@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/harness/protectedPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedPaths.js","sourceRoot":"","sources":["../../src/harness/protectedPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,qCAAqC;IACrC,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IAEjB,sEAAsE;IACtE,4EAA4E;IAC5E,oEAAoE;IACpE,uBAAuB;IACvB,6BAA6B;IAE7B,2EAA2E;IAC3E,sEAAsE;IACtE,iCAAiC;IACjC,oBAAoB;IACpB,cAAc;IACd,8BAA8B;IAC9B,0EAA0E;IAC1E,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,2CAA2C;IAC3C,qBAAqB;IACrB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,oCAAoC;IAEpC,2EAA2E;IAC3E,gEAAgE;IAChE,kBAAkB;IAClB,4BAA4B;IAC5B,yCAAyC;IAEzC,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,uCAAuC;IACvC,aAAa;IACb,mBAAmB;IACnB,4BAA4B;IAE5B,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,+CAA+C;IAC/C,eAAe;IACf,oBAAoB;IAEpB,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,mBAAmB;IACnB,kBAAkB;IAClB,0BAA0B;CAC3B,CAAA;AAoGD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,8DAA8D,CAAA;AAExF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC;;;;;;OAMG;IACH,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,iBAAiB,EAAE,CAA2B;IAE9E,oEAAoE;IACpE,QAAQ,EAAE,4CAA4C,iBAAiB,MAAM;IAE7E;;;;;;;;;;;;;OAaG;IACH,8DAA8D;IAC9D,QAAQ,EAAE;QACR,+BAA+B;QAC/B,oFAAoF;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC;IAEZ;;;;;;;;;;;OAWG;IACH,KAAK,EAAE;QACL,uBAAuB;QACvB,gBAAgB;QAChB,sCAAsC;QACtC,2DAA2D;QAC3D,wBAAwB;QACxB,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC;CACJ,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,EAAU;IAC1D,MAAM,SAAS,GAA6C;QAC1D,CAAC,cAAc,EAAE,8FAA8F,CAAC;QAChH;YACE,cAAc;YACd,6EAA6E;gBAC3E,wEAAwE;gBACxE,0EAA0E;gBAC1E,8EAA8E;SACjF;QACD,CAAC,OAAO,EAAE,mEAAmE,CAAC;QAC9E,CAAC,MAAM,EAAE,sDAAsD,CAAC;QAChE,CAAC,SAAS,EAAE,kCAAkC,CAAC;QAC/C,CAAC,aAAa,EAAE,6EAA6E,CAAC;QAC9F,CAAC,eAAe,EAAE,uEAAuE,CAAC;QAC1F,CAAC,IAAI,EAAE,uDAAuD,CAAC;QAC/D,CAAC,GAAG,EAAE,uEAAuE,CAAC;KAC/E,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,KAAK,GAAG,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACtG,CAAC;IACD,sCAAsC;IACtC,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5F,CAAC;AACH,CAAC;AAED;+CAC+C;AAC/C,SAAS,oBAAoB,CAAC,QAAiC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACd,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,CAAC,EAAE,uDAAuD;gBACzE,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE,CAC1E,CAAA;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACxD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;oBACzE,oEAAoE,CACvE,CAAA;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,CAAC,EAAE,iDAAiD;gBACnE,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA4B,oBAAoB,CAAC;IACtF;QACE,EAAE,EAAE,uBAAuB;QAC3B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,mFAAmF;QAC3F,SAAS,EACP,sEAAsE;YACtE,uEAAuE;YACvE,0EAA0E;YAC1E,iEAAiE;QACnE,OAAO,EAAE,CAAC,iCAAiC,EAAE,6BAA6B,EAAE,sBAAsB,CAAC;QACnG,4EAA4E;QAC5E,wEAAwE;QACxE,mCAAmC;QACnC,UAAU,EAAE,CAAC,gCAAgC,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAClF;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,wFAAwF;QAChG,SAAS,EACP,uEAAuE;YACvE,uEAAuE;YACvE,sDAAsD;QACxD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;QACxE,UAAU,EAAE,CAAC,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,iDAAiD;QACzD,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,sEAAsE;QAC9E,SAAS,EACP,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,oEAAoE;QACtE,OAAO,EAAE,CAAC,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,CAAC;QACpG,UAAU,EAAE,CAAC,uBAAuB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC;KACzF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,2FAA2F;QACnG,SAAS,EACP,yEAAyE;YACzE,0EAA0E;YAC1E,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,+DAA+D;QACjE,OAAO,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,EAAE,yCAAyC,CAAC;QACxG,UAAU,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,CAAC;KAC7E;CACF,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B,oBAAoB,CAClF,CAAC,GAAG,EAAE;IACJ,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC1C,MAAM,MAAM,GAAG,SAAS,GAAG,wBAAwB,CAAA;IACnD,MAAM,OAAO,GAAG,MAAM,GAAG,sCAAsC,CAAA;IAC/D,MAAM,KAAK,GAAG,WAAW,GAAG,0BAA0B,CAAA;IACtD,6EAA6E;IAC7E,MAAM,KAAK,GAAG,KAAK,GAAG,kCAAkC,CAAA;IACxD,gFAAgF;IAChF,MAAM,MAAM,GAAG,MAAM,GAAG,kCAAkC,GAAG,kCAAkC,CAAA;IAC/F,MAAM,SAAS,GAAG,UAAU,GAAG,0BAA0B,CAAA;IACzD,MAAM,YAAY,GAAG,aAAa,GAAG,sBAAsB,CAAA;IAC3D,MAAM,SAAS,GAAG,aAAa,GAAG,kBAAkB,CAAA;IACpD,MAAM,QAAQ,GAAgE;QAC5E,wBAAwB,EAAE;YACxB,OAAO,EAAE,CAAC,oDAAoD,MAAM,KAAK,CAAC;YAC1E,UAAU,EAAE;gBACV,2CAA2C;gBAC3C,cAAc,GAAG,MAAM,GAAG,aAAa,EAAE,yBAAyB;gBAClE,cAAc,GAAG,MAAM,GAAG,oBAAoB,EAAE,4BAA4B;aAC7E;SACF;QACD,2BAA2B,EAAE;YAC3B,OAAO,EAAE,CAAC,iCAAiC,MAAM,IAAI,CAAC;YACtD,UAAU,EAAE;gBACV,oDAAoD;gBACpD,cAAc,GAAG,SAAS,GAAG,SAAS;gBACtC,oDAAoD;aACrD;SACF;QACD,sBAAsB,EAAE;YACtB,OAAO,EAAE,CAAC,6BAA6B,OAAO,IAAI,CAAC;YACnD,UAAU,EAAE;gBACV,6CAA6C;gBAC7C,cAAc,GAAG,MAAM,GAAG,eAAe;gBACzC,cAAc,GAAG,MAAM,GAAG,wCAAwC;aACnE;SACF;QACD,yBAAyB,EAAE;YACzB,OAAO,EAAE,CAAC,eAAe,YAAY,IAAI,EAAE,eAAe,SAAS,IAAI,CAAC;YACxE,UAAU,EAAE;gBACV,2CAA2C;gBAC3C,0CAA0C;gBAC1C,qDAAqD;aACtD;SACF;QACD,4BAA4B,EAAE;YAC5B,OAAO,EAAE,CAAC,kCAAkC,KAAK,IAAI,CAAC;YACtD,UAAU,EAAE;gBACV,kDAAkD;gBAClD,cAAc,GAAG,WAAW,GAAG,SAAS;gBACxC,cAAc,GAAG,WAAW,GAAG,4BAA4B,EAAE,oBAAoB;aAClF;SACF;QACD,6BAA6B,EAAE;YAC7B,OAAO,EAAE,CAAC,+BAA+B,KAAK,IAAI,CAAC;YACnD,UAAU,EAAE;gBACV,sDAAsD;gBACtD,cAAc,GAAG,KAAK,GAAG,YAAY;gBACrC,2DAA2D;gBAC3D,cAAc,GAAG,KAAK,GAAG,mCAAmC;aAC7D;SACF;QACD,+BAA+B,EAAE;YAC/B,OAAO,EAAE,CAAC,6CAA6C,MAAM,IAAI,CAAC;YAClE,UAAU,EAAE;gBACV,iDAAiD;gBACjD,cAAc,GAAG,MAAM,GAAG,YAAY;gBACtC,2DAA2D;gBAC3D,cAAc,GAAG,MAAM,GAAG,kCAAkC,GAAG,mCAAmC;aACnG;SACF;QACD,2BAA2B,EAAE;YAC3B,OAAO,EAAE,CAAC,iCAAiC,SAAS,IAAI,CAAC;YACzD,UAAU,EAAE;gBACV,uDAAuD;gBACvD,cAAc,GAAG,UAAU,GAAG,SAAS;gBACvC,cAAc,GAAG,UAAU,GAAG,4BAA4B,EAAE,sBAAsB;aACnF;SACF;KACF,CAAA;IACD,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAgB,EAAE;QACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAA;QAC5E,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,GAAG,CAAC,CAAC,WAAW,kDAAkD;gBAClE,gEAAgE;gBAChE,yDAAyD;YAC3D,SAAS,EACP,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,0BAA0B;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,EAAE,CACL,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,oBAAoB,CAAC;IAClF;QACE,EAAE,EAAE,mCAAmC;QACvC,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,MAAM;QAChB,MAAM,EACJ,kFAAkF;YAClF,qFAAqF;QACvF,SAAS,EACP,sFAAsF;YACtF,uFAAuF;YACvF,wEAAwE;QAC1E,OAAO,EAAE;YACP,oCAAoC;YACpC,0CAA0C;YAC1C,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,oBAAoB;YACpB,+BAA+B;YAC/B,aAAa;YACb,uCAAuC;SACxC;KACF;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,MAAM;QAChB,MAAM,EACJ,kFAAkF;YAClF,qFAAqF;QACvF,SAAS,EACP,gFAAgF;QAClF,OAAO,EAAE;YACP,oCAAoC;YACpC,0CAA0C;YAC1C,kDAAkD;SACnD;QACD,UAAU,EAAE;YACV,yBAAyB;YACzB,2BAA2B;YAC3B,+BAA+B;YAC/B,uCAAuC;SACxC;KACF;CACF,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA4B,oBAAoB;AACvF,8EAA8E;AAC9E,4EAA4E;AAC5E,sDAAsD;AACrD;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,MAAM,EAAE,+BAA+B;QACvC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,yCAAyC;QACjD,SAAS,EACP,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE;QACnE,OAAO,EAAE;YACP,YAAY;YACZ,+BAA+B;YAC/B,iBAAiB;YACjB,aAAa;YACb,uBAAuB;SACxB;QACD,UAAU,EAAE;YACV,iCAAiC;YACjC,iBAAiB;YACjB,YAAY;YACZ,uBAAuB;YACvB,uBAAuB;YACvB,iBAAiB;SAClB;KACF;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,2BAA2B;QACnC,SAAS,EACP,0EAA0E;YAC1E,0EAA0E;YAC1E,4EAA4E;QAC9E,OAAO,EAAE,CAAC,uBAAuB,EAAE,yBAAyB,EAAE,8BAA8B,CAAC;QAC7F,UAAU,EAAE,CAAC,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,CAAC;KAC5E;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,yCAAyC;QACjD,SAAS,EACP,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;QACvE,OAAO,EAAE,CAAC,+BAA+B,EAAE,wCAAwC,EAAE,wBAAwB,CAAC;QAC9G,UAAU,EAAE,CAAC,gCAAgC,EAAE,iCAAiC,EAAE,aAAa,CAAC;KACjG;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,oCAAoC;QAC5C,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EACP,2EAA2E;YAC3E,4EAA4E;YAC5E,gCAAgC;QAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,gCAAgC,CAAC;QACvF,UAAU,EAAE,CAAC,uBAAuB,EAAE,iBAAiB,EAAE,YAAY,CAAC;KACvE;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,gDAAgD;QACxD,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,wDAAwD;QAChE,SAAS,EACP,0EAA0E;YAC1E,uEAAuE;YACvE,0BAA0B;QAC5B,OAAO,EAAE,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,mBAAmB,CAAC;QAC5E,UAAU,EAAE,CAAC,6BAA6B,EAAE,sBAAsB,EAAE,eAAe,CAAC;KACrF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,0DAA0D;QAClE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,uDAAuD;QAC/D,SAAS,EACP,qEAAqE;YACrE,oEAAoE;YACpE,0BAA0B;QAC5B,OAAO,EAAE,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,uBAAuB,CAAC;QACrF,UAAU,EAAE,CAAC,wBAAwB,EAAE,4BAA4B,EAAE,qBAAqB,CAAC;KAC5F;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW;QACnB,SAAS,EACP,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,+CAA+C;QACjD,OAAO,EAAE,CAAC,eAAe,EAAE,oBAAoB,EAAE,yBAAyB,CAAC;QAC3E,UAAU,EAAE,CAAC,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,CAAC;KAC9E;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,2CAA2C;QACnD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kDAAkD;QAC1D,SAAS,EACP,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,uBAAuB;QACzB,OAAO,EAAE,CAAC,gCAAgC,EAAE,mCAAmC,EAAE,gBAAgB,CAAC;QAClG,UAAU,EAAE,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,yBAAyB,CAAC;KACnG;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,2BAA2B;QACnC,SAAS,EACP,wEAAwE;YACxE,2EAA2E;YAC3E,2EAA2E;YAC3E,wEAAwE;YACxE,kBAAkB;QACpB,OAAO,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC;QACjF,UAAU,EAAE,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;KAC5E;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,MAAM,EAAE,2DAA2D;QACnE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,sDAAsD;QAC9D,SAAS,EACP,sEAAsE;YACtE,2EAA2E;YAC3E,oDAAoD;QACtD,OAAO,EAAE,CAAC,2BAA2B,EAAE,kBAAkB,EAAE,gCAAgC,CAAC;QAC5F,UAAU,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,wBAAwB,CAAC;KAC/E;CACiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CACvE,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;GAMG;AACH,MAAM,6BAA6B,GAA4B,CAAC,GAAG,EAAE,CACnE,oBAAoB,CAClB,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE;IACpE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,OAAgB;IAC1B,MAAM,EAAE,0DAA0D,CAAC,EAAE;IACrE,SAAS,EACP,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,CAAC,GAAG;IACZ,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC;IACnE,UAAU,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC;CAC9D,CAAC,CAAC,CACJ,CAAC,EAAE,CAAA;AAEN,MAAM,UAAU,0BAA0B;IACxC,OAAO,6BAA6B,CAAA;AACtC,CAAC;AAED;;;;;;;;;;kBAUkB;AAClB,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,GAAG,0BAA0B;QAC7B,GAAG,uBAAuB;QAC1B,GAAG,sBAAsB;QACzB,GAAG,0BAA0B,EAAE;KAChC,CAAA;AACH,CAAC"}

package/dist/harness/rooCodeHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rooCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmOH;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAuEf"}
+{"version":3,"file":"rooCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAqNH;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAuEf"}

package/dist/harness/rooCodeHooks.js

@@ -20,18 +20,10 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { newIso } from '@intutic/id';
+import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+import { UNIVERSAL_PROTECTED_PATHS } from './protectedPaths.js';
 const log = createLogger('sync-roo-code-hooks');
 /** Governance-sensitive paths that the hook gate protects. */
-const PROTECTED_PATHS = [
-    path.join(os.homedir(), '.claude', 'settings.json'),
-    path.join(os.homedir(), '.claude', 'settings.local.json'),
-    '.claude/settings.json',
-    '.claude/settings.local.json',
-    '.intutic/hooks',
-    '.intutic/integrity.json',
-    '.intutic/context_integrity.json',
-    '.roorules/hooks',
-];
 // ─── Node.js hook script template ─────────────────────────────────────────────
 function buildRooCheckScript(proxyUrl, workspaceRoot, workspaceId) {
     const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'roo-hook-events.jsonl');
@@ -52,6 +44,7 @@ function buildRooCheckScript(proxyUrl, workspaceRoot, workspaceId) {
  * Workspace: ${workspaceId}
  */
 'use strict';
+${emitJsFailClosedPrelude({ harness: 'roo-code', contract: 'stdout-cancel' })}
 const path = require('path');
 const os = require('os');
 const fs = require('fs');
@@ -83,11 +76,12 @@ function loadRuntimeEnv() {
 }
 
 // ── Governance-sensitive paths ────────────────────────────────────────────────
-const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+${emitJsGate({ harness: "roo-code", contract: 'stdout-cancel' })}
 
 // ── Dual-path logEvent ────────────────────────────────────────────────────────
 const HOOK_EVENTS_LOG = ${JSON.stringify(hookEventsLog)};
 
+let _intuticSessionId = '';
 function logEvent(env, verdict, toolName, reason) {
   const ts = new Date().toISOString();
   const incidentId = crypto.createHash('sha1')
@@ -95,13 +89,16 @@ function logEvent(env, verdict, toolName, reason) {
     .digest('hex').slice(0, 16);
 
   const entry = {
-    event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+    // Passed through, not collapsed to two values: the advisory tier emits
+      // 'tool_flagged', and a ternary here silently recorded it as an allow.
+      event: verdict,
     toolName,
     reason: reason || '',
     workspaceId: env.INTUTIC_WORKSPACE_ID,
     harnessType: 'roo-code',
     timestamp: ts,
     incidentId,
+    ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
   };
 
   // Path B — reliable file append
@@ -135,13 +132,13 @@ function logEvent(env, verdict, toolName, reason) {
 }
 
 function block(env, toolName, reason) {
-  logEvent(env, 'blocked', toolName, reason);
+  logEvent(env, 'tool_blocked', toolName, reason);
   process.stdout.write(JSON.stringify({ cancel: true, errorMessage: reason }));
   process.exit(0);
 }
 
 function allow(env, toolName) {
-  logEvent(env, 'allowed', toolName, '');
+  logEvent(env, 'tool_allowed', toolName, '');
   process.stdout.write(JSON.stringify({ cancel: false }));
   process.exit(0);
 }
@@ -153,47 +150,36 @@ process.stdin.on('data', (chunk) => { inputData += chunk; });
 process.stdin.on('end', () => {
   try {
     const ctx = JSON.parse(inputData);
-    const toolName = (ctx.tool_name || ctx.toolName || '').toLowerCase();
+    _intuticSessionId = ctx.session_id || ctx.sessionId || ctx.conversation_id || ctx.conversationId || ctx.task_id || ctx.taskId || '';
+    // An envelope carrying none of the tool fields extracts to empty strings,
+    // which match no rule — an allow. Refused instead, and the refusal CANCELS
+    // (this harness ignores exit codes); see intuticGuardEnvelope.
+    intuticGuardEnvelope(ctx, ['tool_name', 'toolName', 'tool_input', 'toolInput'],
+      (v, t, r) => logEvent(runtimeEnv, v, t, r));
+    const toolName = (ctx.tool_name || ctx.toolName || '').toLowerCase()
+    // Case preserved for the gate. A BLOCK: SOP compiles to a tool-name
+    // pattern the operator wrote as they see it (Bash, Write) and this
+    // harness lowercases the tool for its own matching. Handing the gate the
+    // lowercased form means every SOP tool rule silently matches nothing here
+    // while appearing active everywhere else.
+    const rawToolName = ctx.tool_name || ctx.toolName || '';
     const toolInput = ctx.tool_input || ctx.toolInput || {};
     const toolInputStr = JSON.stringify(toolInput);
 
-    // 1. Protected-path guard
-    if (['edit', 'write', 'multiedit'].includes(toolName)) {
-      const targetPath = toolInput.path || toolInput.file_path ||
-        toolInput.new_path || toolInput.target || '';
-      for (const p of PROTECTED_PATHS) {
-        if (targetPath.includes(p) || String(targetPath).startsWith(p)) {
-          const reason = 'Attempt to modify governance-protected path: "' + targetPath + '". ' +
-            'To change governance policy, update your SOP via the Intutic control plane.';
-          block(runtimeEnv, toolName, reason);
-          return;
-        }
-      }
-    }
-
-    // 2. Bash/shell command bypass guard
-    if (toolName === 'bash') {
-      const cmd = toolInput.command || toolInput.cmd || '';
-      const BYPASS_PATTERNS = [
-        'chflags nouchg',
-        'chattr -i',
-        'rm -rf .intutic',
-        'rm -rf .roorules',
-      ];
-      for (const pattern of BYPASS_PATTERNS) {
-        if (cmd.includes(pattern)) {
-          const reason = 'Shell command matches governance bypass pattern: "' + pattern + '"';
-          block(runtimeEnv, toolName, reason);
-          return;
-        }
-      }
-    }
+    // Roo Code ignores the exit code and reads a cancel object from stdout, so
+    // the shared gate is emitted with the stdout-cancel contract. Getting that
+    // wrong is invisible in review — the gate would exit 2 into a harness that
+    // never looks at it, and every call would proceed.
+    const targetPath = toolInput.path || toolInput.file_path || toolInput.filePath ||
+      toolInput.new_path || toolInput.target || toolInput.notebook_path || '';
+    const command = toolInput.command || toolInput.cmd || toolInput.script || '';
+    intuticGate(rawToolName, targetPath, command, (v, t, r) => logEvent(runtimeEnv, v, t, r), runtimeEnv.INTUTIC_WORKSPACE_ID, toolInput);
 
     allow(runtimeEnv, toolName);
   } catch (err) {
     // Fail closed on parse error
     const env = runtimeEnv;
-    logEvent(env, 'blocked', 'unknown', String(err));
+    logEvent(env, 'tool_blocked', 'unknown', String(err));
     process.stdout.write(JSON.stringify({ cancel: true, errorMessage: '[Intutic] Hook error: ' + String(err) }));
     process.exit(0);
   }
@@ -217,7 +203,7 @@ function buildRooRulesContent() {
         '',
         'The following paths must not be modified by any agent:',
         '',
-        ...PROTECTED_PATHS.map((p) => `- \`${p}\``),
+        ...UNIVERSAL_PROTECTED_PATHS.map((p) => `- \`${p}\``),
         '',
         '### Hook Events',
         '',

package/dist/harness/rooCodeHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"rooCodeHooks.js","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,8DAA8D;AAC9D,MAAM,eAAe,GAAG;IACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;IACzD,uBAAuB;IACvB,6BAA6B;IAC7B,gBAAgB;IAChB,yBAAyB;IACzB,iCAAiC;IACjC,iBAAiB;CAClB,CAAA;AAED,iFAAiF;AAEjF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;IAC7F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAEhF,OAAO;;;;;;;;;;;YAWG,QAAQ;gBACJ,MAAM,EAAE;gBACR,WAAW;;;;;;;;;;;2BAWA,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;4BAM7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;0BAiB7B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;0BAG/B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgHtD,CAAC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB;IAC3B,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,wBAAwB;QACxB,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,wDAAwD;QACxD,EAAE;QACF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACjG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,8BAA8B,CAAC,CAAA;IAErG,6EAA6E;IAE7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC1D,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,uCAAuC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAA;QACjD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAChE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC5C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEvE,6EAA6E;IAE7E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,QAAQ,cAAc,EAAE;aAClC;SACF;KACF,CAAA;IAED,MAAM,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE,EACzD,6BAA6B,CAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rooCodeHooks.js","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,8DAA8D;AAE9D,iFAAiF;AAEjF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;IAC7F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAEhF,OAAO;;;;;;;;;;;YAWG,QAAQ;gBACJ,MAAM,EAAE;gBACR,WAAW;;;EAGzB,uBAAuB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;;;;;;;;;2BASlD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;4BAM7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;EAiBrD,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;;;0BAGtC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyGtD,CAAC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB;IAC3B,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,wBAAwB;QACxB,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,wDAAwD;QACxD,EAAE;QACF,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrD,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACjG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,8BAA8B,CAAC,CAAA;IAErG,6EAA6E;IAE7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC1D,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,uCAAuC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAA;QACjD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAChE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC5C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEvE,6EAA6E;IAE7E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,QAAQ,cAAc,EAAE;aAClC;SACF;KACF,CAAA;IAED,MAAM,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE,EACzD,6BAA6B,CAC9B,CAAA;AACH,CAAC"}

package/dist/harness/windsurfHooks.d.ts

@@ -12,6 +12,78 @@
  * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
  *
+ * # Correction (2026-08-18): this file's hook event names and payload
+ * # extraction were WRONG from the day this file was written, not a case of
+ * # Windsurf changing later
+ *
+ * The original implementation (2026-06-18) registered
+ * `beforeShellExecution`/`beforeMCPExecution`/`beforeFileEdit` — Cursor's
+ * event names — under the stated assumption that Windsurf's hook system
+ * "registers the same event names Cursor's does." That assumption was never
+ * independently verified, and it was wrong: Windsurf/Cascade's REAL hook
+ * system (confirmed against docs.devin.ai/desktop/cascade/hooks — the
+ * current authoritative source; docs.windsurf.com/windsurf/cascade/hooks
+ * redirects there post-Cognition/Devin acquisition — 2026-08-18) uses
+ * entirely different event names and a differently-shaped payload, and this
+ * naming was ALREADY the live one when this file was first written — a
+ * March-2026 third-party integration guide already documents
+ * `pre_run_command`/`tool_info.command_line`, predating this file's own
+ * 2026-06-18 commit date. This was a copy-without-verifying mistake at
+ * authoring time, not a later drift.
+ *
+ * Confirmed real facts, all from docs.devin.ai/desktop/cascade/hooks:
+ * - Event names (the `hooks.json` top-level keys) are `pre_run_command`,
+ *   `pre_write_code`, `pre_mcp_tool_use` (plus `post_*` variants this file
+ *   has no use for — only pre-hooks can block, via exit code 2; any other
+ *   non-zero exit is treated as a hook ERROR and the action proceeds, i.e.
+ *   Cascade fails OPEN if this script itself cannot run — same as every
+ *   other harness in this codebase, not a Windsurf-specific gap).
+ * - Each event's value in `hooks.json` is an ARRAY of `{command, ...}`
+ *   objects, not a single object — `[{command: "..."}]`, not
+ *   `{command: "..."}`. There is no `failClosed` field in Windsurf's schema
+ *   (that was Cursor's field, also copied without verification); dropped
+ *   from the config this file writes.
+ * - The payload delivered on stdin has `agent_action_name` as its event-name
+ *   field (not `hook_event_name`/`event`, which are Cursor's field names),
+ *   and nests event-specific data under `tool_info`:
+ *   `tool_info.command_line`/`tool_info.cwd` for `pre_run_command`,
+ *   `tool_info.file_path`/`tool_info.edits[]` for `pre_write_code`,
+ *   `tool_info.mcp_server_name`/`tool_info.mcp_tool_name`/
+ *   `tool_info.mcp_tool_arguments` for `pre_mcp_tool_use`. `trajectory_id`
+ *   is Cascade's real conversation-identifier field.
+ *
+ * # Follow-up (2026-08-18): JetBrains plugin coverage
+ *
+ * The JetBrains plugin reads user-level hooks.json from a DIFFERENT path —
+ * `~/.codeium/hooks.json`, no `windsurf` subdirectory — which this file now
+ * also writes (same config content). Its own changelog (v2.12.4) naming
+ * `post_setup_worktree`, one of Cascade's documented event names, as a hook
+ * it added is corroborating evidence the JetBrains plugin dispatches the
+ * SAME event/payload system as Desktop, not a guess. Workspace-level
+ * `.windsurf/hooks.json` needed no change — that path is workspace-root-
+ * relative, not app-specific, so the existing write already covers both
+ * clients. Still not independently verified: whether `post_mcp_tool_use`'s
+ * `mcp_result` field would be useful for anything (it isn't used here —
+ * post-hooks can't block, so there is nothing this file's threat model
+ * gains from it).
+ *
+ * # Follow-up 2 (2026-08-18): JetBrains proxy configuration
+ *
+ * The JetBrains plugin's proxy-config surface — the thing that decides
+ * whether its OWN AI traffic (not just hook dispatch) routes through
+ * Intutic's TLS MITM proxy — is now also configured, via
+ * `windsurfJetBrainsProxy.ts`. See that module's doc comment for the full
+ * research record: the plugin has no manual-proxy field of its own (only
+ * a `detectProxy` boolean that opts into the IDE PLATFORM's proxy
+ * setting), confirmed by decompiling the actual published plugin JAR, not
+ * guessed.
+ *
+ * The Cursor-shaped field names this file previously relied on exclusively
+ * are kept as a SECOND, lower-priority fallback in the extraction below —
+ * not because they are believed to be real for Windsurf, but because they
+ * cost nothing to keep checking and this file has already been wrong about
+ * a Windsurf-specific assumption once.
+ *
  * @module
  */
 /**

package/dist/harness/windsurfHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windsurfHooks.d.ts","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAiJH;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
+{"version":3,"file":"windsurfHooks.d.ts","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAuKH;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/harness/windsurfHooks.js

@@ -12,6 +12,78 @@
  * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
  *
+ * # Correction (2026-08-18): this file's hook event names and payload
+ * # extraction were WRONG from the day this file was written, not a case of
+ * # Windsurf changing later
+ *
+ * The original implementation (2026-06-18) registered
+ * `beforeShellExecution`/`beforeMCPExecution`/`beforeFileEdit` — Cursor's
+ * event names — under the stated assumption that Windsurf's hook system
+ * "registers the same event names Cursor's does." That assumption was never
+ * independently verified, and it was wrong: Windsurf/Cascade's REAL hook
+ * system (confirmed against docs.devin.ai/desktop/cascade/hooks — the
+ * current authoritative source; docs.windsurf.com/windsurf/cascade/hooks
+ * redirects there post-Cognition/Devin acquisition — 2026-08-18) uses
+ * entirely different event names and a differently-shaped payload, and this
+ * naming was ALREADY the live one when this file was first written — a
+ * March-2026 third-party integration guide already documents
+ * `pre_run_command`/`tool_info.command_line`, predating this file's own
+ * 2026-06-18 commit date. This was a copy-without-verifying mistake at
+ * authoring time, not a later drift.
+ *
+ * Confirmed real facts, all from docs.devin.ai/desktop/cascade/hooks:
+ * - Event names (the `hooks.json` top-level keys) are `pre_run_command`,
+ *   `pre_write_code`, `pre_mcp_tool_use` (plus `post_*` variants this file
+ *   has no use for — only pre-hooks can block, via exit code 2; any other
+ *   non-zero exit is treated as a hook ERROR and the action proceeds, i.e.
+ *   Cascade fails OPEN if this script itself cannot run — same as every
+ *   other harness in this codebase, not a Windsurf-specific gap).
+ * - Each event's value in `hooks.json` is an ARRAY of `{command, ...}`
+ *   objects, not a single object — `[{command: "..."}]`, not
+ *   `{command: "..."}`. There is no `failClosed` field in Windsurf's schema
+ *   (that was Cursor's field, also copied without verification); dropped
+ *   from the config this file writes.
+ * - The payload delivered on stdin has `agent_action_name` as its event-name
+ *   field (not `hook_event_name`/`event`, which are Cursor's field names),
+ *   and nests event-specific data under `tool_info`:
+ *   `tool_info.command_line`/`tool_info.cwd` for `pre_run_command`,
+ *   `tool_info.file_path`/`tool_info.edits[]` for `pre_write_code`,
+ *   `tool_info.mcp_server_name`/`tool_info.mcp_tool_name`/
+ *   `tool_info.mcp_tool_arguments` for `pre_mcp_tool_use`. `trajectory_id`
+ *   is Cascade's real conversation-identifier field.
+ *
+ * # Follow-up (2026-08-18): JetBrains plugin coverage
+ *
+ * The JetBrains plugin reads user-level hooks.json from a DIFFERENT path —
+ * `~/.codeium/hooks.json`, no `windsurf` subdirectory — which this file now
+ * also writes (same config content). Its own changelog (v2.12.4) naming
+ * `post_setup_worktree`, one of Cascade's documented event names, as a hook
+ * it added is corroborating evidence the JetBrains plugin dispatches the
+ * SAME event/payload system as Desktop, not a guess. Workspace-level
+ * `.windsurf/hooks.json` needed no change — that path is workspace-root-
+ * relative, not app-specific, so the existing write already covers both
+ * clients. Still not independently verified: whether `post_mcp_tool_use`'s
+ * `mcp_result` field would be useful for anything (it isn't used here —
+ * post-hooks can't block, so there is nothing this file's threat model
+ * gains from it).
+ *
+ * # Follow-up 2 (2026-08-18): JetBrains proxy configuration
+ *
+ * The JetBrains plugin's proxy-config surface — the thing that decides
+ * whether its OWN AI traffic (not just hook dispatch) routes through
+ * Intutic's TLS MITM proxy — is now also configured, via
+ * `windsurfJetBrainsProxy.ts`. See that module's doc comment for the full
+ * research record: the plugin has no manual-proxy field of its own (only
+ * a `detectProxy` boolean that opts into the IDE PLATFORM's proxy
+ * setting), confirmed by decompiling the actual published plugin JAR, not
+ * guessed.
+ *
+ * The Cursor-shaped field names this file previously relied on exclusively
+ * are kept as a SECOND, lower-priority fallback in the extraction below —
+ * not because they are believed to be real for Windsurf, but because they
+ * cost nothing to keep checking and this file has already been wrong about
+ * a Windsurf-specific assumption once.
+ *
  * @module
  */
 import * as fs from 'node:fs/promises';
@@ -19,37 +91,28 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { newIso } from '@intutic/id';
+import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+import { configureJetBrainsWindsurfProxy } from './windsurfJetBrainsProxy.js';
 const log = createLogger('sync-windsurf-hooks');
 const WINDSURF_USER_DIR = path.join(os.homedir(), '.codeium', 'windsurf');
-const PROTECTED_PATHS = [
-    '.codeium/windsurf/hooks.json',
-    '.windsurf/hooks.json',
-    '.intutic/hooks',
-    '.intutic/integrity.json',
-    '.claude/settings.json',
-    '.cursor/hooks.json',
-    '.cline/hooks',
-    '.agents/plugins/intutic-governance',
-    '.openhands/hooks.json',
-];
+/** The JetBrains plugin's user-level hooks.json lives directly under
+ *  `~/.codeium` — no `windsurf` subdirectory — confirmed against
+ *  docs.devin.ai/desktop/cascade/hooks (see module doc comment). Only
+ *  hooks.json goes here: this writer's `settings.json` proxy-config write
+ *  targets Desktop's known path specifically, and whether/how the
+ *  JetBrains plugin has an equivalent proxy-config surface was not
+ *  researched — out of scope for this fix, which is about hook dispatch. */
+const WINDSURF_JETBRAINS_USER_DIR = path.join(os.homedir(), '.codeium');
+/** Cascade's real pre-hook event names (see module doc comment). Each maps
+ *  to an ARRAY of hook entries in `hooks.json` — Windsurf's schema, unlike
+ *  Cursor's, has no `failClosed` field; exit code 2 is the only block
+ *  signal Cascade recognizes. */
+const CASCADE_HOOK_EVENTS = ['pre_run_command', 'pre_write_code', 'pre_mcp_tool_use'];
 function buildHooksConfig(hookScriptPath) {
     return {
         _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
         _lastSync: newIso(),
-        hooks: {
-            beforeShellExecution: {
-                command: `node "${hookScriptPath}"`,
-                failClosed: true,
-            },
-            beforeMCPExecution: {
-                command: `node "${hookScriptPath}"`,
-                failClosed: true,
-            },
-            beforeFileEdit: {
-                command: `node "${hookScriptPath}"`,
-                failClosed: true,
-            },
-        },
+        hooks: Object.fromEntries(CASCADE_HOOK_EVENTS.map((event) => [event, [{ command: `node "${hookScriptPath}"` }]])),
     };
 }
 function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
@@ -61,6 +124,7 @@ function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
  * Proxy: ${proxyUrl}
  * Generated: ${newIso()}
  */
+${emitJsFailClosedPrelude({ harness: 'windsurf', contract: 'exit2' })}
 const fs = require('fs');
 const crypto = require('crypto');
 const https = require('https');
@@ -78,19 +142,23 @@ try {
   });
 } catch {}
 
-const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+${emitJsGate({ harness: "windsurf", contract: 'exit2' })}
 
+let _intuticSessionId = '';
 function logEvent(verdict, toolName, reason) {
   try {
     const ts = new Date().toISOString();
     const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
     const entry = JSON.stringify({
-      event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+      // Passed through, not collapsed to two values: the advisory tier emits
+      // 'tool_flagged', and a ternary here silently recorded it as an allow.
+      event: verdict,
       toolName, reason: reason || '',
       workspaceId: _intuticWsId,
       harnessType: 'windsurf',
       timestamp: ts,
       incidentId,
+      ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
     }) + '\\n';
     fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
     if (_intuticKey) {
@@ -111,41 +179,63 @@ process.stdin.on('data', (c) => { raw += c; });
 process.stdin.on('end', () => {
   try {
     const ctx = JSON.parse(raw);
-    const event = (ctx.event || '').toLowerCase();
-    const input = ctx.input || ctx;
+    _intuticSessionId = ctx.trajectory_id || ctx.trajectoryId || ctx.session_id || ctx.sessionId ||
+      ctx.conversation_id || ctx.conversationId || ctx.task_id || ctx.taskId || '';
+    // 'agent_action_name' and 'tool_info' are Cascade's REAL top-level
+    // fields (docs.devin.ai/desktop/cascade/hooks; see this file's module
+    // doc comment for the correction record). The rest of this list is the
+    // Claude-Code-shaped envelope this repo's own generic gate-behaviour
+    // test suite drives every harness writer with uniformly, plus the
+    // Cursor-shaped fields this file incorrectly targeted before — kept so
+    // neither that test coverage nor an unconfirmed Windsurf variant loses
+    // recognition.
+    intuticGuardEnvelope(ctx, ['agent_action_name', 'tool_info', 'tool_name', 'toolName', 'tool_input', 'toolInput',
+      'input', 'event', 'hook_event_name', 'command', 'cmd', 'script', 'path', 'file_path', 'filePath', 'file',
+      'target', 'notebook_path'], logEvent);
+    // Cascade's real event field is 'agent_action_name' (values like
+    // 'pre_run_command'/'pre_write_code'/'pre_mcp_tool_use'), checked
+    // first. 'hook_event_name'/'event' are Cursor's field names, kept as a
+    // fallback this file no longer trusts as primary.
+    const event = (ctx.agent_action_name || ctx.hook_event_name || ctx.event || '').toLowerCase();
+    // Cascade nests event-specific data under 'tool_info' — NOT 'input' or
+    // 'tool_input', which are the Claude-Code/Cursor-shaped fields this file
+    // previously read exclusively. Prefer 'tool_info' when present; fall
+    // back to the others for the generic test envelope / an unconfirmed
+    // variant.
+    const toolInfo = ctx.tool_info || {};
+    const input = ctx.input || ctx.tool_input || ctx.toolInput || toolInfo || ctx;
 
-    const targetPath = input.path || input.file || input.target || '';
-    for (const p of PROTECTED_PATHS) {
-      if (String(targetPath).includes(p)) {
-        const reason = 'Attempt to modify protected path "' + targetPath + '"';
-        process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
-        logEvent('blocked', 'edit', reason);
-        process.exit(2);
-      }
-    }
+    const targetPath = toolInfo.file_path || input.path || input.file_path || input.filePath || input.file ||
+      input.target || input.notebook_path || '';
+    const command = toolInfo.command_line || input.command || input.cmd || input.script || '';
+    let toolName = ctx.tool_name || ctx.toolName || event || 'tool';
 
-    // Scan shell commands for governance bypass patterns
-    const command = input.command || input.cmd || '';
-    const dangerPatterns = [
-      /chflags\\s+nouchg/,
-      /chattr\\s+-i\\s+/,
-      /chmod\\s+[0-9]*[2367][0-9]*\\s+.*hooks/,
-    ];
-    for (const pat of dangerPatterns) {
-      if (pat.test(command)) {
-        const reason = 'Command matches bypass pattern: "' + command + '"';
-        process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
-        logEvent('blocked', 'bash', reason);
-        process.exit(2);
-      }
+    // M3: compose \`mcp__<server>__<tool>\` for an MCP tool call. Cascade's
+    // CONFIRMED real shape is event 'pre_mcp_tool_use' with
+    // tool_info.mcp_server_name/tool_info.mcp_tool_name (see module doc
+    // comment). The 'beforemcpexecution'/ctx.command-or-url branch below is
+    // Cursor's shape, which this file previously assumed without
+    // verification and which never matched anything Cascade actually
+    // sends — kept only as a fallback, now second priority.
+    if (event === 'pre_mcp_tool_use' && toolInfo.mcp_tool_name) {
+      toolName = 'mcp__' + toolInfo.mcp_server_name + '__' + toolInfo.mcp_tool_name;
+    } else if (event === 'beforemcpexecution' && ctx.tool_name) {
+      const mcpServer = ctx.command || ctx.url || ctx.server_name || ctx.serverName;
+      if (mcpServer) toolName = 'mcp__' + mcpServer + '__' + ctx.tool_name;
     }
 
-    logEvent('allowed', event || 'tool', '');
+    // The block reason now comes from the shared gate and always contains
+    // "governance rule". hookEvents.resolveSeverity keys CRITICAL off the
+    // "governance-protected" substring, and this was the one harness of twelve
+    // that omitted it — so a Windsurf agent caught tampering was filed MEDIUM.
+    intuticGate(toolName, targetPath, command, logEvent, _intuticWsId, input);
+
+    logEvent('tool_allowed', toolName, '');
     process.exit(0);
   } catch (err) {
     const errMsg = String(err);
     process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
-    logEvent('blocked', 'unknown', errMsg);
+    logEvent('tool_blocked', 'unknown', errMsg);
     process.exit(2);
   }
 });
@@ -171,19 +261,38 @@ export async function writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort = 88
     await fs.rename(tmpScript, hookScriptPath);
     await fs.chmod(hookScriptPath, 0o755);
     const config = buildHooksConfig(hookScriptPath);
-    // 1. User-level hooks
+    // 1. User-level hooks — Desktop's path.
     await fs.mkdir(WINDSURF_USER_DIR, { recursive: true });
     await atomicWriteJson(path.join(WINDSURF_USER_DIR, 'hooks.json'), config);
     log.info({ action: 'windsurf_hooks_written', level: 'user' }, 'Windsurf user-level hooks written');
-    // 2. Workspace-level hooks (.windsurf/hooks.json)
+    // 1b. User-level hooks — the JetBrains plugin's SEPARATE path. Same config
+    // content: the JetBrains plugin's own changelog (v2.12.4) names
+    // `post_setup_worktree` — one of Cascade's documented event names — as a
+    // hook it added, which is corroborating evidence (not a guess) that it
+    // dispatches the same Cascade hook event/payload system as Desktop, just
+    // reads its user-level config from this different file.
+    await fs.mkdir(WINDSURF_JETBRAINS_USER_DIR, { recursive: true });
+    await atomicWriteJson(path.join(WINDSURF_JETBRAINS_USER_DIR, 'hooks.json'), config);
+    log.info({ action: 'windsurf_hooks_written', level: 'user-jetbrains' }, 'Windsurf JetBrains plugin user-level hooks written');
+    // 2. Workspace-level hooks (.windsurf/hooks.json) — the SAME relative path
+    // for both Desktop and the JetBrains plugin (workspace-root-relative, not
+    // app-specific), so this one write already covers both. Hooks configured
+    // at multiple levels are NOT one-wins: Cascade runs every level's hooks
+    // for a matching event, in order system → user → workspace (confirmed
+    // against docs.devin.ai/desktop/cascade/hooks) — an earlier version of
+    // this comment claimed user-level "takes precedence," which was another
+    // unverified assumption.
     const wsWindsurfDir = path.join(workspaceRoot, '.windsurf');
     await fs.mkdir(wsWindsurfDir, { recursive: true });
     await atomicWriteJson(path.join(wsWindsurfDir, 'hooks.json'), {
         ...config,
-        _note: 'Workspace-level hooks — agent may be able to modify this file. User-level hooks take precedence.',
+        _note: 'Workspace-level hooks — agent may be able to modify this file. Runs IN ADDITION to ' +
+            'user-level hooks (Cascade runs every configured level for a matching event; last-wins/' +
+            'precedence is not how this works), so this file being tampered with does not disable ' +
+            'user-level enforcement.',
     });
     log.info({ action: 'windsurf_hooks_written', level: 'workspace' }, 'Windsurf workspace-level hooks written');
-    // 3. HTTP proxy settings → routes Windsurf's Cascade AI traffic through Intutic TLS MITM
+    // 3. HTTP proxy settings — Desktop's own settings.json.
     const wsSettings = {
         _comment: 'Intutic proxy settings — auto-generated. DO NOT EDIT.',
         _lastSync: newIso(),
@@ -193,6 +302,11 @@ export async function writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort = 88
     };
     await atomicWriteJson(path.join(WINDSURF_USER_DIR, 'settings.json'), wsSettings);
     log.info({ action: 'windsurf_proxy_configured', port: proxyPort }, 'Windsurf HTTP proxy configured for TLS MITM interception');
+    // 4. HTTP proxy settings — every installed JetBrains product. See
+    // windsurfJetBrainsProxy.ts's module doc comment for what this
+    // configures and why it needs two merge-writes per product rather than
+    // one owned file the way Desktop's settings.json is.
+    await configureJetBrainsWindsurfProxy(proxyPort);
 }
 async function atomicWriteJson(filePath, data) {
     const tmp = filePath + '.intutic-tmp';

package/dist/harness/windsurfHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"windsurfHooks.js","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEzE,MAAM,eAAe,GAAG;IACtB,8BAA8B;IAC9B,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;IACd,oCAAoC;IACpC,uBAAuB;CACxB,CAAA;AAED,SAAS,gBAAgB,CAAC,cAAsB;IAC9C,OAAO;QACL,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,oBAAoB,EAAE;gBACpB,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;YACD,kBAAkB,EAAE;gBAClB,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;YACD,cAAc,EAAE;gBACd,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;gFAQwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;0BAWjF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;wBAcjC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDpD,CAAA;AACD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,SAAS,GAAG,IAAI,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAE/C,sBAAsB;IACtB,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACzE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAElG,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;QAC5D,GAAG,MAAM;QACT,KAAK,EAAE,kGAAkG;KAC1G,CAAC,CAAA;IACF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,wCAAwC,CAAC,CAAA;IAE5G,yFAAyF;IACzF,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,uDAAuD;QACjE,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,oBAAoB,SAAS,EAAE;QAC7C,qBAAqB,EAAE,KAAK,EAAE,iCAAiC;QAC/D,eAAe,EAAE,oBAAoB,SAAS,EAAE;KACjD,CAAA;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,2BAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,EACxD,0DAA0D,CAC3D,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}
+{"version":3,"file":"windsurfHooks.js","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAA;AAE7E,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEzE;;;;;;4EAM4E;AAC5E,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;AAGvE;;;iCAGiC;AACjC,MAAM,mBAAmB,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,CAAU,CAAA;AAE9F,SAAS,gBAAgB,CAAC,cAAsB;IAC9C,OAAO;QACL,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC,CACvF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;gFAOW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkBhC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+EpD,CAAA;AACD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,SAAS,GAAG,IAAI,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAE/C,wCAAwC;IACxC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACzE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAElG,2EAA2E;IAC3E,gEAAgE;IAChE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACnF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAC7D,oDAAoD,CACrD,CAAA;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,yBAAyB;IACzB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;QAC5D,GAAG,MAAM;QACT,KAAK,EAAE,qFAAqF;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,yBAAyB;KAC5B,CAAC,CAAA;IACF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,wCAAwC,CAAC,CAAA;IAE5G,wDAAwD;IACxD,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,uDAAuD;QACjE,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,oBAAoB,SAAS,EAAE;QAC7C,qBAAqB,EAAE,KAAK,EAAE,iCAAiC;QAC/D,eAAe,EAAE,oBAAoB,SAAS,EAAE;KACjD,CAAA;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,2BAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,EACxD,0DAA0D,CAC3D,CAAA;IAED,kEAAkE;IAClE,+DAA+D;IAC/D,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}