@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/harness/gateBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateBody.js","sourceRoot":"","sources":["../../src/harness/gateBody.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwD;IACjF,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IACxP,CAAC,gBAAgB,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAC1J,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IAC9H,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;CACzG,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;AAEjG;iDACiD;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAA;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,wBAAwB,EAAE,CAAA;AAChF;+BAC+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,sFAAsF;AACtF,SAAS,qBAAqB;IAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAC9B,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CACpB,mBAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,YAAY,CACjG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO;;;kBAGS,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;;EAEhD,KAAK;;EAEL,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAyB1C,gDAAgD;AAChD,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAiC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,GAAG,CACN,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChG,EAAE,CACN,CAAA;IACD,OAAO,GAAG,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAA;AAC3C,CAAC;AAED,iDAAiD;AACjD,SAAS,YAAY,CAAC,IAAY,EAAE,QAAiC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QAC7E,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;QAC5E,YAAY,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAC3F,CAAA;IACD,OAAO,SAAS,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAU,CAAA;AAEjH;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,CAAe;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1G,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;oCACG,YAAY;;;;;;;;;;;;;;;;;;;;;;CAsB/C,CAAA;AAmBD;;;;;;GAMG;AACH,qCAAqC;AACrC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,iBAAqC;IAC1D,OAAO,kCAAkC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;+BAC1C,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;sCAC1B,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;6DAoBlB,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkE1E,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B/B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAsB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAA;IACrC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAA;IACnC,OAAO;0BACiB,YAAY,eAAe,IAAI,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;IAyB7D,GAAG;;;;EAIL,kBAAkB,CAAC,KAAK;;;;;EAKxB,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;IAoBrC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA6E2B,yBAAyB;;;;;;aAM9C,GAAG;aACH,GAAG;aACH,GAAG;aACH,GAAG;;;;;;;;;;;;;;;gCAegB,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,8EAA8E;;;EAG1K,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAoDnB,GAAG;;;;;;;;;;;qEAW4D,sBAAsB;;;;;;IAMvF,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgFC,GAAG;;;;MAIL,GAAG;;;;;;;;;;;;;;;;;;;;;;MAsBH,GAAG;;;;;;;IAOL,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCO,GAAG;;;cAGH,GAAG;;;;;;;;;CAShB,CAAA;AACD,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAgFD,yBAAyB;;;;EAIjD,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAA;IAEnC,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,eAAe;QAC/B,CAAC,CAAC,yFAAyF;YACzF,wBAAwB;QAC1B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,sBAAsB;YACxC,CAAC,CAAC,6FAA6F;gBAC7F,wBAAwB;YAC1B,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,mEAAmE;gBACnE,iDAAiD;gBACjD,CAAC,CAAC,2IAA2I;gBAC7I,CAAC,CAAC,wBAAwB,CAAA;IAElC,OAAO;2BACkB,YAAY,eAAe,IAAI,CAAC,OAAO;;;;;;;EAOhE,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC;;;;EAIpC,kBAAkB,CAAC,QAAQ;;EAE3B,kBAAkB;;EAElB,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCrC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyHN,MAAM;;;;;;;;;;;;;;;;;;;;;;EAsBN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BN,MAAM;;;;;;CAMP,CAAA;AACD,CAAC;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4HR,CAAA;AACD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,MAAM,SAAS,GACb,IAAI,CAAC,QAAQ,KAAK,eAAe;QAC/B,CAAC,CAAC,WAAW;YACX,mEAAmE;YACnE,iHAAiH;YACjH,4EAA4E;YAC5E,oBAAoB;QACtB,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,sBAAsB;YACxC,CAAC,CAAC,WAAW;gBACX,uEAAuE;gBACvE,iHAAiH;gBACjH,4EAA4E;gBAC5E,oBAAoB;YACtB,CAAC,CAAC,WAAW;gBACX,8FAA8F;gBAC9F,qDAAqD;gBACrD,wEAAwE;gBACxE,oBAAoB,CAAA;IAC5B,OAAO,sCAAsC,YAAY,eAAe,IAAI,CAAC,OAAO;;;;;;;;;EASpF,SAAS;;;iDAGsC,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8E5B,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QAC7D,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAC3E,CAAA;IACD,OAAO;0BACiB,YAAY;;;EAGpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;;;;EAIf,kBAAkB,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyG5B,CAAA;AACD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAA;IACnC,OAAO;2BACkB,YAAY;;;;;;;EAOrC,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC;;;;EAIpC,kBAAkB,CAAC,QAAQ;;EAE3B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsInB,CAAA;AACD,CAAC;AAED;mEACmE;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAA"}

package/dist/harness/gateKind.d.ts

@@ -0,0 +1,164 @@
+/**
+ * gateKind.ts — classifies each harness by HOW its tool calls get governed,
+ * for `agentReporter.ts`'s `guardrails` facet.
+ *
+ * # Why this exists
+ *
+ * `collectAgentReport` used to report `hook_gate: true` unconditionally for
+ * every harness, with the comment "the daemon writes the hook gate for every
+ * harness it supports." That was already false for `langgraph` — which has
+ * no on-disk hook, only the SDK-side `intutic_clawde.gate` — and for `aider`,
+ * whose only NO_GATE-registered mechanism is a post-edit, /run-blind
+ * pre-commit hook (see `aiderConfigMerger.ts`'s NO_GATE row in
+ * `__tests__/harness/gateRegistry.ts`). Wave 1 adds eight more SDK-gated
+ * harnesses, which would have made the lie eight times larger without this
+ * fix.
+ *
+ * # What this does NOT do
+ *
+ * This does not verify that a user actually pip-installed `intutic-clawde`
+ * and wired `guard_tools`/`IntuticMiddleware`/etc. into their process — the
+ * daemon cannot observe another process's imports, the same way it cannot
+ * observe whether a written hook file was left executable. It only reports
+ * which MECHANISM this harness's governance model uses (a file the daemon
+ * itself writes and can verify existence of, vs. an SDK the harness's own
+ * process must import), matching the trust level `hook_gate: true` already
+ * carried for file-based harnesses before this fix.
+ *
+ * # Keeping this in sync with the gate registry
+ *
+ * `services/sync-daemon/__tests__/harness/gateRegistry.ts` (the GATES/NO_GATE
+ * completeness registry exercised by `generatedGateBehaviour.test.ts`) is the
+ * authoritative decision per harness, but it is a test-only module (it
+ * dynamically imports every writer's compiled `.js` from a temp build dir)
+ * and must not be imported from daemon runtime code. `gateKind.test.ts`
+ * cross-checks the two lists so this file cannot silently drift from that
+ * registry's own NO_GATE rows: `file: null` harnesses split between 'sdk'
+ * (LangGraph + the Python frameworks — the gate ships in intutic-clawde),
+ * 'delegated' (xirp — the gate is whichever wrapped harness's own gate is
+ * running), and 'bridge' (trueforge-server — the gate runs in a separate
+ * Intutic-operated service, not in any process this repo's writers touch);
+ * the one non-null row (aiderConfigMerger.ts, "no ... exists") is 'none'.
+ *
+ * @module
+ */
+import { type HarnessType as HarnessTypeT } from '@intutic/shared-types';
+/**
+ * `'hook'`      — the daemon writes an on-disk hook/config file this harness
+ *                 reads before running a tool call (the 19-harness majority).
+ * `'sdk'`       — the blocking gate ships in `intutic-clawde`, imported into
+ *                 the harness's own Python process; no file for the daemon
+ *                 to write or verify (LangGraph + the eight Wave/Wave-2
+ *                 frameworks).
+ * `'none'`      — no enforcement point exists today at all (aider: its only
+ *                 native hook is post-edit and /run-blind).
+ * `'delegated'` — this harness has no gate mechanism of its own because it
+ *                 does not run tools itself: it wraps OTHER harnesses that
+ *                 are already `'hook'`- or `'sdk'`-gated, and a tool call
+ *                 made inside it is governed by whichever wrapped harness's
+ *                 own gate is running (Xirp, Agentic Orchestrator, and — a
+ *                 different shape of the same idea — AgentCore Runtime,
+ *                 which HOSTS a customer's already-gated framework code
+ *                 rather than spawning it as a subprocess; see
+ *                 gateRegistry.ts's NO_GATE rows for the reasoning this
+ *                 precedent sets for future orchestrator/host-shaped
+ *                 harnesses).
+ *                 Every wrapped backend of the two orchestrators has a gate of
+ *                 its own (Agentic Orchestrator's `opencode` backend since
+ *                 TD-397 closed with `openCodeHooks.ts`), so `'delegated'`
+ *                 claims exactly what happens. Distinct from
+ *                 `'none'`: `'none'` means no enforcement point exists
+ *                 ANYWHERE for this harness's tool calls; `'delegated'`
+ *                 means one exists, just not one this harness's own row
+ *                 owns or can be credited for independently — reporting it
+ *                 as `'none'` would undercount real coverage, and reporting
+ *                 it as `'hook'` would overclaim a file this daemon never
+ *                 writes for the wrapping harness itself.
+ * `'bridge'`    — the gate runs OUT OF PROCESS, in an Intutic-operated
+ *                 service reacting to the harness's own async
+ *                 approval/event API, rather than a file this daemon writes
+ *                 (`'hook'`), an SDK imported into the harness's own process
+ *                 (`'sdk'`), no enforcement point at all (`'none'`), or
+ *                 governance credited to a wrapped harness's own gate
+ *                 (`'delegated'`) — a fifth, genuinely different shape.
+ *                 TRUEFORGE_SERVER is the first and so far only member: a
+ *                 TrueForge standalone/hosted server is a separate process
+ *                 nobody embeds an Intutic gate into (unlike TRUEFORGE,
+ *                 embedded mode, which IS `'sdk'`-gated — see that row's own
+ *                 doc), so `services/trueforge-bridge` watches its turn/event
+ *                 stream externally and answers pending approvals over HTTP.
+ *                 Distinct from `'delegated'`: a delegated harness's tool
+ *                 calls are governed by ANOTHER HARNESS's own gate running
+ *                 in that other harness's process; a bridge-gated harness's
+ *                 tool calls are governed by a service this repo ships and
+ *                 operates, running in neither the harness's process nor any
+ *                 other harness's. Distinct from `'sdk'`: no code from this
+ *                 repo ever runs inside the governed harness's own process
+ *                 at all — the harness's only obligation is to expose the
+ *                 async approval API the bridge polls/subscribes to.
+ */
+export type GateKind = 'hook' | 'sdk' | 'none' | 'delegated' | 'bridge';
+/**
+ * Harnesses whose blocking gate ships SDK-side, in the harness's own
+ * process — no on-disk hook/config file exists to point a gate at. Mirrors
+ * the `file: null` NO_GATE rows in `gateRegistry.ts`.
+ *
+ * MASTRA, VERCEL_AI_SDK (T2), EVE (A2), and TRUEFORGE (embedded-library mode
+ * only — see its own HarnessType doc) are the JS/TS-native members of this
+ * family: their blocking gate ships in `@intutic/gate/mastra`/
+ * `@intutic/gate/vercel`/`@intutic/gate/eve`/`@intutic/gate/trueforge`
+ * (packages/gate-js) rather than `intutic-clawde`, but the shape is
+ * identical — no on-disk hook/config file, tools run as plain callables in
+ * the harness's own process (for eve, as per-tool/per-connection `approval`
+ * policies attached in the agent directory's own TypeScript; for TrueForge,
+ * as `intuticApprovalResponder()` answering `tool.approval_required`
+ * pauses — see `@intutic/gate/trueforge`'s module doc for why that shape
+ * differs from mastra/vercel's single-callback pattern).
+ *
+ * AI_SDK_HARNESS and AI_SDK_WORKFLOW (A3) are the same `@intutic/gate`
+ * family with one nuance worth naming: the VETO still runs SDK-side in the
+ * caller's own Node.js process (an approval responder / a `needsApproval`
+ * function), which is what `'sdk'` classifies — but for AI_SDK_HARNESS the
+ * tool EXECUTION it vetoes happens server-side in a Vercel Sandbox microVM,
+ * and its built-in sandbox tools have no veto surface at all beyond
+ * `permissionMode` (defaults to 'allow-all'). `'sdk'` describes where the
+ * gate mechanism lives, not a claim that every tool the harness can run
+ * passes through it — see gateRegistry.ts's NO_GATE rows for the honest
+ * scope statement per harness.
+ */
+export declare const SDK_GATED_HARNESSES: ReadonlySet<HarnessTypeT>;
+/**
+ * Harnesses with no enforcement point at all today. Mirrors the
+ * `aiderConfigMerger.ts` NO_GATE row: aider's only native hook
+ * (`--git-commit-verify`) is opt-in, post-edit, and blind to `/run`.
+ */
+export declare const NO_GATE_HARNESSES: ReadonlySet<HarnessTypeT>;
+/**
+ * Harnesses that wrap OTHER already-gated harnesses instead of running tools
+ * themselves — no gate of their own, but not ungoverned either. Mirrors the
+ * `file: null` NO_GATE rows for `xirp` and `agentic-orchestrator` in
+ * `gateRegistry.ts`. Xirp was the first entry of this shape; Agentic
+ * Orchestrator (O3) is the second. O2 (QM) is expected to add a third, same
+ * "wraps other harnesses" shape, in a concurrent phase not yet merged as of
+ * this one.
+ */
+export declare const DELEGATED_GATE_HARNESSES: ReadonlySet<HarnessTypeT>;
+/**
+ * Harnesses whose blocking gate runs OUT OF PROCESS, in an Intutic-operated
+ * service reacting to the harness's own async approval/event API — not a
+ * file this daemon writes, and not an SDK imported into the harness's own
+ * process (no process of ours runs inside the harness at all). Mirrors the
+ * `file: null` NO_GATE row for `trueforge-server` in `gateRegistry.ts`.
+ *
+ * TRUEFORGE_SERVER (B3) is the first member: a TrueForge standalone/hosted
+ * server has no in-process host to hang an SDK gate off of (contrast
+ * TRUEFORGE, embedded mode, in `SDK_GATED_HARNESSES` above) — instead
+ * `services/trueforge-bridge` watches its turn/event stream externally and
+ * answers pending `tool.approval_required` pauses over HTTP. See the
+ * `'bridge'` `GateKind` doc above for the full distinction from `'sdk'` and
+ * `'delegated'`.
+ */
+export declare const BRIDGE_GATED_HARNESSES: ReadonlySet<HarnessTypeT>;
+/** How this harness's tool calls get gated. Defaults to `'hook'`. */
+export declare function gateKindForHarness(type: HarnessTypeT): GateKind;
+//# sourceMappingURL=gateKind.d.ts.map

package/dist/harness/gateKind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateKind.d.ts","sourceRoot":"","sources":["../../src/harness/gateKind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAe,KAAK,WAAW,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,YAAY,CAiBxD,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAgC,CAAA;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,YAAY,CAO7D,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,YAAY,CAA2C,CAAA;AAExG,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAM/D"}

package/dist/harness/gateKind.js

@@ -0,0 +1,143 @@
+/**
+ * gateKind.ts — classifies each harness by HOW its tool calls get governed,
+ * for `agentReporter.ts`'s `guardrails` facet.
+ *
+ * # Why this exists
+ *
+ * `collectAgentReport` used to report `hook_gate: true` unconditionally for
+ * every harness, with the comment "the daemon writes the hook gate for every
+ * harness it supports." That was already false for `langgraph` — which has
+ * no on-disk hook, only the SDK-side `intutic_clawde.gate` — and for `aider`,
+ * whose only NO_GATE-registered mechanism is a post-edit, /run-blind
+ * pre-commit hook (see `aiderConfigMerger.ts`'s NO_GATE row in
+ * `__tests__/harness/gateRegistry.ts`). Wave 1 adds eight more SDK-gated
+ * harnesses, which would have made the lie eight times larger without this
+ * fix.
+ *
+ * # What this does NOT do
+ *
+ * This does not verify that a user actually pip-installed `intutic-clawde`
+ * and wired `guard_tools`/`IntuticMiddleware`/etc. into their process — the
+ * daemon cannot observe another process's imports, the same way it cannot
+ * observe whether a written hook file was left executable. It only reports
+ * which MECHANISM this harness's governance model uses (a file the daemon
+ * itself writes and can verify existence of, vs. an SDK the harness's own
+ * process must import), matching the trust level `hook_gate: true` already
+ * carried for file-based harnesses before this fix.
+ *
+ * # Keeping this in sync with the gate registry
+ *
+ * `services/sync-daemon/__tests__/harness/gateRegistry.ts` (the GATES/NO_GATE
+ * completeness registry exercised by `generatedGateBehaviour.test.ts`) is the
+ * authoritative decision per harness, but it is a test-only module (it
+ * dynamically imports every writer's compiled `.js` from a temp build dir)
+ * and must not be imported from daemon runtime code. `gateKind.test.ts`
+ * cross-checks the two lists so this file cannot silently drift from that
+ * registry's own NO_GATE rows: `file: null` harnesses split between 'sdk'
+ * (LangGraph + the Python frameworks — the gate ships in intutic-clawde),
+ * 'delegated' (xirp — the gate is whichever wrapped harness's own gate is
+ * running), and 'bridge' (trueforge-server — the gate runs in a separate
+ * Intutic-operated service, not in any process this repo's writers touch);
+ * the one non-null row (aiderConfigMerger.ts, "no ... exists") is 'none'.
+ *
+ * @module
+ */
+import { HarnessType } from '@intutic/shared-types';
+/**
+ * Harnesses whose blocking gate ships SDK-side, in the harness's own
+ * process — no on-disk hook/config file exists to point a gate at. Mirrors
+ * the `file: null` NO_GATE rows in `gateRegistry.ts`.
+ *
+ * MASTRA, VERCEL_AI_SDK (T2), EVE (A2), and TRUEFORGE (embedded-library mode
+ * only — see its own HarnessType doc) are the JS/TS-native members of this
+ * family: their blocking gate ships in `@intutic/gate/mastra`/
+ * `@intutic/gate/vercel`/`@intutic/gate/eve`/`@intutic/gate/trueforge`
+ * (packages/gate-js) rather than `intutic-clawde`, but the shape is
+ * identical — no on-disk hook/config file, tools run as plain callables in
+ * the harness's own process (for eve, as per-tool/per-connection `approval`
+ * policies attached in the agent directory's own TypeScript; for TrueForge,
+ * as `intuticApprovalResponder()` answering `tool.approval_required`
+ * pauses — see `@intutic/gate/trueforge`'s module doc for why that shape
+ * differs from mastra/vercel's single-callback pattern).
+ *
+ * AI_SDK_HARNESS and AI_SDK_WORKFLOW (A3) are the same `@intutic/gate`
+ * family with one nuance worth naming: the VETO still runs SDK-side in the
+ * caller's own Node.js process (an approval responder / a `needsApproval`
+ * function), which is what `'sdk'` classifies — but for AI_SDK_HARNESS the
+ * tool EXECUTION it vetoes happens server-side in a Vercel Sandbox microVM,
+ * and its built-in sandbox tools have no veto surface at all beyond
+ * `permissionMode` (defaults to 'allow-all'). `'sdk'` describes where the
+ * gate mechanism lives, not a claim that every tool the harness can run
+ * passes through it — see gateRegistry.ts's NO_GATE rows for the honest
+ * scope statement per harness.
+ */
+export const SDK_GATED_HARNESSES = new Set([
+    HarnessType.LANGGRAPH,
+    HarnessType.LANGCHAIN,
+    HarnessType.CREWAI,
+    HarnessType.AUTOGEN,
+    HarnessType.AG2,
+    HarnessType.GOOGLE_ADK,
+    HarnessType.OPENAI_AGENTS,
+    HarnessType.PYDANTIC_AI,
+    HarnessType.SMOLAGENTS,
+    HarnessType.STRANDS,
+    HarnessType.MASTRA,
+    HarnessType.VERCEL_AI_SDK,
+    HarnessType.EVE,
+    HarnessType.TRUEFORGE,
+    HarnessType.AI_SDK_HARNESS,
+    HarnessType.AI_SDK_WORKFLOW,
+]);
+/**
+ * Harnesses with no enforcement point at all today. Mirrors the
+ * `aiderConfigMerger.ts` NO_GATE row: aider's only native hook
+ * (`--git-commit-verify`) is opt-in, post-edit, and blind to `/run`.
+ */
+export const NO_GATE_HARNESSES = new Set([HarnessType.AIDER]);
+/**
+ * Harnesses that wrap OTHER already-gated harnesses instead of running tools
+ * themselves — no gate of their own, but not ungoverned either. Mirrors the
+ * `file: null` NO_GATE rows for `xirp` and `agentic-orchestrator` in
+ * `gateRegistry.ts`. Xirp was the first entry of this shape; Agentic
+ * Orchestrator (O3) is the second. O2 (QM) is expected to add a third, same
+ * "wraps other harnesses" shape, in a concurrent phase not yet merged as of
+ * this one.
+ */
+export const DELEGATED_GATE_HARNESSES = new Set([
+    HarnessType.XIRP,
+    HarnessType.AGENTIC_ORCHESTRATOR,
+    // B2: AWS Bedrock AgentCore Runtime — hosts a customer's own framework
+    // code unchanged; governed by whichever already-supported framework
+    // adapter that code uses. See tools/cli/src/harness/agentcore.ts.
+    HarnessType.AGENTCORE_RUNTIME,
+]);
+/**
+ * Harnesses whose blocking gate runs OUT OF PROCESS, in an Intutic-operated
+ * service reacting to the harness's own async approval/event API — not a
+ * file this daemon writes, and not an SDK imported into the harness's own
+ * process (no process of ours runs inside the harness at all). Mirrors the
+ * `file: null` NO_GATE row for `trueforge-server` in `gateRegistry.ts`.
+ *
+ * TRUEFORGE_SERVER (B3) is the first member: a TrueForge standalone/hosted
+ * server has no in-process host to hang an SDK gate off of (contrast
+ * TRUEFORGE, embedded mode, in `SDK_GATED_HARNESSES` above) — instead
+ * `services/trueforge-bridge` watches its turn/event stream externally and
+ * answers pending `tool.approval_required` pauses over HTTP. See the
+ * `'bridge'` `GateKind` doc above for the full distinction from `'sdk'` and
+ * `'delegated'`.
+ */
+export const BRIDGE_GATED_HARNESSES = new Set([HarnessType.TRUEFORGE_SERVER]);
+/** How this harness's tool calls get gated. Defaults to `'hook'`. */
+export function gateKindForHarness(type) {
+    if (SDK_GATED_HARNESSES.has(type))
+        return 'sdk';
+    if (NO_GATE_HARNESSES.has(type))
+        return 'none';
+    if (DELEGATED_GATE_HARNESSES.has(type))
+        return 'delegated';
+    if (BRIDGE_GATED_HARNESSES.has(type))
+        return 'bridge';
+    return 'hook';
+}
+//# sourceMappingURL=gateKind.js.map

package/dist/harness/gateKind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateKind.js","sourceRoot":"","sources":["../../src/harness/gateKind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,WAAW,EAAoC,MAAM,uBAAuB,CAAA;AA0DrF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,IAAI,GAAG,CAAC;IACpE,WAAW,CAAC,SAAS;IACrB,WAAW,CAAC,SAAS;IACrB,WAAW,CAAC,MAAM;IAClB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,GAAG;IACf,WAAW,CAAC,UAAU;IACtB,WAAW,CAAC,aAAa;IACzB,WAAW,CAAC,WAAW;IACvB,WAAW,CAAC,UAAU;IACtB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,MAAM;IAClB,WAAW,CAAC,aAAa;IACzB,WAAW,CAAC,GAAG;IACf,WAAW,CAAC,SAAS;IACrB,WAAW,CAAC,cAAc;IAC1B,WAAW,CAAC,eAAe;CAC5B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;AAExF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA8B,IAAI,GAAG,CAAC;IACzE,WAAW,CAAC,IAAI;IAChB,WAAW,CAAC,oBAAoB;IAChC,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,WAAW,CAAC,iBAAiB;CAC9B,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAExG,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IAC9C,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAA;IAC1D,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IACrD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/harness/githubCopilotHooks.d.ts

@@ -0,0 +1,54 @@
+/**
+ * githubCopilotHooks.ts — GitHub Copilot (VS Code agent mode) PreToolUse hooks.
+ *
+ * ⚠️ **PREVIEW MECHANISM.** VS Code agent hooks are a Preview feature: Copilot
+ * reads hook definitions from `.github/hooks/*.json` in the workspace (and
+ * from `~/.copilot/hooks` at user level), fires PreToolUse before each tool
+ * call with stdin JSON {session_id, cwd, hook_event_name, tool_name,
+ * tool_input, tool_use_id}, and refuses on **exit code 2** or a stdout
+ * `{"permissionDecision":"deny"}` (deny wins across hooks). The format may
+ * change between releases; everything below is written to fail SAFE if it
+ * does.
+ *
+ * CONTRACT LAST RE-VERIFIED 2026-08-10 against the live docs
+ * (code.visualstudio.com/docs/agent-customization/hooks and
+ * /docs/agents/reference/hooks-reference): envelope fields, exit-2 blocking,
+ * both file locations, the `chat.hookFilesLocations` setting (whose defaults
+ * also read `.claude/settings.json`-format hooks), and the explicit Preview
+ * marking ("configuration format and behavior might change") all confirmed
+ * as described above. What is NOT verified: an end-to-end block inside a
+ * live Copilot-subscribed VS Code agent session — that requires an
+ * interactive editor with a Copilot entitlement and cannot run headlessly;
+ * until someone performs it, this gate's live status is "contract-verified,
+ * session-unverified" and the security matrix says so.
+ *
+ * Fail-safe analysis, stated rather than assumed: the shared JS gate
+ * (`intuticGate`) extracts the target path and command from `tool_input` by
+ * known field names, and an input whose fields it does not recognise extracts
+ * to EMPTY strings — which match no rule, i.e. the gate degrades to ALLOW.
+ * That is fine for a stable harness and wrong for a Preview one, so this
+ * writer's stdin handler refuses (exit 2) any payload that carries neither
+ * `tool_name` nor `tool_input`: if Copilot renames the envelope, the gate
+ * fails closed and loudly instead of silently approving everything. A JSON
+ * parse failure fails closed the same way.
+ *
+ * Historically github-copilot had an instructions file only
+ * (`.github/copilot-instructions.md`) — advisory text, not enforcement. This
+ * closes that gap for agent mode.
+ *
+ * @module
+ */
+/**
+ * Write the Copilot gate script and its hook definition at workspace and user
+ * level.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path);
+ * both hook definition files are wholly Intutic-owned, so rewriting them is
+ * idempotent by construction.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the gate header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export declare function writeGithubCopilotHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=githubCopilotHooks.d.ts.map

package/dist/harness/githubCopilotHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubCopilotHooks.d.ts","sourceRoot":"","sources":["../../src/harness/githubCopilotHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkJH;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/harness/githubCopilotHooks.js

@@ -0,0 +1,218 @@
+/**
+ * githubCopilotHooks.ts — GitHub Copilot (VS Code agent mode) PreToolUse hooks.
+ *
+ * ⚠️ **PREVIEW MECHANISM.** VS Code agent hooks are a Preview feature: Copilot
+ * reads hook definitions from `.github/hooks/*.json` in the workspace (and
+ * from `~/.copilot/hooks` at user level), fires PreToolUse before each tool
+ * call with stdin JSON {session_id, cwd, hook_event_name, tool_name,
+ * tool_input, tool_use_id}, and refuses on **exit code 2** or a stdout
+ * `{"permissionDecision":"deny"}` (deny wins across hooks). The format may
+ * change between releases; everything below is written to fail SAFE if it
+ * does.
+ *
+ * CONTRACT LAST RE-VERIFIED 2026-08-10 against the live docs
+ * (code.visualstudio.com/docs/agent-customization/hooks and
+ * /docs/agents/reference/hooks-reference): envelope fields, exit-2 blocking,
+ * both file locations, the `chat.hookFilesLocations` setting (whose defaults
+ * also read `.claude/settings.json`-format hooks), and the explicit Preview
+ * marking ("configuration format and behavior might change") all confirmed
+ * as described above. What is NOT verified: an end-to-end block inside a
+ * live Copilot-subscribed VS Code agent session — that requires an
+ * interactive editor with a Copilot entitlement and cannot run headlessly;
+ * until someone performs it, this gate's live status is "contract-verified,
+ * session-unverified" and the security matrix says so.
+ *
+ * Fail-safe analysis, stated rather than assumed: the shared JS gate
+ * (`intuticGate`) extracts the target path and command from `tool_input` by
+ * known field names, and an input whose fields it does not recognise extracts
+ * to EMPTY strings — which match no rule, i.e. the gate degrades to ALLOW.
+ * That is fine for a stable harness and wrong for a Preview one, so this
+ * writer's stdin handler refuses (exit 2) any payload that carries neither
+ * `tool_name` nor `tool_input`: if Copilot renames the envelope, the gate
+ * fails closed and loudly instead of silently approving everything. A JSON
+ * parse failure fails closed the same way.
+ *
+ * Historically github-copilot had an instructions file only
+ * (`.github/copilot-instructions.md`) — advisory text, not enforcement. This
+ * closes that gap for agent mode.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+const log = createLogger('sync-github-copilot-hooks');
+/**
+ * The pre-tool gate script — receives Copilot's PreToolUse JSON on stdin,
+ * exits 0 to allow or 2 to block.
+ */
+function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    return `#!/usr/bin/env node
+/**
+ * Intutic GitHub Copilot (agent mode) governance gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ *
+ * PREVIEW: VS Code agent hooks are a Preview feature and the stdin shape may
+ * change. This gate refuses (exit 2) any payload it does not recognise —
+ * fail closed, never silently allow.
+ *
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+${emitJsFailClosedPrelude({ harness: 'github-copilot', contract: 'exit2' })}
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+${emitJsGate({ harness: 'github-copilot', contract: 'exit2' })}
+
+let _intuticSessionId = '';
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      // Passed through, not collapsed to two values: the advisory tier emits
+      // 'tool_flagged', and a ternary here silently recorded it as an allow.
+      event: verdict,
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'github-copilot',
+      timestamp: ts,
+      incidentId,
+      ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
+    }) + '\\n';
+    fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+let raw = '';
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(raw);
+    _intuticSessionId = ctx.session_id || ctx.sessionId || '';
+
+    // The Preview guard — the precedent the whole family now follows. The
+    // shared gate extracts by known field names, and an envelope it does not
+    // recognise extracts to empty strings — which match no rule and would
+    // ALLOW. On a Preview harness whose format may shift, that is a silent
+    // hole. The hand-rolled check that lived here became the shared
+    // intuticGuardEnvelope in gateBody.ts (v5), so every JS writer refuses the
+    // same envelopes with the same event; if Copilot renames the fields,
+    // re-run intutic sync after upgrading.
+    intuticGuardEnvelope(ctx, ['tool_name', 'toolName', 'tool_input', 'toolInput'], logEvent);
+
+    const input = ctx.tool_input || ctx.toolInput || {};
+    const toolName = ctx.tool_name || ctx.toolName || 'tool';
+
+    // Every spelling any harness uses, matching the bash extractor. A field
+    // name this list misses is a path guard that silently does not run — and
+    // the caller controls which spelling it sends.
+    const targetPath = input.path || input.file_path || input.filePath || input.file ||
+      input.target || input.notebook_path || '';
+    const command = input.command || input.cmd || input.script || '';
+
+    intuticGate(toolName, targetPath, command, logEvent, _intuticWsId, input);
+
+    // Allow
+    logEvent('tool_allowed', toolName, '');
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED
+    const errMsg = String(err);
+    process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
+    logEvent('tool_blocked', 'unknown', errMsg);
+    process.exit(2);
+  }
+});
+`;
+}
+/** The hook definition Copilot loads. One file wholly owned by Intutic — the
+ *  `.github/hooks/` directory is per-file, so no merge is needed and user hook
+ *  files are never touched. */
+function buildHookConfig(hookScriptPath) {
+    return {
+        _comment: 'Intutic governance hook — auto-generated. DO NOT EDIT. ' +
+            'PREVIEW: VS Code agent hooks are a Preview feature; the gate fails closed if the format changes.',
+        _lastSync: newIso(),
+        hooks: {
+            PreToolUse: [
+                {
+                    // Catch-all: the gate decides from the arguments, so a tool name
+                    // nobody anticipated is still evaluated.
+                    matcher: '.*',
+                    hooks: [{ type: 'command', command: `node "${hookScriptPath}"` }],
+                },
+            ],
+        },
+    };
+}
+/**
+ * Write the Copilot gate script and its hook definition at workspace and user
+ * level.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path);
+ * both hook definition files are wholly Intutic-owned, so rewriting them is
+ * idempotent by construction.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the gate header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writeGithubCopilotHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    await fs.mkdir(hookScriptDir, { recursive: true });
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    const hookScriptPath = path.join(hookScriptDir, 'github-copilot-check.js');
+    const tmpScript = hookScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    const config = buildHookConfig(hookScriptPath);
+    // 1. Workspace-level: .github/hooks/intutic-governance.json
+    const projectHooksDir = path.join(workspaceRoot, '.github', 'hooks');
+    await fs.mkdir(projectHooksDir, { recursive: true });
+    await atomicWriteJson(path.join(projectHooksDir, 'intutic-governance.json'), config);
+    log.info({ action: 'github_copilot_hooks_written', level: 'workspace', path: projectHooksDir }, 'GitHub Copilot workspace-level hook written (Preview mechanism)');
+    // 2. User-level: ~/.copilot/hooks/intutic-governance.json
+    const userHooksDir = path.join(os.homedir(), '.copilot', 'hooks');
+    await fs.mkdir(userHooksDir, { recursive: true });
+    await atomicWriteJson(path.join(userHooksDir, 'intutic-governance.json'), config);
+    log.info({ action: 'github_copilot_hooks_written', level: 'user', path: userHooksDir }, 'GitHub Copilot user-level hook written (Preview mechanism)');
+}
+async function atomicWriteJson(filePath, data) {
+    const tmp = filePath + '.intutic-tmp';
+    await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmp, filePath);
+}
+//# sourceMappingURL=githubCopilotHooks.js.map

package/dist/harness/githubCopilotHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubCopilotHooks.js","sourceRoot":"","sources":["../../src/harness/githubCopilotHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAA;AAErD;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;;;;;;YASG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;gFASK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkBtC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDpD,CAAA;AACD,CAAC;AAED;;+BAE+B;AAC/B,SAAS,eAAe,CAAC,cAAsB;IAC7C,OAAO;QACL,QAAQ,EACN,yDAAyD;YACzD,kGAAkG;QACpG,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV;oBACE,iEAAiE;oBACjE,yCAAyC;oBACzC,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,cAAc,GAAG,EAAE,CAAC;iBAClE;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAA;IAE9C,4DAA4D;IAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAA;IACpF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,EACrF,iEAAiE,CAClE,CAAA;IAED,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACjE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAA;IACjF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAC7E,4DAA4D,CAC7D,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}

package/dist/harness/gooseHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gooseHooks.d.ts","sourceRoot":"","sources":["../../src/harness/gooseHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwBH;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAe,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAqHrH"}
+{"version":3,"file":"gooseHooks.d.ts","sourceRoot":"","sources":["../../src/harness/gooseHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAe,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HrH"}