext'],
     pipInstall: 'intutic-clawde[autogen]',
     importLine: 'from intutic_clawde.gate.adapters.autogen import IntuticInterventionHandler',
-    usageSummary: 'IntuticInterventionHandler vetoes a runtime-routed FunctionCall via on_send (see TD-374: ' +
+    usageSummary: 'IntuticInterventionHandler vetoes a runtime-routed FunctionCall via on_send (' +
         'invisible to AssistantAgent\'s own tool calls — wrap those tools with @guard/guard_tools ' +
         'instead).',
     docsSlug: 'autogen',

package/dist/harness/autogen.js.map

@@ -1 +1 @@
-{"version":3,"file":"autogen.js","sourceRoot":"","sources":["../../src/harness/autogen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;IAChD,IAAI,EAAE,WAAW,CAAC,OAAO;IACzB,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,CAAC,mBAAmB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC9D,UAAU,EAAE,yBAAyB;IACrC,UAAU,EAAE,6EAA6E;IACzF,YAAY,EACV,2FAA2F;QAC3F,2FAA2F;QAC3F,WAAW;IACb,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAA"}
+{"version":3,"file":"autogen.js","sourceRoot":"","sources":["../../src/harness/autogen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;IAChD,IAAI,EAAE,WAAW,CAAC,OAAO;IACzB,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,CAAC,mBAAmB,EAAE,cAAc,EAAE,aAAa,CAAC;IAC9D,UAAU,EAAE,yBAAyB;IACrC,UAAU,EAAE,6EAA6E;IACzF,YAAY,EACV,+EAA+E;QAC/E,2FAA2F;QAC3F,WAAW;IACb,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAA"}

package/dist/harness/claudeCode.d.ts

@@ -1,2 +1,23 @@
-export declare const claudeCodeAdapter: import("./types.js").IHarnessAdapter;
+/**
+ * Claude Code adapter — rule sets in `.claude/rules/intutic-governance.md`.
+ *
+ * Claude Code loads every `.claude/rules/*.md` without `paths:` front matter
+ * at launch, with the priority of `.claude/CLAUDE.md`
+ * (https://code.claude.com/docs/en/memory). Not `CLAUDE.md` itself, which is
+ * usually the team's own: and under Claude Code's default setting a project
+ * `CLAUDE.md` stops it reading `AGENTS.md`, so creating one would hide a
+ * team's `AGENTS.md` from it. Earlier versions overwrote `CLAUDE.md`; the
+ * user's own copy comes back. The decisions log goes next to it, in
+ * `.claude/rules/intutic-decisions.md` (decisionsDigest.ts). A rule set that
+ * also reaches Claude Code through `AGENTS.md` is left out of its own file
+ * (`writeHarnessConfigs`), so Claude Code does not load it twice.
+ *
+ * The gate is installed by `intutic connect`'s own step, with the synced
+ * settings its deny rules need.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import type { IHarnessAdapter } from './types.js';
+export declare const claudeCodeAdapter: IHarnessAdapter;
 //# sourceMappingURL=claudeCode.d.ts.map

package/dist/harness/claudeCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/harness/claudeCode.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,sCAA8D,CAAA"}
+{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/harness/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMjD,eAAO,MAAM,iBAAiB,EAAE,eA2B/B,CAAA"}

package/dist/harness/claudeCode.js

@@ -1,9 +1,53 @@
 /**
- * Claude Code adapter — CLAUDE.md
+ * Claude Code adapter — rule sets in `.claude/rules/intutic-governance.md`.
+ *
+ * Claude Code loads every `.claude/rules/*.md` without `paths:` front matter
+ * at launch, with the priority of `.claude/CLAUDE.md`
+ * (https://code.claude.com/docs/en/memory). Not `CLAUDE.md` itself, which is
+ * usually the team's own: and under Claude Code's default setting a project
+ * `CLAUDE.md` stops it reading `AGENTS.md`, so creating one would hide a
+ * team's `AGENTS.md` from it. Earlier versions overwrote `CLAUDE.md`; the
+ * user's own copy comes back. The decisions log goes next to it, in
+ * `.claude/rules/intutic-decisions.md` (decisionsDigest.ts). A rule set that
+ * also reaches Claude Code through `AGENTS.md` is left out of its own file
+ * (`writeHarnessConfigs`), so Claude Code does not load it twice.
+ *
+ * The gate is installed by `intutic connect`'s own step, with the synced
+ * settings its deny rules need.
+ *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
  */
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
 import { HarnessType } from '@intutic/shared-types';
-import { createMarkdownAdapter } from './base.js';
-export const claudeCodeAdapter = createMarkdownAdapter(HarnessType.CLAUDE_CODE, 'CLAUDE.md');
+import { ownRulesFileHash, retireLegacyRulesFile, writeOwnRulesFile } from './rulesFiles.js';
+const RULES_FILE = '.claude/rules/intutic-governance.md';
+const LEGACY_FILE = 'CLAUDE.md';
+export const claudeCodeAdapter = {
+    type: HarnessType.CLAUDE_CODE,
+    configFileName: RULES_FILE,
+    async detect(workspaceRoot) {
+        try {
+            await access(join(workspaceRoot, LEGACY_FILE));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    /** With no rule set left for it (they all reach it through `AGENTS.md`;
+     *  see `writeHarnessConfigs`), its own file goes rather than repeat them. */
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        await retireLegacyRulesFile(workspaceRoot, LEGACY_FILE);
+        if (sops.length === 0) {
+            await retireLegacyRulesFile(workspaceRoot, RULES_FILE);
+            return null;
+        }
+        return writeOwnRulesFile(workspaceRoot, RULES_FILE, sops, proxyUrl);
+    },
+    readCurrentHash(workspaceRoot) {
+        return ownRulesFileHash(workspaceRoot, RULES_FILE);
+    },
+};
 //# sourceMappingURL=claudeCode.js.map

package/dist/harness/claudeCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/harness/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AAEjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA"}
+{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/harness/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE5F,MAAM,UAAU,GAAG,qCAAqC,CAAA;AACxD,MAAM,WAAW,GAAG,WAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,IAAI,EAAE,WAAW,CAAC,WAAW;IAC7B,cAAc,EAAE,UAAU;IAE1B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;iFAC6E;IAC7E,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,qBAAqB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;YACtD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;CACF,CAAA"}

package/dist/harness/cline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,YAAY,EAAE,eA4D1B,CAAA"}
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,YAAY,EAAE,eA8C1B,CAAA"}

package/dist/harness/cline.js

@@ -20,9 +20,9 @@ import { homedir } from 'node:os';
 import { HarnessType } from '@intutic/shared-types';
 import { hashFile } from '../lib/hash.js';
 import { loadCredentials } from '../config/store.js';
-import { newIso } from '@intutic/id';
 import { writeClineHooks, ensureClinerulesDirectory } from '@intutic/sync-daemon/harness/clineHooks';
-import { keepOriginal, writeOwnedFile } from '@intutic/sync-daemon';
+import { keepOriginal } from '@intutic/sync-daemon';
+import { writeOwnRulesFile } from './rulesFiles.js';
 const CONFIG_FILE = '.clinerules/intutic-governance.md';
 export const clineAdapter = {
     type: HarnessType.CLINE,
@@ -46,30 +46,21 @@ export const clineAdapter = {
             return false;
         }
     },
+    /** The PreToolUse gate in .clinerules/hooks/. */
+    async installGate(workspaceRoot, proxyUrl) {
+        const creds = await loadCredentials();
+        await writeClineHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
+    },
+    /** Rules, as one file in the .clinerules directory Cline reads; every
+     *  file there is applied (https://docs.cline.bot/features/cline-rules). */
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // 1. Rules, as one file in the .clinerules directory Cline reads.
-        let filePath = null;
+        if (sops.length === 0)
+            return null;
         // Kept before `.clinerules` is created, so disconnect knows it made the directory.
         await keepOriginal(join(workspaceRoot, CONFIG_FILE), workspaceRoot);
-        if (await ensureClinerulesDirectory(workspaceRoot)) {
-            filePath = join(workspaceRoot, CONFIG_FILE);
-            const instructions = sops.length > 0
-                ? sops.map((sop) => `## ${sop.title}\n\n${sop.content}`).join('\n\n---\n\n')
-                : '# Intutic governance active — no SOP rules configured yet.';
-            const content = [
-                '# Intutic Governance Rules (auto-generated)',
-                '# DO NOT EDIT — managed by intutic sync daemon',
-                `# Last sync: ${newIso()}`,
-                '',
-                instructions,
-                '',
-            ].join('\n');
-            await writeOwnedFile(filePath, workspaceRoot, content);
-        }
-        // 2. The PreToolUse gate in .clinerules/hooks/.
-        const creds = await loadCredentials();
-        await writeClineHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
-        return filePath;
+        if (!(await ensureClinerulesDirectory(workspaceRoot)))
+            return null;
+        return writeOwnRulesFile(workspaceRoot, CONFIG_FILE, sops, proxyUrl);
     },
     async readCurrentHash(workspaceRoot) {
         try {

package/dist/harness/cline.js.map

@@ -1 +1 @@
-{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAA;AACpG,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,WAAW,GAAG,mCAAmC,CAAA;AAEvD,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,kEAAkE;QAClE,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,mFAAmF;QACnF,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAA;QACnE,IAAI,MAAM,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC5E,CAAC,CAAC,4DAA4D,CAAA;YAEhE,MAAM,OAAO,GAAG;gBACd,6CAA6C;gBAC7C,gDAAgD;gBAChD,gBAAgB,MAAM,EAAE,EAAE;gBAC1B,EAAE;gBACF,YAAY;gBACZ,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACxD,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE7E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAA;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,WAAW,GAAG,mCAAmC,CAAA;AAEvD,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC/E,CAAC;IAED;+EAC2E;IAC3E,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,mFAAmF;QACnF,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAA;QACnE,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,OAAO,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/harness/codex.d.ts

@@ -1,7 +1,12 @@
 /**
  * codex.ts — Codex adapter.
  *
- * Writes three things:
+ * Writes four things:
+ * - the rule sets, as the marked section of the workspace's `AGENTS.md`,
+ *   which Codex reads before any work, merged from `~/.codex` and every
+ *   directory from the project root down to where it runs
+ *   (https://developers.openai.com/codex/guides/agents-md), through the
+ *   shared writer (agentsMd.ts);
  * - `.env.intutic` in the workspace, with the proxy base URLs for shells and
  *   scripts that source it;
  * - `openai_base_url` in Codex's user config (`$CODEX_HOME/config.toml`,

package/dist/harness/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAcjD,eAAO,MAAM,YAAY,EAAE,eAqD1B,CAAA"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAcjD,eAAO,MAAM,YAAY,EAAE,eAkD1B,CAAA"}

package/dist/harness/codex.js

@@ -1,7 +1,12 @@
 /**
  * codex.ts — Codex adapter.
  *
- * Writes three things:
+ * Writes four things:
+ * - the rule sets, as the marked section of the workspace's `AGENTS.md`,
+ *   which Codex reads before any work, merged from `~/.codex` and every
+ *   directory from the project root down to where it runs
+ *   (https://developers.openai.com/codex/guides/agents-md), through the
+ *   shared writer (agentsMd.ts);
  * - `.env.intutic` in the workspace, with the proxy base URLs for shells and
  *   scripts that source it;
  * - `openai_base_url` in Codex's user config (`$CODEX_HOME/config.toml`,
@@ -17,11 +22,11 @@
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { HarnessType, anthropicBaseUrl, openaiBaseUrl, proxyHost } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
 import { loadCredentials } from '../config/store.js';
 import { newIso } from '@intutic/id';
 import { writeCodexHooks, mergeCodexConfig, writeOwnedFile } from '@intutic/sync-daemon';
-const CONFIG_FILE = '.env.intutic';
+import { AGENTS_MD, agentsMdHash, writeAgentsMd } from './agentsMd.js';
+const ENV_FILE = '.env.intutic';
 /** Codex's user config directory, resolved at call time so CODEX_HOME and
  *  HOME changes (and tests that move them) are honoured. */
 function codexHome() {
@@ -29,7 +34,7 @@ function codexHome() {
 }
 export const codexAdapter = {
     type: HarnessType.CODEX,
-    configFileName: CONFIG_FILE,
+    configFileName: AGENTS_MD,
     async detect(_workspaceRoot) {
         if (process.env.CODEX_HOME)
             return true;
@@ -47,9 +52,18 @@ export const codexAdapter = {
         catch { /* ignore */ }
         return false;
     },
+    async installGate(workspaceRoot, proxyUrl) {
+        // Codex user config — persists proxy routing across sessions without env
+        // sourcing. Merged; a config.toml that does not parse is left alone.
+        await mergeCodexConfig(join(codexHome(), 'config.toml'), openaiBaseUrl(proxyUrl));
+        // The PreToolUse gate. The routing above governs LLM egress only; the
+        // gate is what refuses tool calls.
+        const creds = await loadCredentials();
+        await writeCodexHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
+    },
+    /** The `AGENTS.md` section, and the workspace `.env.intutic`. */
     async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // 1. Workspace .env.intutic
-        const filePath = join(workspaceRoot, CONFIG_FILE);
+        const filePath = join(workspaceRoot, ENV_FILE);
         const envContent = [
             '# Intutic Governance Rules (auto-generated)',
             '# DO NOT EDIT — managed by intutic sync daemon',
@@ -63,22 +77,10 @@ export const codexAdapter = {
             '',
         ].join('\n');
         await writeOwnedFile(filePath, workspaceRoot, envContent);
-        // 2. Codex user config — persists proxy routing across sessions without
-        //    env sourcing. Merged; a config.toml that does not parse is left alone.
-        await mergeCodexConfig(join(codexHome(), 'config.toml'), openaiBaseUrl(proxyUrl));
-        // 3. The PreToolUse gate. The routing above governs LLM egress only; the
-        //    gate is what refuses tool calls.
-        const creds = await loadCredentials();
-        await writeCodexHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
-        return filePath;
+        return (await writeAgentsMd(workspaceRoot, sops, proxyUrl)) ?? filePath;
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    readCurrentHash(workspaceRoot) {
+        return agentsMdHash(workspaceRoot);
     },
 };
 //# sourceMappingURL=codex.js.map

package/dist/harness/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAG/F,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAExF,MAAM,WAAW,GAAG,cAAc,CAAA;AAElC;4DAC4D;AAC5D,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,gBAAgB,CAAC,QAAQ,CAAC,GAAG;YAC3D,2BAA2B,aAAa,CAAC,QAAQ,CAAC,GAAG;YACrD,6BAA6B,SAAS,CAAC,QAAQ,CAAC,GAAG;YACnD,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;QAEzD,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEjF,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE7E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAG/F,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACxF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEtE,MAAM,QAAQ,GAAG,cAAc,CAAA;AAE/B;4DAC4D;AAC5D,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,IAAI,EAAE,WAAW,CAAC,KAAK;IACvB,cAAc,EAAE,SAAS;IAEzB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEjF,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,eAAe,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC/E,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,UAAU,GAAG;YACjB,6CAA6C;YAC7C,gDAAgD;YAChD,gBAAgB,MAAM,EAAE,EAAE;YAC1B,yCAAyC;YACzC,EAAE;YACF,8BAA8B,gBAAgB,CAAC,QAAQ,CAAC,GAAG;YAC3D,2BAA2B,aAAa,CAAC,QAAQ,CAAC,GAAG;YACrD,6BAA6B,SAAS,CAAC,QAAQ,CAAC,GAAG;YACnD,4BAA4B,IAAI,CAAC,MAAM,EAAE;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;QACzD,OAAO,CAAC,MAAM,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAA;IACzE,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC;CACF,CAAA"}

package/dist/harness/continue.d.ts

@@ -4,10 +4,16 @@
  * Detects the Continue AI coding assistant and:
  * - sets `apiBase` on each OpenAI/Anthropic model in `~/.continue/config.yaml`
  *   so its LLM calls reach the proxy (merged; see continueConfigMerger.ts);
- * - installs the Continue CLI (`cn`) PreToolUse gate in
- *   `~/.continue/settings.json` and `<repo>/.continue/settings.json` (see
- *   continueHooks.ts). The IDE extension has no hook system, so for it proxy
- *   routing is the only mechanism.
+ * - installs no tool-call gate: the CLI (`cn`) loads PreToolUse hooks from
+ *   its settings but never fires them (`firePreToolUse` has no caller at
+ *   continuedev/continue main 5522c6f), and the IDE extension has no hook
+ *   system. The proxy and the rules below are what govern it;
+ * - writes the rule sets to `.continue/rules/intutic-governance.md` with
+ *   `alwaysApply: true`. The IDE extension reads the workspace root's
+ *   `.continue/rules/`, and the CLI the one in the directory it runs in,
+ *   which keeps only always-apply rules
+ *   (https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/core/config/markdown/loadMarkdownRules.ts,
+ *   https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/extensions/cli/src/systemMessage.ts).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/continue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAWjD,eAAO,MAAM,eAAe,EAAE,eA6B7B,CAAA"}
+{"version":3,"file":"continue.d.ts","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAYjD,eAAO,MAAM,eAAe,EAAE,eA2B7B,CAAA"}

package/dist/harness/continue.js

@@ -4,10 +4,16 @@
  * Detects the Continue AI coding assistant and:
  * - sets `apiBase` on each OpenAI/Anthropic model in `~/.continue/config.yaml`
  *   so its LLM calls reach the proxy (merged; see continueConfigMerger.ts);
- * - installs the Continue CLI (`cn`) PreToolUse gate in
- *   `~/.continue/settings.json` and `<repo>/.continue/settings.json` (see
- *   continueHooks.ts). The IDE extension has no hook system, so for it proxy
- *   routing is the only mechanism.
+ * - installs no tool-call gate: the CLI (`cn`) loads PreToolUse hooks from
+ *   its settings but never fires them (`firePreToolUse` has no caller at
+ *   continuedev/continue main 5522c6f), and the IDE extension has no hook
+ *   system. The proxy and the rules below are what govern it;
+ * - writes the rule sets to `.continue/rules/intutic-governance.md` with
+ *   `alwaysApply: true`. The IDE extension reads the workspace root's
+ *   `.continue/rules/`, and the CLI the one in the directory it runs in,
+ *   which keeps only always-apply rules
+ *   (https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/core/config/markdown/loadMarkdownRules.ts,
+ *   https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/extensions/cli/src/systemMessage.ts).
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -15,10 +21,10 @@
 import { access, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { HarnessType, openaiBaseUrl } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { loadCredentials } from '../config/store.js';
-import { mergeContinueConfig, writeContinueHooks } from '@intutic/sync-daemon';
+import { HarnessType, rulesFrontMatterOf, openaiBaseUrl } from '@intutic/shared-types';
+import { mergeContinueConfig } from '@intutic/sync-daemon';
+import { ownRulesFileHash, writeOwnRulesFile } from './rulesFiles.js';
+const RULES_FILE = '.continue/rules/intutic-governance.md';
 /** `~/.continue/<name>`, resolved at call time so HOME changes (and tests
  *  that move HOME) are honoured. */
 function continuePath(name) {
@@ -26,7 +32,7 @@ function continuePath(name) {
 }
 export const continueAdapter = {
     type: HarnessType.CONTINUE,
-    configFileName: continuePath('config.yaml'),
+    configFileName: RULES_FILE,
     async detect(_workspaceRoot) {
         for (const p of [continuePath('config.yaml'), continuePath('config.json')]) {
             try {
@@ -43,20 +49,14 @@ export const continueAdapter = {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, _sops, proxyUrl) {
-        const configYaml = continuePath('config.yaml');
-        const routed = await mergeContinueConfig(configYaml, openaiBaseUrl(proxyUrl));
-        const creds = await loadCredentials();
-        await writeContinueHooks(workspaceRoot, proxyUrl, creds?.workspaceId || 'local');
-        return routed > 0 ? configYaml : null;
+    async installGate(workspaceRoot, proxyUrl) {
+        await mergeContinueConfig(continuePath('config.yaml'), openaiBaseUrl(proxyUrl));
     },
-    async readCurrentHash(_workspaceRoot) {
-        try {
-            return await hashFile(continuePath('config.yaml'));
-        }
-        catch {
-            return null;
-        }
+    writeConfig(workspaceRoot, sops, proxyUrl) {
+        return writeOwnRulesFile(workspaceRoot, RULES_FILE, sops, proxyUrl, rulesFrontMatterOf(HarnessType.CONTINUE, 'Intutic governance rules'));
+    },
+    readCurrentHash(workspaceRoot) {
+        return ownRulesFileHash(workspaceRoot, RULES_FILE);
     },
 };
 //# sourceMappingURL=continue.js.map

package/dist/harness/continue.js.map

@@ -1 +1 @@
-{"version":3,"file":"continue.js","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGlE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE9E;oCACoC;AACpC,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,YAAY,CAAC,aAAa,CAAC;IAE3C,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;YACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,KAAqB,EAAE,QAAgB;QAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QAE7E,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAEhF,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,IAAI,CAAC;YAAC,OAAO,MAAM,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IAClF,CAAC;CACF,CAAA"}
+{"version":3,"file":"continue.js","sourceRoot":"","sources":["../../src/harness/continue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAErE,MAAM,UAAU,GAAG,uCAAuC,CAAA;AAE1D;oCACoC;AACpC,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,UAAU;IAE1B,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;YACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,mBAAmB,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjF,CAAC;IAED,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QACvE,OAAO,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC3I,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;CACF,CAAA"}

package/dist/harness/cursor.d.ts

@@ -1,8 +1,11 @@
 /**
  * cursor.ts — Cursor adapter (full implementation with 3-level hooks).
  *
- * Replaces the minimal createMarkdownAdapter stub with a full adapter that:
- * - Writes .cursorrules governance text (existing behaviour, kept)
+ * - Writes the rule sets to `.cursor/rules/intutic-governance.mdc`, a project
+ *   rule with `alwaysApply: true`, which Cursor adds to every request
+ *   (https://cursor.com/docs/context/rules; a plain `.md` there is ignored).
+ *   Earlier versions overwrote `.cursorrules`, a single file the current docs
+ *   no longer describe; the user's own copy of it comes back.
  * - Injects hooks.json at project-level AND user-level
  * - Enterprise system-level (/etc/cursor) is handled by the system administrator
  *

package/dist/harness/cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,aAAa,EAAE,eA6B3B,CAAA"}
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,aAAa,EAAE,eA2B3B,CAAA"}