@intutic/cli 2.2.0 → 2.4.0

package/dist/harness/rulesFiles.d.ts

@@ -0,0 +1,53 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import type { SyncSopEntry } from '@intutic/shared-types';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export declare function buildSopSections(sops: SyncSopEntry[]): string;
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export declare function buildRulesBody(sops: SyncSopEntry[], proxyUrl: string, shape: 'section' | 'file'): string;
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeRulesSectionFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export declare function rulesSectionHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export declare function writeOwnRulesFile(workspaceRoot: string, relPath: string, sops: SyncSopEntry[], proxyUrl: string, frontMatter?: string): Promise<string | null>;
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export declare function ownRulesFileHash(workspaceRoot: string, relPath: string): Promise<string | null>;
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export declare function retireLegacyRulesFile(workspaceRoot: string, relPath: string): Promise<void>;
+//# sourceMappingURL=rulesFiles.d.ts.map

package/dist/harness/rulesFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.d.ts","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAIzD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAWxG;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASrG;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,0EAA0E;AAC1E,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMrG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F"}

package/dist/harness/rulesFiles.js

@@ -0,0 +1,106 @@
+/**
+ * rulesFiles.ts — the two ways a rule set reaches a harness's instructions.
+ *
+ * Which file each harness reads is `HARNESS_RULES_FILES` in
+ * `@intutic/shared-types`, with the product documentation that says so. The
+ * adapters write through these helpers, and `rulesFiles.test.ts` checks every
+ * adapter writes where the map says and nowhere else.
+ *
+ * - {@link writeRulesSectionFile}: a file the user also writes (`CLAUDE.md`,
+ *   `AGENTS.md`, `GEMINI.md`, `.goosehints`, ...). The rule sets go between
+ *   the INTUTIC:RULES markers and the rest of the file is the user's.
+ * - {@link writeOwnRulesFile}: a file of Intutic's own in a directory the
+ *   product reads every file of (`.cursor/rules/`, `.continue/rules/`, ...).
+ *
+ * Neither carries a sync time: the same rule sets give the same bytes, so a
+ * sync with nothing new leaves the file alone.
+ *
+ * @module
+ */
+import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { retireRulesFile, rulesSectionOf, writeOwnedFile, writeRulesSection } from '@intutic/sync-daemon';
+import { hashFile, hashString } from '../lib/hash.js';
+/**
+ * One markdown section per SOP. Each SOP the control plane synced ends with
+ * its `sop://` pointer comment, which maps the rules in the file back to the
+ * SOP that produced them.
+ */
+export function buildSopSections(sops) {
+    return sops
+        .map((sop) => `## ${sop.title}\n\n${sop.content}${sop.sopRef ? `\n${sop.sopRef}` : ''}`)
+        .join('\n\n---\n\n');
+}
+/**
+ * The rule sets as markdown: the generated header (which `intutic disconnect`
+ * recognises), the proxy URL, one section per SOP.
+ */
+export function buildRulesBody(sops, proxyUrl, shape) {
+    return [
+        '# Intutic Governance Rules (auto-generated)',
+        shape === 'section'
+            ? '# DO NOT EDIT this section — managed by intutic sync daemon; edit outside the INTUTIC:RULES markers'
+            : '# DO NOT EDIT — managed by intutic sync daemon; put rules of your own in another file',
+        '',
+        `> **Proxy URL:** \`${proxyUrl}\``,
+        '',
+        buildSopSections(sops),
+    ].join('\n');
+}
+/**
+ * Writes the rule sets as the marked section of `relPath`. Nothing is written
+ * without a rule set. Returns the absolute path, or null.
+ */
+export async function writeRulesSectionFile(workspaceRoot, relPath, sops, proxyUrl) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    await writeRulesSection(filePath, workspaceRoot, buildRulesBody(sops, proxyUrl, 'section'));
+    return filePath;
+}
+/** The section's hash: the user's own edits elsewhere in the file are not drift. */
+export async function rulesSectionHash(workspaceRoot, relPath) {
+    let content;
+    try {
+        content = await readFile(join(workspaceRoot, relPath), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const section = rulesSectionOf(content);
+    return section === null ? null : hashString(section);
+}
+/**
+ * Writes the rule sets as Intutic's own file `relPath`, after `frontMatter`
+ * (the product's own keys, e.g. `alwaysApply: true`) when given. Nothing is
+ * written without a rule set. Returns the absolute path, or null.
+ */
+export async function writeOwnRulesFile(workspaceRoot, relPath, sops, proxyUrl, frontMatter) {
+    if (sops.length === 0)
+        return null;
+    const filePath = join(workspaceRoot, relPath);
+    const body = `${buildRulesBody(sops, proxyUrl, 'file')}\n`;
+    const content = frontMatter ? `---\n${frontMatter.trimEnd()}\n---\n\n${body}` : body;
+    // Unchanged rule sets leave the file, and its modification time, alone.
+    if ((await readFile(filePath, 'utf-8').catch(() => null)) !== content)
+        await writeOwnedFile(filePath, workspaceRoot, content);
+    return filePath;
+}
+/** The hash of a whole file Intutic owns; null when it does not exist. */
+export async function ownRulesFileHash(workspaceRoot, relPath) {
+    try {
+        return await hashFile(join(workspaceRoot, relPath));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Takes back the whole rules file earlier versions wrote at `relPath`, a path
+ * the product has stopped reading or reads only as a legacy fallback: the
+ * user's original comes back, or the file goes when Intutic created it.
+ */
+export function retireLegacyRulesFile(workspaceRoot, relPath) {
+    return retireRulesFile(join(workspaceRoot, relPath), workspaceRoot);
+}
+//# sourceMappingURL=rulesFiles.js.map

package/dist/harness/rulesFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesFiles.js","sourceRoot":"","sources":["../../src/harness/rulesFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACzG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACvF,IAAI,CAAC,aAAa,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,QAAgB,EAAE,KAAyB;IAC9F,OAAO;QACL,6CAA6C;QAC7C,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,qGAAqG;YACvG,CAAC,CAAC,uFAAuF;QAC3F,EAAE;QACF,sBAAsB,QAAQ,IAAI;QAClC,EAAE;QACF,gBAAgB,CAAC,IAAI,CAAC;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAC3F,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,OAAe,EACf,IAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,wEAAwE;IACxE,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC7H,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,OAAe;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAe;IAC1E,OAAO,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;AACrE,CAAC"}

package/dist/harness/smolagents.d.ts

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/smolagents.js

@@ -12,8 +12,8 @@
  * tool calls at all; its choke point is the generated Python CODE STRING,
  * gated by `intutic_clawde.gate.adapters.smolagents.IntuticPythonExecutor`
  * (wraps any `PythonExecutor`) — verified live against smolagents==1.26.0 by
- * driving a real `CodeAgent.run()` end to end. See that module's doc (and
- * TD-377) for what governing code TEXT does and does not cover.
+ * driving a real `CodeAgent.run()` end to end. See that module's doc for
+ * what governing code TEXT does and does not cover.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -27,7 +27,7 @@ export const smolagentsAdapter = makeSdkGatedAdapter({
     pipInstall: 'intutic-clawde[smolagents]',
     importLine: 'from intutic_clawde.gate.adapters.smolagents import IntuticPythonExecutor',
     usageSummary: 'IntuticPythonExecutor gates CodeAgent\'s generated code text before running it; ' +
-        'ToolCallingAgent tools are covered by @guard/guard_tools instead (see TD-377).',
+        'ToolCallingAgent tools are covered by @guard/guard_tools instead.',
     docsSlug: 'smolagents',
 });
 //# sourceMappingURL=smolagents.js.map

package/dist/harness/smolagents.js.map

@@ -1 +1 @@
-{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,gFAAgF;IAClF,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}
+{"version":3,"file":"smolagents.js","sourceRoot":"","sources":["../../src/harness/smolagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;IACnD,IAAI,EAAE,WAAW,CAAC,UAAU;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,4BAA4B;IACxC,UAAU,EAAE,2EAA2E;IACvF,YAAY,EACV,kFAAkF;QAClF,mEAAmE;IACrE,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAA"}

package/dist/harness/types.d.ts

@@ -5,7 +5,6 @@
  * config to its native config file, and read the current file hash.
  *
  * HLD §3.14 — Harness Onboarding Matrix
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
@@ -13,18 +12,33 @@ import type { HarnessType, SyncSopEntry } from '@intutic/shared-types';
 export interface IHarnessAdapter {
     /** Harness type identifier. */
     readonly type: HarnessType;
-    /** Config file name relative to workspace root. */
+    /**
+     * The file drift is tracked on, relative to the workspace root: the
+     * harness's rules file when it has one in the workspace (`rulesFileOf` in
+     * `@intutic/shared-types`), else the workspace file the adapter writes; ''
+     * for none.
+     */
     readonly configFileName: string;
     /** Detect whether this harness is present in the workspace. */
     detect(workspaceRoot: string): Promise<boolean>;
     /**
-     * Write governance config to the harness's native config file.
-     * Returns the absolute path written, or null if skipped.
+     * Install what governs this harness whatever rule sets the workspace has:
+     * its tool-call gate, and the proxy routing that rides with it. The gate
+     * enforces the built-in protections, the destructive-command tier, group
+     * rules and holds, none of which need a rule set, so `intutic connect` runs
+     * this for every configured harness. Absent when the harness has no gate
+     * Intutic installs.
+     */
+    installGate?(workspaceRoot: string, proxyUrl: string): Promise<void>;
+    /**
+     * Write the rule sets into the file the harness reads as standing
+     * instructions — the one `HARNESS_RULES_FILES` names, and no other.
+     * `intutic connect` calls it only when a rule set targets the harness, or
+     * on a forced sync. Returns the absolute path written, or null if nothing
+     * was.
      */
     writeConfig(workspaceRoot: string, sops: SyncSopEntry[], proxyUrl: string): Promise<string | null>;
     /** Read SHA-256 hash of current config file content. Returns null if file doesn't exist. */
     readCurrentHash(workspaceRoot: string): Promise<string | null>;
 }
-/** Harness config file mapping for file-based harnesses. */
-export declare const HARNESS_CONFIG_FILES: Record<HarnessType, string>;
 //# sourceMappingURL=types.d.ts.map

package/dist/harness/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;OAGG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CA4F5D,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEtE,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;;;OAOG;IACH,WAAW,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClG,4FAA4F;IAC5F,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/D"}

package/dist/harness/types.js

@@ -5,101 +5,7 @@
  * config to its native config file, and read the current file hash.
  *
  * HLD §3.14 — Harness Onboarding Matrix
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
-/** Harness config file mapping for file-based harnesses. */
-export const HARNESS_CONFIG_FILES = {
-    'cursor': '.cursorrules',
-    'claude-code': 'CLAUDE.md',
-    'antigravity': '.gemini/settings.json',
-    'windsurf': '.windsurfrules',
-    'aider': '.aider.conf.yml',
-    'openhands': 'config.toml',
-    'codex': '.env.intutic',
-    'n8n': '', // Phase 2 — TD-037: API call, not file write
-    'openclaw': '.openclaw/openclaw.json',
-    'hermes': '.hermes/config.yaml',
-    'pi': '.pi/hooks.json',
-    'github-copilot': '.github/copilot-instructions.md',
-    'cline': '',
-    'roo-code': '',
-    'continue': '',
-    'claude-desktop': '',
-    'goose': '',
-    'open-webui': '',
-    'langgraph': '.env.intutic',
-    // Muse Code reads AGENTS.md (falling back to CLAUDE.md) — see muse.ts.
-    'muse-code': 'AGENTS.md',
-    // AGENTS.md is Grok Build's native rules file — the same cross-tool
-    // convention Codex/Amp read. Delivered via the generic markdown formatter
-    // (`buildMarkdownContent`) every `---`-separated rules
-    // file in this codebase already shares (Cursor, Claude Code, Windsurf,
-    // GitHub Copilot) — not a bespoke format.
-    'grok': 'AGENTS.md',
-    // OpenCode reads AGENTS.md (CLAUDE.md fallback) — see opencode.ts. The gate
-    // is the plugin `openCodeHooks.ts` generates, not this file.
-    'opencode': 'AGENTS.md',
-    // dsh has no workspace-relative rules file in the research this phase could
-    // verify — its config lives entirely under $DSH_HOME (profiles/*/cordis.patch.yml,
-    // settings.yaml), not the project workspace. Empty, matching goose/cline/
-    // continue/claude-desktop/open-webui's precedent for "no single canonical
-    // file" harnesses; dsh.ts's own adapter resolves its real paths directly.
-    'dsh': '',
-    // Xirp writes no config of its own — see xirp.ts's module doc. It
-    // orchestrates other already-gated harnesses (Claude Code, Codex,
-    // Antigravity/Gemini CLI), whose own adapters do the real writing.
-    'xirp': '',
-    // Agentic Orchestrator writes no config of its own — see
-    // agenticOrchestrator.ts's module doc. It orchestrates other CLI backends
-    // (Claude Code, Codex, OpenCode), whose own adapters do the real writing.
-    'agentic-orchestrator': '',
-    // Wave 1 SDK-gated frameworks — same rationale as langgraph above: no
-    // on-disk hook/config file exists to gate tool calls, so each of these
-    // writes .env.intutic (proxy base-URL vars + an SDK-gate pointer comment).
-    'langchain': '.env.intutic',
-    'crewai': '.env.intutic',
-    'autogen': '.env.intutic',
-    'ag2': '.env.intutic',
-    'google-adk': '.env.intutic',
-    'openai-agents': '.env.intutic',
-    'pydantic-ai': '.env.intutic',
-    'smolagents': '.env.intutic',
-    // A4: AWS Strands Agents — same Python SDK-gated rationale as the Wave 1
-    // family above (gate ships in intutic_clawde.gate.adapters.strands).
-    'strands': '.env.intutic',
-    // TD-375: Microsoft Agent Framework — same Python SDK-gated rationale
-    // (gate ships in intutic_clawde.gate.adapters.agent_framework).
-    'agent-framework': '.env.intutic',
-    // T2: JS/TS SDK-gated frameworks — same rationale as the Wave 1 Python
-    // family above, but the blocking gate ships in @intutic/gate
-    // (packages/gate-js) rather than intutic-clawde.
-    'mastra': '.env.intutic',
-    'vercel-ai-sdk': '.env.intutic',
-    // eve (Vercel, PREVIEW) — same JS/TS SDK-gated family; detection is a
-    // compound `eve` dep + `agent/` directory check — see eve.ts.
-    'eve': '.env.intutic',
-    // TrueForge (embedded-library mode only — see trueforge.ts's module doc
-    // and the HarnessType.TRUEFORGE doc comment); same JS/TS SDK-gated family.
-    'trueforge': '.env.intutic',
-    // A3: Vercel platform-agent runtimes — same @intutic/gate family. Note the
-    // env vars are weaker still for ai-sdk-harness (tool execution is
-    // server-side in Vercel Sandbox microVMs; see aiSdkHarness.ts's module doc
-    // and the envPreamble override it carries).
-    'ai-sdk-harness': '.env.intutic',
-    'ai-sdk-workflow': '.env.intutic',
-    // B2: AWS Bedrock AgentCore Runtime — hosts the customer's own framework
-    // code unchanged; the actual tool-call gate belongs to whichever
-    // already-supported framework adapter that code uses (Strands, LangGraph,
-    // ...), same 'delegated'/no-file-of-its-own shape as xirp/
-    // agentic-orchestrator above. See agentcore.ts's module doc.
-    'agentcore-runtime': '',
-    // B3: TrueForge, standalone/hosted server (see the HarnessType.TRUEFORGE_SERVER
-    // doc comment) — no CLI adapter exists for this row at all: it is an
-    // operator-configured deployment, not a package.json dependency of
-    // whatever repo `intutic init` runs against, so there is nothing for this
-    // detector to find and no config file to write. Governed entirely by
-    // services/trueforge-bridge instead (GateKind: 'bridge').
-    'trueforge-server': '',
-};
+export {};
 //# sourceMappingURL=types.js.map

package/dist/harness/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,uBAAuB;IACtC,UAAU,EAAE,gBAAgB;IAC5B,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,EAAE,EAAE,6CAA6C;IACxD,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,qBAAqB;IAC/B,IAAI,EAAE,gBAAgB;IACtB,gBAAgB,EAAE,iCAAiC;IACnD,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,gBAAgB,EAAE,EAAE;IACpB,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,EAAE;IAChB,WAAW,EAAE,cAAc;IAC3B,uEAAuE;IACvE,WAAW,EAAE,WAAW;IACxB,oEAAoE;IACpE,0EAA0E;IAC1E,uDAAuD;IACvD,uEAAuE;IACvE,0CAA0C;IAC1C,MAAM,EAAE,WAAW;IACnB,4EAA4E;IAC5E,6DAA6D;IAC7D,UAAU,EAAE,WAAW;IACvB,4EAA4E;IAC5E,mFAAmF;IACnF,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,KAAK,EAAE,EAAE;IACT,kEAAkE;IAClE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,EAAE,EAAE;IACV,yDAAyD;IACzD,0EAA0E;IAC1E,0EAA0E;IAC1E,sBAAsB,EAAE,EAAE;IAC1B,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,cAAc;IAC3B,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,cAAc;IACzB,KAAK,EAAE,cAAc;IACrB,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,cAAc;IAC/B,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,cAAc;IAC5B,yEAAyE;IACzE,qEAAqE;IACrE,SAAS,EAAE,cAAc;IACzB,sEAAsE;IACtE,gEAAgE;IAChE,iBAAiB,EAAE,cAAc;IACjC,uEAAuE;IACvE,6DAA6D;IAC7D,iDAAiD;IACjD,QAAQ,EAAE,cAAc;IACxB,eAAe,EAAE,cAAc;IAC/B,sEAAsE;IACtE,8DAA8D;IAC9D,KAAK,EAAE,cAAc;IACrB,wEAAwE;IACxE,2EAA2E;IAC3E,WAAW,EAAE,cAAc;IAC3B,2EAA2E;IAC3E,kEAAkE;IAClE,2EAA2E;IAC3E,4CAA4C;IAC5C,gBAAgB,EAAE,cAAc;IAChC,iBAAiB,EAAE,cAAc;IACjC,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,2DAA2D;IAC3D,6DAA6D;IAC7D,mBAAmB,EAAE,EAAE;IACvB,gFAAgF;IAChF,qEAAqE;IACrE,mEAAmE;IACnE,0EAA0E;IAC1E,qEAAqE;IACrE,0DAA0D;IAC1D,kBAAkB,EAAE,EAAE;CACvB,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/harness/windsurf.d.ts

@@ -1,7 +1,12 @@
 /**
  * windsurf.ts — Windsurf adapter (full implementation with hooks + TLS MITM proxy config).
  *
- * Writes .windsurfrules governance text and injects Cascade hook scripts
+ * Writes the rule sets to `.windsurf/rules/intutic-governance.md` with
+ * `trigger: always_on`, which Cascade includes in every message
+ * (https://docs.devin.ai/desktop/cascade/memories, where Windsurf's rules
+ * docs now live; `.windsurfrules`, which earlier versions overwrote, is the
+ * legacy single file, and the user's own copy of it comes back), and injects
+ * Cascade hook scripts
  * at user-level (~/.codeium/windsurf/hooks.json) and workspace-level
  * (.windsurf/hooks.json), merged with any hooks already there. Also merges
  * HTTP proxy settings into Windsurf's user settings.json, and switches

package/dist/harness/windsurf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAUjD,eAAO,MAAM,eAAe,EAAE,eA+B7B,CAAA"}
+{"version":3,"file":"windsurf.d.ts","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AASjD,eAAO,MAAM,eAAe,EAAE,eA4B7B,CAAA"}

package/dist/harness/windsurf.js

@@ -1,7 +1,12 @@
 /**
  * windsurf.ts — Windsurf adapter (full implementation with hooks + TLS MITM proxy config).
  *
- * Writes .windsurfrules governance text and injects Cascade hook scripts
+ * Writes the rule sets to `.windsurf/rules/intutic-governance.md` with
+ * `trigger: always_on`, which Cascade includes in every message
+ * (https://docs.devin.ai/desktop/cascade/memories, where Windsurf's rules
+ * docs now live; `.windsurfrules`, which earlier versions overwrote, is the
+ * legacy single file, and the user's own copy of it comes back), and injects
+ * Cascade hook scripts
  * at user-level (~/.codeium/windsurf/hooks.json) and workspace-level
  * (.windsurf/hooks.json), merged with any hooks already there. Also merges
  * HTTP proxy settings into Windsurf's user settings.json, and switches
@@ -14,19 +19,18 @@
 import { access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { HarnessType } from '@intutic/shared-types';
-import { hashFile } from '../lib/hash.js';
-import { buildMarkdownContent } from './base.js';
+import { HarnessType, rulesFrontMatterOf } from '@intutic/shared-types';
 import { loadCredentials } from '../config/store.js';
 import { writeWindsurfHooks } from '@intutic/sync-daemon/harness/windsurfHooks';
-import { writeOwnedFile } from '@intutic/sync-daemon';
-const CONFIG_FILE = '.windsurfrules';
+import { ownRulesFileHash, retireLegacyRulesFile, writeOwnRulesFile } from './rulesFiles.js';
+const CONFIG_FILE = '.windsurf/rules/intutic-governance.md';
+const LEGACY_FILE = '.windsurfrules';
 const WINDSURF_USER_DIR = join(homedir(), '.codeium', 'windsurf');
 export const windsurfAdapter = {
     type: HarnessType.WINDSURF,
     configFileName: CONFIG_FILE,
     async detect(workspaceRoot) {
-        for (const marker of [CONFIG_FILE, '.windsurf']) {
+        for (const marker of [LEGACY_FILE, '.windsurf']) {
             try {
                 await access(join(workspaceRoot, marker));
                 return true;
@@ -41,27 +45,20 @@ export const windsurfAdapter = {
             return false;
         }
     },
-    async writeConfig(workspaceRoot, sops, proxyUrl) {
-        // 1. Write .windsurfrules markdown governance text
-        const filePath = join(workspaceRoot, CONFIG_FILE);
-        const content = buildMarkdownContent(sops, proxyUrl);
-        await writeOwnedFile(filePath, workspaceRoot, content);
-        // 2. Write Cascade hooks.json at user + workspace level, configure TLS MITM
-        //    proxy. The proxy serves HTTP CONNECT on the same listener as its API,
-        //    so the port is the one `intutic connect` runs it on (PORT, 4000 by
-        //    default).
+    /** Cascade hooks.json at user + workspace level, and the TLS MITM proxy.
+     *  The proxy serves HTTP CONNECT on the same listener as its API, so the
+     *  port is the one `intutic connect` runs it on (PORT, 4000 by default). */
+    async installGate(workspaceRoot, proxyUrl) {
         const proxyPort = parseInt(process.env.PORT || '4000', 10);
         const creds = await loadCredentials();
         await writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort, creds?.workspaceId || 'local');
-        return filePath;
     },
-    async readCurrentHash(workspaceRoot) {
-        try {
-            return await hashFile(join(workspaceRoot, CONFIG_FILE));
-        }
-        catch {
-            return null;
-        }
+    async writeConfig(workspaceRoot, sops, proxyUrl) {
+        await retireLegacyRulesFile(workspaceRoot, LEGACY_FILE);
+        return writeOwnRulesFile(workspaceRoot, CONFIG_FILE, sops, proxyUrl, rulesFrontMatterOf(HarnessType.WINDSURF, 'Intutic governance rules'));
+    },
+    readCurrentHash(workspaceRoot) {
+        return ownRulesFileHash(workspaceRoot, CONFIG_FILE);
     },
 };
 //# sourceMappingURL=windsurf.js.map

package/dist/harness/windsurf.js.map

@@ -1 +1 @@
-{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,mDAAmD;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACpD,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QAEtD,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,eAAe;QACf,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAE3F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,IAAI,CAAC;YAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IACvF,CAAC;CACF,CAAA"}
+{"version":3,"file":"windsurf.js","sourceRoot":"","sources":["../../src/harness/windsurf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE5F,MAAM,WAAW,GAAG,uCAAuC,CAAA;AAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,WAAW,CAAC,QAAQ;IAC1B,cAAc,EAAE,WAAW;IAE3B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC7E,CAAC;IAED;;gFAE4E;IAC5E,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,QAAgB;QACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,IAAoB,EAAE,QAAgB;QAC7E,MAAM,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACvD,OAAO,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC5I,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACrD,CAAC;CACF,CAAA"}

package/dist/harness/xirp.d.ts

@@ -30,8 +30,7 @@
  * download available in this environment, so none of the detection paths
  * below were live-verified against a real install — they follow this
  * codebase's own convention for comparable tools (`~/.grok`, `~/.muse`,
- * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source. See
- * TD-390.
+ * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module

package/dist/harness/xirp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xirp.d.ts","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,WAAW,EAAE,eAgDzB,CAAA"}
+{"version":3,"file":"xirp.d.ts","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOjD,eAAO,MAAM,WAAW,EAAE,eAgDzB,CAAA"}

package/dist/harness/xirp.js

@@ -30,8 +30,7 @@
  * download available in this environment, so none of the detection paths
  * below were live-verified against a real install — they follow this
  * codebase's own convention for comparable tools (`~/.grok`, `~/.muse`,
- * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source. See
- * TD-390.
+ * `<Name>.app` in `/Applications`) rather than a confirmed Xirp source.
  *
  * HLD §3.14 — Harness Onboarding Matrix
  * @module
@@ -47,7 +46,7 @@ const XIRP_APP_PATH = '/Applications/Xirp.app';
 export const xirpAdapter = {
     type: HarnessType.XIRP,
     // No config file of its own — see module doc. Matches the goose/cline-
-    // style convention of an empty HARNESS_CONFIG_FILES entry for a harness
+    // style convention of an empty HARNESS_FILES entry for a harness
     // whose governance-relevant writes are not a single named file (in Xirp's
     // case: no writes of its own at all).
     configFileName: '',

package/dist/harness/xirp.js.map

@@ -1 +1 @@
-{"version":3,"file":"xirp.js","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,0EAA0E;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,sCAAsC;IACtC,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE/C,qEAAqE;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}
+{"version":3,"file":"xirp.js","sourceRoot":"","sources":["../../src/harness/xirp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,0EAA0E;AAC1E,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,sCAAsC;IACtC,cAAc,EAAE,EAAE;IAElB,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,mEAAmE;QACnE,kEAAkE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE/C,qEAAqE;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,KAAqB,EAAE,SAAiB;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA"}

package/dist/lib/api.d.ts

@@ -4,7 +4,6 @@
  * Uses native fetch() (Node 18+). All requests include
  * Authorization: Bearer <apiKey> header.
  *
- * LLD #8 — Sync Daemon / CLI
  * @module
  */
 import type { SyncConfigPayload, DaemonStatus, SopHashReport } from '@intutic/shared-types';
@@ -45,6 +44,14 @@ export interface ApiClient {
         status: number;
         body: T;
     }>;
+    /**
+     * GET for a file download: the body as bytes.
+     *
+     * `get()` parses JSON, which a report served as markdown, CSV or PDF is
+     * not (`/api/v1/compliance/frameworks/:id/coverage?format=pdf`). A non-2xx
+     * throws exactly as `get()` does, since those errors are JSON.
+     */
+    getFile(path: string): Promise<Uint8Array>;
     /** Generic POST request for arbitrary API paths. */
     post<T>(path: string, body?: unknown): Promise<T>;
     /**
@@ -59,6 +66,19 @@ export interface ApiClient {
         status: number;
         body: T;
     }>;
+    /**
+     * PUT and DELETE that hand back the status, for the same reason:
+     * `PUT /api/v1/policy-guardrails/guardrails/:id` answers 400 with the
+     * validator's named checks and 409 with a `code`, and both are the answer.
+     */
+    putWithStatus<T>(path: string, body?: unknown): Promise<{
+        status: number;
+        body: T;
+    }>;
+    delWithStatus<T>(path: string): Promise<{
+        status: number;
+        body: T;
+    }>;
     /**
      * Multipart POST that hands back the status.
      *
@@ -83,6 +103,12 @@ export interface ApiClient {
  * @param controlPlaneUrl - Base URL (e.g., http://localhost:3001 or https://api.intutic.ai)
  * @param apiKey - API key (vk_*) or JWT access token
  */
+/**
+ * The error a failed call throws. A 403 carries the server's `detail` when it
+ * gives one (a role guard names the roles that may make the call), so a member
+ * whose role cannot do something is told which role can, not shown raw JSON.
+ */
+export declare function apiFailure(method: string, path: string, status: number, text: string): Error;
 export declare function createApiClient(controlPlaneUrl: string, apiKey: string): ApiClient;
 /**
  * Decodes a TOON payload, normalising "not TOON" to an empty list.

package/dist/lib/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpJ,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAmHlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,uBAAuB,CAAA;AAI9B,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC5D,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpF,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpJ,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1C,oDAAoD;IACpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD;;;;;;;OAOG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACrF;;;;OAIG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpF,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAC/E,mDAAmD;IACnD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAChD,qDAAqD;IACrD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAClD,sDAAsD;IACtD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjD;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAU5F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CA2IlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBzD"}