@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/harness/hermesHooks.js

@@ -21,24 +21,11 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { newIso } from '@intutic/id';
+import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
 const log = createLogger('sync-hermes-hooks');
 /** Path to the Hermes global config file. */
 const HERMES_CONFIG = path.join(os.homedir(), '.hermes', 'config.yaml');
 /** Governance-sensitive paths that the hook gate protects. */
-const PROTECTED_PATHS = [
-    '.gemini/settings.json',
-    '.intutic/hooks',
-    '.intutic/integrity.json',
-    '.intutic/events',
-    '.claude/settings.json',
-    '.cursor/hooks.json',
-    '.codeium/windsurf/hooks.json',
-    '.cline/hooks',
-    '.agents/plugins/intutic-governance',
-    '.openhands/hooks.json',
-    '.hermes/config.yaml',
-    '.hermes/skills/intutic-governance',
-];
 // ─── Bash hook script template ────────────────────────────────────────────────
 function buildHermesCheckScript(proxyUrl, workspaceRoot, workspaceId) {
     const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
@@ -50,7 +37,7 @@ function buildHermesCheckScript(proxyUrl, workspaceRoot, workspaceId) {
 # Generated: ${newIso()}
 # Workspace: ${workspaceId}
 set -euo pipefail
-
+${SHELL_FAIL_CLOSED}
 # Source runtime credentials (never embedded in this file)
 if [ -f "${runtimeEnv}" ]; then
   # shellcheck disable=SC1090
@@ -62,18 +49,35 @@ INTUTIC_API_KEY="\${INTUTIC_API_KEY:-}"
 INTUTIC_WORKSPACE_ID="\${INTUTIC_WORKSPACE_ID:-${workspaceId}}"
 
 INPUT="$(cat)"
-TOOL_NAME="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)"
-TARGET_PATH="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); i=d.get('tool_input',{}); print(i.get('path',i.get('file_path','')))" 2>/dev/null || true)"
-COMMAND="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); i=d.get('tool_input',{}); print(i.get('command',i.get('cmd','')))" 2>/dev/null || true)"
+${SHELL_EXTRACT}
 
 HOOK_EVENTS_LOG=${JSON.stringify(hookEventsLog)}
 
 log_event() {
   local verdict="\$1" tool="\$2" reason="\$3"
+  # \`tool\` and \`reason\` carry agent-controlled text — the tool name, and the
+  # target path quoted into the block reason — and both are spliced into the
+  # JSON string below. Escape first: one unescaped quote yields a line
+  # JSON.parse rejects, and drainHookEvents drops malformed lines then wipes the
+  # log on a successful drain, so the record of a block is destroyed rather than
+  # delayed. A crafted path could otherwise close the string and forge fields.
+  tool="\${tool//\\\\/\\\\\\\\}";     tool="\${tool//\\"/\\\\\\"}"
+  reason="\${reason//\\\\/\\\\\\\\}"; reason="\${reason//\\"/\\\\\\"}"
+  # Every C0 control character, not just newline and carriage return. JSON
+  # forbids all of U+0000-U+001F unescaped, so a plain TAB in a filename — no
+  # adversary required — was still enough to produce a line JSON.parse rejects.
+  # (NUL cannot appear in a bash variable, so the range starts at \\x01.)
+  tool="\${tool//[\$'\\x01'-\$'\\x1f']/ }"; reason="\${reason//[\$'\\x01'-\$'\\x1f']/ }"
+  # The workspace id is spliced into the same JSON string. It comes from
+  # runtime.env on disk rather than from the agent, so it is lower risk — but a
+  # value with a quote in it breaks every audit line the same way, and "lower
+  # risk" is not "cannot happen" for a file the operator edits by hand.
+  local ws="\${INTUTIC_WORKSPACE_ID}"
+  ws="\${ws//\\\\/\\\\\\\\}"; ws="\${ws//\\"/\\\\\\"}"; ws="\${ws//[\$'\\x01'-\$'\\x1f']/ }"
   local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   # incidentId = sha1(timestamp + toolName + workspaceId).slice(0,16)
   local incident_id; incident_id="\$(echo -n \"\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}\" | sha1sum | cut -c1-16)"
-  local entry="{\\\"event\\\":\\\"toolGovernance\\\",\\\"verdict\\\":\\\"\${verdict}\\\",\\\"toolName\\\":\\\"\${tool}\\\",\\\"reason\\\":\\\"\${reason}\\\",\\\"workspaceId\\\":\\\"\${INTUTIC_WORKSPACE_ID}\\\",\\\"harnessType\\\":\\\"hermes\\\",\\\"incidentId\\\":\\\"\${incident_id}\\\",\\\"timestamp\\\":\\\"\${ts}\\\"}"
+  local entry="{\\\"event\\\":\\\"\${verdict}\\\",\\\"toolName\\\":\\\"\${tool}\\\",\\\"reason\\\":\\\"\${reason}\\\",\\\"workspaceId\\\":\\\"\${INTUTIC_WORKSPACE_ID}\\\",\\\"harnessType\\\":\\\"hermes\\\",\\\"incidentId\\\":\\\"\${incident_id}\\\",\\\"timestamp\\\":\\\"\${ts}\\\"}"
   # Path B: reliable file append (sync-daemon drains on FSEvents change)
   printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
   # Path A: fire-and-forget HTTP POST (near-real-time dashboard, non-blocking)
@@ -86,40 +90,7 @@ log_event() {
   fi
 }
 
-PROTECTED_PATHS=(
-${PROTECTED_PATHS.map((p) => `  "${p}"`).join('\n')}
-)
-
-# 1. Protected-path guard
-for p in "\${PROTECTED_PATHS[@]}"; do
-  if echo "$TARGET_PATH" | grep -qF "$p"; then
-    REASON="Attempt to modify governance-protected path \\"$TARGET_PATH\\""
-    echo "[Intutic Governance] BLOCKED: $REASON" >&2
-    log_event "tool_blocked" "$TOOL_NAME" "$REASON"
-    exit 2
-  fi
-done
-
-# 2. Bash/shell command guard — block governance bypass patterns
-if [ -n "$COMMAND" ]; then
-  BYPASS_PATTERNS=(
-    "chflags nouchg"
-    "chattr -i"
-    "rm -rf .intutic"
-    "rm -rf .hermes/config"
-    "HERMES_PRE_TOOL_HOOK="
-    "rm -rf .gemini/settings"
-  )
-  for pattern in "\${BYPASS_PATTERNS[@]}"; do
-    if echo "$COMMAND" | grep -qF "$pattern"; then
-      REASON="Shell command matches governance bypass pattern: \\"$pattern\\""
-      echo "[Intutic Governance] BLOCKED: $REASON" >&2
-      log_event "tool_blocked" "$TOOL_NAME" "$REASON"
-      exit 2
-    fi
-  done
-fi
-
+${emitShellGate({ harness: "hermes" })}
 log_event "tool_allowed" "$TOOL_NAME" ""
 exit 0
 `;
@@ -233,8 +204,8 @@ export async function writeHermesHooks(workspaceRoot, proxyUrl, workspaceId = ''
     // ── 5. Write env snippet ───────────────────────────────────────────────────
     const envSnippet = [
         `# Intutic Hermes governance env`,
-        `INTUITIC_HERMES_HOOK=~/.intutic/hooks/hermes-check.sh`,
-        `INTUITIC_HERMES_CONFIG=~/.hermes/config.yaml`,
+        `INTUTIC_HERMES_HOOK=~/.intutic/hooks/hermes-check.sh`,
+        `INTUTIC_HERMES_CONFIG=~/.hermes/config.yaml`,
     ].join('\n') + '\n';
     const envFilePath = path.join(envDir, 'hermes.env');
     const tmpEnv = envFilePath + '.intutic-tmp';

package/dist/harness/hermesHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,uBAAuB;IACvB,oBAAoB;IACpB,8BAA8B;IAC9B,cAAc;IACd,oCAAoC;IACpC,uBAAuB;IACvB,qBAAqB;IACrB,mCAAmC;CACpC,CAAA;AAED,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;;;WAIf,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;;;;;kBAO1C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;EAqB7C,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmClD,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,eAAe;QACf,gBAAgB,cAAc,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,cAAc;QACd,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC5B,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,sDAAsD;QACtD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,OAAO,CACvB,gBAAgB,EAChB,mCAAmC,cAAc,EAAE,CACpD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;uDAe8C,QAAQ;CAC9D,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,uDAAuD;QACvD,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}
+{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,eAAe;QACf,gBAAgB,cAAc,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,cAAc;QACd,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC5B,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,sDAAsD;QACtD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,OAAO,CACvB,gBAAgB,EAChB,mCAAmC,cAAc,EAAE,CACpD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;uDAe8C,QAAQ;CAC9D,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}

package/dist/harness/holdRedaction.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Redaction for the request context captured when a review hold fires.
+ *
+ * A hold snapshot is the one place in the product where raw tool *arguments*
+ * leave the developer's machine. `Write` carries file contents; `Bash` carries
+ * whole command lines; both routinely contain credentials that the developer
+ * never intended to publish. The proxy's DLP scanner does not help here — it
+ * sits on the HTTP path, and this runs inside the harness before any request
+ * exists.
+ *
+ * So the snapshot is redacted and capped **in the hook, before it touches
+ * disk** — not in the daemon on the way out. If it were done on the way out,
+ * the plaintext would already be sitting in `.intutic/events/`, and a file that
+ * exists is a file that gets copied into a bug report.
+ *
+ * ## Why this is emitted rather than imported
+ *
+ * The generated hook is a standalone script with no module resolution — it runs
+ * as whatever `node` the harness invokes, in whatever directory. So the function
+ * below is serialised into it with `String()`. That is also why it must be
+ * **entirely self-contained**: no imports, no closure captures, no references to
+ * anything outside its own body — `emitRedactor` declares every module-level
+ * name these two reach, and a test evaluates the emitted text to prove it.
+ *
+ * Serialising the function instead of pasting a source string is deliberate.
+ * Four separate bugs in this file's history came from backticks and `${`
+ * sequences inside emitted code terminating the enclosing template literal.
+ * An interpolated *value* is never re-parsed, so that whole class is gone — and
+ * the function gets ordinary unit tests instead of being tested through a
+ * generated artifact.
+ *
+ * @module
+ */
+/** Longest string kept verbatim. Past this the middle is dropped, not the end. */
+export declare const MAX_STRING = 2000;
+/** Deepest object nesting walked. Below this, values become a marker. */
+export declare const MAX_DEPTH = 6;
+/** Most array elements kept. */
+export declare const MAX_ARRAY = 50;
+/** Hard ceiling on the serialised snapshot. */
+export declare const MAX_SNAPSHOT_BYTES = 32768;
+/**
+ * Returns a redacted, size-capped copy of `value`.
+ *
+ * Self-contained by contract — see the module docstring. Do not add imports or
+ * outer-scope references to this function; `emitRedactor()` asserts it stays
+ * closed over nothing.
+ */
+export declare function redactSecrets(value: unknown, depth?: number): unknown;
+/**
+ * Emits both functions as standalone JavaScript for the generated hook.
+ *
+ * The caps are declared ahead of the functions rather than substituted into
+ * their bodies, so one definition serves the emitted hook and the unit tests.
+ */
+export declare function emitRedactor(): string;
+/**
+ * Builds the snapshot the hook writes, redacted and under the byte ceiling.
+ *
+ * Serialised into the hook by `emitRedactor` and imported directly by the
+ * tests, so what the tests exercise is what runs.
+ */
+export declare function buildContextSnapshot(input: {
+    tool: string;
+    toolInput: unknown;
+    cwd: string;
+    reason: string;
+}): Record<string, unknown>;
+//# sourceMappingURL=holdRedaction.d.ts.map

package/dist/harness/holdRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holdRedaction.d.ts","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,OAAQ,CAAA;AAC/B,yEAAyE;AACzE,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,gCAAgC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAwGhE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB1B"}

package/dist/harness/holdRedaction.js

@@ -0,0 +1,211 @@
+/**
+ * Redaction for the request context captured when a review hold fires.
+ *
+ * A hold snapshot is the one place in the product where raw tool *arguments*
+ * leave the developer's machine. `Write` carries file contents; `Bash` carries
+ * whole command lines; both routinely contain credentials that the developer
+ * never intended to publish. The proxy's DLP scanner does not help here — it
+ * sits on the HTTP path, and this runs inside the harness before any request
+ * exists.
+ *
+ * So the snapshot is redacted and capped **in the hook, before it touches
+ * disk** — not in the daemon on the way out. If it were done on the way out,
+ * the plaintext would already be sitting in `.intutic/events/`, and a file that
+ * exists is a file that gets copied into a bug report.
+ *
+ * ## Why this is emitted rather than imported
+ *
+ * The generated hook is a standalone script with no module resolution — it runs
+ * as whatever `node` the harness invokes, in whatever directory. So the function
+ * below is serialised into it with `String()`. That is also why it must be
+ * **entirely self-contained**: no imports, no closure captures, no references to
+ * anything outside its own body — `emitRedactor` declares every module-level
+ * name these two reach, and a test evaluates the emitted text to prove it.
+ *
+ * Serialising the function instead of pasting a source string is deliberate.
+ * Four separate bugs in this file's history came from backticks and `${`
+ * sequences inside emitted code terminating the enclosing template literal.
+ * An interpolated *value* is never re-parsed, so that whole class is gone — and
+ * the function gets ordinary unit tests instead of being tested through a
+ * generated artifact.
+ *
+ * @module
+ */
+/** Longest string kept verbatim. Past this the middle is dropped, not the end. */
+export const MAX_STRING = 2_000;
+/** Deepest object nesting walked. Below this, values become a marker. */
+export const MAX_DEPTH = 6;
+/** Most array elements kept. */
+export const MAX_ARRAY = 50;
+/** Hard ceiling on the serialised snapshot. */
+export const MAX_SNAPSHOT_BYTES = 32_768;
+/**
+ * Returns a redacted, size-capped copy of `value`.
+ *
+ * Self-contained by contract — see the module docstring. Do not add imports or
+ * outer-scope references to this function; `emitRedactor()` asserts it stays
+ * closed over nothing.
+ */
+export function redactSecrets(value, depth = 0) {
+    // Keys whose value is a credential regardless of what it looks like. Matched
+    // loosely on purpose: `apiKey`, `api_key`, `X-Api-Key` and `apikey` all occur.
+    const SECRET_KEY = /(pass(word|phrase)?|secret|token|api[-_ ]?key|auth(orization)?|credential|private[-_ ]?key|session[-_ ]?id|cookie)/i;
+    // Credential *shapes*, for values that arrive under an innocent key — the
+    // common case, since most of these appear inside a shell command string.
+    const SECRET_VALUE = [
+        /AKIA[0-9A-Z]{16}/g, // AWS access key id
+        /ASIA[0-9A-Z]{16}/g, // AWS temporary access key id
+        /sk-ant-[A-Za-z0-9_-]{16,}/g, // Anthropic
+        /sk-[A-Za-z0-9]{32,}/g, // OpenAI and lookalikes
+        /gh[pousr]_[A-Za-z0-9]{20,}/g, // GitHub
+        /github_pat_[A-Za-z0-9_]{20,}/g,
+        /xox[abprs]-[A-Za-z0-9-]{10,}/g, // Slack
+        /AIza[0-9A-Za-z_-]{30,}/g, // Google
+        /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, // JWT
+        /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+        // Bare basic-auth in a URL.
+        /\/\/[^/\s:@]+:[^/\s:@]+@/g,
+    ];
+    // Assignment forms — `--token=…`, `PASSWORD=…`, `"secret": "…"`,
+    // `Authorization: Bearer …`. Matched in two steps, name first and value
+    // second, for two independent reasons.
+    //
+    // **Cost.** The single regex this replaces put two unbounded runs either side
+    // of the keyword alternation — `[A-Za-z0-9_-]*(token|…)[A-Za-z0-9_-]*` — so
+    // every start offset enumerated every split point of the identifier and the
+    // whole thing went quadratic. Measured on `'key'.repeat(n)`: 59 KB took 566 ms
+    // and 469 KB took 38 *seconds*, synchronously, inside a `PreToolUse` hook. The
+    // size caps do not bound it: `scrub` redacts the whole string and truncates to
+    // MAX_STRING only afterwards, and MAX_SNAPSHOT_BYTES applies later still. A
+    // `Write` carrying a few hundred KB of file content was enough. Matching the
+    // name alone is bounded by the identifier run, and the value is walked once,
+    // by hand, only after the name has been found interesting — 1.2 MB in ~25 ms.
+    //
+    // **Reach.** That same mandatory `[A-Za-z_]` before the alternation meant the
+    // keyword could only ever be an *infix* of the identifier, never the whole of
+    // it. So `MY_API_KEY=` redacted and `PASSWORD=`, `--token=`, `--credential=`,
+    // `passphrase=` and `"secret":` did not — all three of the forms the old
+    // comment offered as its examples passed through to disk in plaintext.
+    const NAME = /\b([A-Za-z_][A-Za-z0-9_-]*)(["']?\s*[:=]\s*["']?(?:Bearer\s+|Basic\s+)?)/g;
+    const NAME_IS_SECRET = /pass(word|phrase)?|secret|token|key|credential|auth(orization)?/i;
+    const VALUE_END = /[\s"',;]/;
+    const redactAssignments = (s) => {
+        let out = '';
+        let copied = 0;
+        let m;
+        NAME.lastIndex = 0;
+        while ((m = NAME.exec(s)) !== null) {
+            // Declining leaves `lastIndex` just past the separator rather than past a
+            // consumed value, so a boring name cannot shadow a secret packed into the
+            // same unbroken run — `--set=PGPASSWORD=…` still redacts.
+            if (!NAME_IS_SECRET.test(m[1]))
+                continue;
+            let end = NAME.lastIndex;
+            while (end < s.length && !VALUE_END.test(s[end]))
+                end += 1;
+            // Too short to be a credential, and short enough that redacting it would
+            // cost more context than it protects.
+            if (end - NAME.lastIndex < 8)
+                continue;
+            out += s.slice(copied, NAME.lastIndex) + '[redacted]';
+            copied = end;
+            NAME.lastIndex = end;
+        }
+        // The name and separator survive. A snapshot exists to be reviewed, and
+        // `--token=[redacted]` tells the reviewer what was held; a bare
+        // `[redacted]` swallowing the key name does not.
+        return copied === 0 ? s : out + s.slice(copied);
+    };
+    const scrub = (s) => {
+        let out = s;
+        for (const re of SECRET_VALUE)
+            out = out.replace(re, '[redacted]');
+        out = redactAssignments(out);
+        if (out.length > MAX_STRING) {
+            // Keep both ends. A command's verb is at the front and its target is at
+            // the back; truncating the tail throws away the half that identifies what
+            // the hold was about.
+            const half = Math.floor(MAX_STRING / 2);
+            out = `${out.slice(0, half)}…[${out.length - MAX_STRING} chars elided]…${out.slice(-half)}`;
+        }
+        return out;
+    };
+    if (depth > MAX_DEPTH)
+        return '[depth limit]';
+    if (value === null || value === undefined)
+        return value ?? null;
+    if (typeof value === 'string')
+        return scrub(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value)) {
+        const kept = value.slice(0, MAX_ARRAY).map((v) => redactSecrets(v, depth + 1));
+        if (value.length > MAX_ARRAY)
+            kept.push(`[${value.length - MAX_ARRAY} more elided]`);
+        return kept;
+    }
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = SECRET_KEY.test(k) ? '[redacted]' : redactSecrets(v, depth + 1);
+        }
+        return out;
+    }
+    // Functions, symbols, bigints — nothing a tool input should carry.
+    return `[${typeof value}]`;
+}
+/**
+ * Emits both functions as standalone JavaScript for the generated hook.
+ *
+ * The caps are declared ahead of the functions rather than substituted into
+ * their bodies, so one definition serves the emitted hook and the unit tests.
+ */
+export function emitRedactor() {
+    // Bound under their SOURCE names first, then aliased.
+    //
+    // `buildContextSnapshot` calls `redactSecrets` by name, and a named function
+    // expression only supplies a binding for its own recursion — not for its
+    // siblings. Emitting solely as `__intuticSnapshot` produced a body calling a
+    // `redactSecrets` that did not exist in the hook, which threw inside the
+    // hold-write catch and silently produced no snapshot at all. The structural
+    // assertions did not catch it; evaluating the emitted text did, which is why
+    // that test exists.
+    return [
+        '// ── Intutic hold redaction ───────────────────────────────────────────',
+        '// Serialised from harness/holdRedaction.ts. Do not edit here.',
+        `const MAX_STRING = ${MAX_STRING};`,
+        `const MAX_DEPTH = ${MAX_DEPTH};`,
+        `const MAX_ARRAY = ${MAX_ARRAY};`,
+        `const MAX_SNAPSHOT_BYTES = ${MAX_SNAPSHOT_BYTES};`,
+        `const redactSecrets = ${String(redactSecrets)};`,
+        `const buildContextSnapshot = ${String(buildContextSnapshot)};`,
+        'const __intuticRedact = redactSecrets;',
+        'const __intuticSnapshot = buildContextSnapshot;',
+    ].join('\n');
+}
+/**
+ * Builds the snapshot the hook writes, redacted and under the byte ceiling.
+ *
+ * Serialised into the hook by `emitRedactor` and imported directly by the
+ * tests, so what the tests exercise is what runs.
+ */
+export function buildContextSnapshot(input) {
+    const snapshot = {
+        tool: input.tool,
+        reason: input.reason,
+        cwd: redactSecrets(input.cwd),
+        toolInput: redactSecrets(input.toolInput),
+    };
+    const serialised = JSON.stringify(snapshot);
+    if (serialised.length > MAX_SNAPSHOT_BYTES) {
+        // Drop the arguments rather than truncating the JSON into something that
+        // will not parse. A snapshot that says why it is incomplete is usable; a
+        // snapshot that is silently half a document is not.
+        //
+        // No re-serialise: the replacement is a short string, so the result is
+        // necessarily under the cap, and nothing downstream reads a byte count.
+        snapshot['toolInput'] = `[elided: ${serialised.length} bytes over the ${MAX_SNAPSHOT_BYTES} cap]`;
+    }
+    return snapshot;
+}
+//# sourceMappingURL=holdRedaction.js.map

package/dist/harness/holdRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holdRedaction.js","sourceRoot":"","sources":["../../src/harness/holdRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAA;AAC/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAA;AAC1B,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAC3B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,qHAAqH,CAAA;IAEvH,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAa;QAC7B,mBAAmB,EAAE,oBAAoB;QACzC,mBAAmB,EAAE,8BAA8B;QACnD,4BAA4B,EAAE,YAAY;QAC1C,sBAAsB,EAAE,wBAAwB;QAChD,6BAA6B,EAAE,SAAS;QACxC,+BAA+B;QAC/B,+BAA+B,EAAE,QAAQ;QACzC,yBAAyB,EAAE,SAAS;QACpC,6DAA6D,EAAE,MAAM;QACrE,2EAA2E;QAC3E,4BAA4B;QAC5B,2BAA2B;KAC5B,CAAA;IAED,iEAAiE;IACjE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,MAAM,cAAc,GAAG,kEAAkE,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,CAAA;IAE5B,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAyB,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBAAE,SAAQ;YAClD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAA;YACxB,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAW,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAA;YACpE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,SAAQ;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,YAAY,CAAA;YACrD,MAAM,GAAG,GAAG,CAAA;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAA;QACtB,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,iDAAiD;QACjD,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,EAAE,IAAI,YAAY;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QAClE,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,wEAAwE;YACxE,0EAA0E;YAC1E,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACvC,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,UAAU,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,IAAI,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,eAAe,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,mEAAmE;IACnE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,sDAAsD;IACtD,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,OAAO;QACL,0EAA0E;QAC1E,gEAAgE;QAChE,sBAAsB,UAAU,GAAG;QACnC,qBAAqB,SAAS,GAAG;QACjC,qBAAqB,SAAS,GAAG;QACjC,8BAA8B,kBAAkB,GAAG;QACnD,yBAAyB,MAAM,CAAC,aAAa,CAAC,GAAG;QACjD,gCAAgC,MAAM,CAAC,oBAAoB,CAAC,GAAG;QAC/D,wCAAwC;QACxC,iDAAiD;KAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAC1C,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ,CAAC,WAAW,CAAC,GAAG,YAAY,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,OAAO,CAAA;IACnG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/harness/jetbrainsXmlConfig.d.ts

@@ -0,0 +1,51 @@
+/**
+ * jetbrainsXmlConfig.ts — narrow, dependency-free reader/writer for the
+ * JetBrains Platform's `<application><component name="X">...</component>
+ * </application>` settings-file shape.
+ *
+ * # Why this exists, and why it is not a general XML library
+ *
+ * `windsurfHooks.ts` needs to write into TWO files that live under a
+ * JetBrains IDE's `options/` directory — `proxy.settings.xml` (the IDE
+ * platform's own HTTP proxy setting) and `CodeiumSettings.xml` (the
+ * Windsurf plugin's own settings, including its `detectProxy` toggle) —
+ * and BOTH already exist on a real install, carrying settings this
+ * codebase has no business touching (a user's proxy exceptions list, their
+ * indexing path, dozens of unrelated plugin toggles, some of which — like
+ * `customTrackedWorkspaces` — serialize as a NESTED element, not a simple
+ * `<option name value/>` pair). A wholesale overwrite — the pattern
+ * `atomicWriteJson` uses for files this codebase fully owns, like
+ * `hooks.json` — would silently destroy those. This module instead
+ * MERGES at two levels:
+ *
+ * - Every OTHER `<component>` in the file is passed through completely
+ *   unchanged — this module never parses their contents.
+ * - Within the ONE component the caller names, every simple self-closing
+ *   `<option name="K" value="V" />` this module recognizes is
+ *   added/overwritten by key; anything else inside that same component
+ *   (a nested `<option name="X"><list>...</list></option>`, a comment,
+ *   whatever) is preserved VERBATIM, appended after the merged simple
+ *   options — never dropped, never guessed at.
+ *
+ * The only thing this module refuses outright (writes nothing, returns
+ * `false`) is content it cannot even locate an `<application>` root and
+ * `<component>` children in at all — a file this foreign is not this
+ * module's to touch.
+ *
+ * @module
+ */
+/**
+ * Merges `desiredOptions` into `filePath`'s `<component name=
+ * componentName">` block as simple `<option name value/>` entries,
+ * creating the file/component fresh if absent. Every other component,
+ * and anything inside the target component this module does not
+ * recognize as a simple option, is preserved unchanged (see module doc
+ * comment). `desiredOptions` values are stringified as `"true"`/`"false"`
+ * for booleans, matching JetBrains' own XML serialization convention.
+ *
+ * Returns `false` (and writes nothing) when the existing file does not
+ * match the `<application><component>...` shape this module understands
+ * at all — refusal, not a guess.
+ */
+export declare function mergeXmlComponentOptions(filePath: string, componentName: string, desiredOptions: Readonly<Record<string, string | boolean>>, readFile: (path: string) => Promise<string | null>, writeFileAtomic: (path: string, content: string) => Promise<void>): Promise<boolean>;
+//# sourceMappingURL=jetbrainsXmlConfig.d.ts.map

package/dist/harness/jetbrainsXmlConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jetbrainsXmlConfig.d.ts","sourceRoot":"","sources":["../../src/harness/jetbrainsXmlConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAwGH;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAC1D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAClD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,CA0BlB"}

package/dist/harness/jetbrainsXmlConfig.js

@@ -0,0 +1,151 @@
+/**
+ * jetbrainsXmlConfig.ts — narrow, dependency-free reader/writer for the
+ * JetBrains Platform's `<application><component name="X">...</component>
+ * </application>` settings-file shape.
+ *
+ * # Why this exists, and why it is not a general XML library
+ *
+ * `windsurfHooks.ts` needs to write into TWO files that live under a
+ * JetBrains IDE's `options/` directory — `proxy.settings.xml` (the IDE
+ * platform's own HTTP proxy setting) and `CodeiumSettings.xml` (the
+ * Windsurf plugin's own settings, including its `detectProxy` toggle) —
+ * and BOTH already exist on a real install, carrying settings this
+ * codebase has no business touching (a user's proxy exceptions list, their
+ * indexing path, dozens of unrelated plugin toggles, some of which — like
+ * `customTrackedWorkspaces` — serialize as a NESTED element, not a simple
+ * `<option name value/>` pair). A wholesale overwrite — the pattern
+ * `atomicWriteJson` uses for files this codebase fully owns, like
+ * `hooks.json` — would silently destroy those. This module instead
+ * MERGES at two levels:
+ *
+ * - Every OTHER `<component>` in the file is passed through completely
+ *   unchanged — this module never parses their contents.
+ * - Within the ONE component the caller names, every simple self-closing
+ *   `<option name="K" value="V" />` this module recognizes is
+ *   added/overwritten by key; anything else inside that same component
+ *   (a nested `<option name="X"><list>...</list></option>`, a comment,
+ *   whatever) is preserved VERBATIM, appended after the merged simple
+ *   options — never dropped, never guessed at.
+ *
+ * The only thing this module refuses outright (writes nothing, returns
+ * `false`) is content it cannot even locate an `<application>` root and
+ * `<component>` children in at all — a file this foreign is not this
+ * module's to touch.
+ *
+ * @module
+ */
+const COMPONENT_RE = /<component\s+name="([^"]*)">([\s\S]*?)<\/component>/g;
+const SIMPLE_OPTION_RE = /<option\s+name="([^"]*)"\s+value="([^"]*)"\s*\/>/g;
+function escapeXmlAttr(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/"/g, '&quot;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function parseComponentInner(inner) {
+    const simpleOptions = new Map();
+    let extra = inner;
+    SIMPLE_OPTION_RE.lastIndex = 0;
+    let match;
+    while ((match = SIMPLE_OPTION_RE.exec(inner)) !== null) {
+        const [full, key, value] = match;
+        if (key === undefined || value === undefined || full === undefined)
+            continue;
+        simpleOptions.set(key, value);
+        extra = extra.replace(full, '');
+    }
+    // Normalized to one trimmed line per non-empty line, deliberately
+    // dropping the ORIGINAL indentation depth: re-applying a fixed indent
+    // on top of already-indented text (rather than a normalized base) would
+    // make the file's whitespace grow by one indent level on every sync
+    // cycle this module runs in. XML semantics never depend on this
+    // whitespace, so normalizing costs nothing real and keeps repeated
+    // merges idempotent byte-for-byte.
+    const normalizedExtra = extra
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .join('\n');
+    return { simpleOptions, extra: normalizedExtra };
+}
+/** Parses `raw` (the file's current content, or `null`/empty if it does
+ *  not exist yet) looking for the `<application>` shape this module
+ *  understands. An absent/empty file is `ok: true` with no target —
+ *  "create fresh," not a parse failure. */
+function parseApplicationXml(raw, targetComponentName) {
+    const otherComponents = new Map();
+    if (raw === null || raw.trim().length === 0) {
+        return { ok: true, otherComponents, target: undefined };
+    }
+    const appMatch = /^\s*(?:<\?xml[^>]*\?>\s*)?<application>([\s\S]*)<\/application>\s*$/.exec(raw);
+    if (!appMatch) {
+        return { ok: false, otherComponents, target: undefined };
+    }
+    const body = appMatch[1] ?? '';
+    let target;
+    let match;
+    COMPONENT_RE.lastIndex = 0;
+    while ((match = COMPONENT_RE.exec(body)) !== null) {
+        const [full, name, inner] = match;
+        if (name === undefined || inner === undefined || full === undefined)
+            continue;
+        if (name === targetComponentName) {
+            target = parseComponentInner(inner);
+        }
+        else {
+            otherComponents.set(name, full);
+        }
+    }
+    // Anything at the <application> level that is not whitespace and not one
+    // of the <component> blocks just consumed is content this module does
+    // not understand — refuse the whole file rather than silently drop it.
+    // (Length-based, not substring-removal: two components could otherwise
+    // have byte-identical bodies and make removal ambiguous.)
+    const nonWhitespaceLength = body.replace(/\s/g, '').length;
+    const consumedNonWhitespaceLength = [...body.matchAll(COMPONENT_RE)]
+        .map((m) => (m[0] ?? '').replace(/\s/g, '').length)
+        .reduce((a, b) => a + b, 0);
+    if (nonWhitespaceLength !== consumedNonWhitespaceLength) {
+        return { ok: false, otherComponents, target: undefined };
+    }
+    return { ok: true, otherComponents, target };
+}
+/**
+ * Merges `desiredOptions` into `filePath`'s `<component name=
+ * componentName">` block as simple `<option name value/>` entries,
+ * creating the file/component fresh if absent. Every other component,
+ * and anything inside the target component this module does not
+ * recognize as a simple option, is preserved unchanged (see module doc
+ * comment). `desiredOptions` values are stringified as `"true"`/`"false"`
+ * for booleans, matching JetBrains' own XML serialization convention.
+ *
+ * Returns `false` (and writes nothing) when the existing file does not
+ * match the `<application><component>...` shape this module understands
+ * at all — refusal, not a guess.
+ */
+export async function mergeXmlComponentOptions(filePath, componentName, desiredOptions, readFile, writeFileAtomic) {
+    const existing = await readFile(filePath);
+    const parsed = parseApplicationXml(existing, componentName);
+    if (!parsed.ok)
+        return false;
+    const options = parsed.target?.simpleOptions ?? new Map();
+    for (const [key, value] of Object.entries(desiredOptions)) {
+        options.set(key, typeof value === 'boolean' ? String(value) : value);
+    }
+    const optionLines = [...options.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) => `    <option name="${escapeXmlAttr(key)}" value="${escapeXmlAttr(value)}" />`)
+        .join('\n');
+    const extra = parsed.target?.extra;
+    const componentBody = extra ? `${optionLines}\n${extra.split('\n').map((l) => `    ${l}`).join('\n')}` : optionLines;
+    const componentBlock = `  <component name="${escapeXmlAttr(componentName)}">\n${componentBody}\n  </component>`;
+    const otherBlocks = [...parsed.otherComponents.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([, block]) => `  ${block}`);
+    const body = [componentBlock, ...otherBlocks].join('\n');
+    const serialized = `<application>\n${body}\n</application>\n`;
+    await writeFileAtomic(filePath, serialized);
+    return true;
+}
+//# sourceMappingURL=jetbrainsXmlConfig.js.map