@intutic/sync-daemon 1.10.1 → 2.1.0

package/dist/harness/hermesHooks.js

@@ -20,6 +20,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
+import { parseDocument, isMap } from 'yaml';
 import { newIso } from '@intutic/id';
 import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
 const log = createLogger('sync-hermes-hooks');
@@ -97,43 +98,43 @@ exit 0
 }
 // ─── YAML merge helpers ───────────────────────────────────────────────────────
 /**
- * YAML-safe merge of the Hermes config.
- *
- * Strategy (no YAML library — pure string manipulation):
- * - If file doesn't exist: write fresh with just the hooks block.
- * - If file exists and already contains `preToolUse:`: replace the command line.
- * - If file exists but has no `preToolUse:`: append the hooks block.
- * - If file has `hooks:` but no `preToolUse:`: insert inside existing hooks section.
+ * Merge the hook registration into the Hermes config: `hooks.preToolUse.command`
+ * is set to the gate, and everything else in the file — other hooks, MCP
+ * servers, comments — is kept. Edited through the `yaml` document model; an
+ * earlier line-based version replaced the first `command:` line anywhere in
+ * the file, whichever key it belonged to. A file that does not parse, or is
+ * not a mapping, is left untouched and reported.
  */
-async function mergeHermesConfig(hookScriptPath) {
-    const hooksBlock = [
-        'hooks:',
-        '  preToolUse:',
-        `    command: ${hookScriptPath}`,
-    ].join('\n');
-    let existing = null;
+export function mergeHermesYaml(existing, hookScriptPath) {
+    const doc = parseDocument(existing);
+    if (doc.errors.length > 0)
+        return null;
+    if (doc.contents === null)
+        doc.contents = doc.createNode({});
+    if (!isMap(doc.contents))
+        return null;
     try {
-        existing = await fs.readFile(HERMES_CONFIG, 'utf-8');
+        doc.setIn(['hooks', 'preToolUse', 'command'], hookScriptPath);
     }
     catch {
-        // File doesn't exist — write fresh
-    }
-    let merged;
-    if (existing === null) {
-        // Fresh write
-        merged = hooksBlock + '\n';
+        // `hooks` or `hooks.preToolUse` is a scalar or list — not a shape to edit.
+        return null;
     }
-    else if (/^\s*preToolUse:/m.test(existing)) {
-        // Replace the existing command line under preToolUse:
-        merged = existing.replace(/^(\s*command:\s*).*$/m, `$1${hookScriptPath}`);
+    return doc.toString();
+}
+async function mergeHermesConfig(hookScriptPath) {
+    let existing = '';
+    try {
+        existing = await fs.readFile(HERMES_CONFIG, 'utf-8');
     }
-    else if (/^hooks:/m.test(existing)) {
-        // hooks: block exists but no preToolUse: — insert inside hooks section
-        merged = existing.replace(/^(hooks:\s*)$/m, `$1\n  preToolUse:\n    command: ${hookScriptPath}`);
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
     }
-    else {
-        // No hooks: block at all — append
-        merged = existing.trimEnd() + '\n\n' + hooksBlock + '\n';
+    const merged = mergeHermesYaml(existing, hookScriptPath);
+    if (merged === null) {
+        log.warn({ action: 'hermes_config_merge_skipped', path: HERMES_CONFIG }, `${HERMES_CONFIG} could not be merged — left untouched`);
+        return;
     }
     const tmpPath = HERMES_CONFIG + '.intutic-tmp';
     await fs.writeFile(tmpPath, merged, 'utf-8');
@@ -156,7 +157,7 @@ Before every tool call, you MUST verify compliance with workspace SOPs.
 A pre-tool-use hook (\`~/.intutic/hooks/hermes-check.sh\`) enforces these rules automatically.
 
 If a tool call is blocked, do NOT attempt to circumvent the governance gate.
-To update policy, use the Intutic control plane at \`${proxyUrl}\`.
+Policy is managed in Intutic; this agent's LLM traffic goes through the Intutic proxy at \`${proxyUrl}\`.
 `;
 }
 // ─── Main export ──────────────────────────────────────────────────────────────

package/dist/harness/hermesHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,eAAe;QACf,gBAAgB,cAAc,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,cAAc;QACd,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC5B,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,sDAAsD;QACtD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,OAAO,CACvB,gBAAgB,EAChB,mCAAmC,cAAc,EAAE,CACpD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;uDAe8C,QAAQ;CAC9D,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}
+{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAiB,MAAM,MAAM,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuC7C,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;CAGrC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,GAAG,GAAa,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,aAAa,uCAAuC,CAAC,CAAA;QACjI,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;6FAeoF,QAAQ;CACpG,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,sDAAsD;QACtD,6CAA6C;KAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}

package/dist/harness/jsonMergeTarget.d.ts

@@ -0,0 +1,23 @@
+/**
+ * jsonMergeTarget.ts — read a user-owned JSON config before merging into it.
+ *
+ * Every writer that adds Intutic keys to a file the user also edits (a
+ * harness's settings.json or hooks.json) used to treat a parse failure like a
+ * missing file and "start fresh" — so a single comment, trailing comma or
+ * half-saved edit made the next sync replace the user's whole file with the
+ * few keys Intutic owns. This helper separates the two cases: a missing file
+ * is an empty object, and a file that is present but not a plain JSON object
+ * is reported and left alone.
+ *
+ * @module
+ */
+/**
+ * Read `filePath` as a JSON object to merge into.
+ *
+ * @returns the parsed object, `{}` when the file does not exist, or `null`
+ *          when the file exists but is not a JSON object. On `null` the
+ *          caller must skip its write; a warning naming the file has already
+ *          been logged.
+ */
+export declare function readJsonObjectForMerge(filePath: string): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=jsonMergeTarget.d.ts.map

package/dist/harness/jsonMergeTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonMergeTarget.d.ts","sourceRoot":"","sources":["../../src/harness/jsonMergeTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAuBtG"}

package/dist/harness/jsonMergeTarget.js

@@ -0,0 +1,50 @@
+/**
+ * jsonMergeTarget.ts — read a user-owned JSON config before merging into it.
+ *
+ * Every writer that adds Intutic keys to a file the user also edits (a
+ * harness's settings.json or hooks.json) used to treat a parse failure like a
+ * missing file and "start fresh" — so a single comment, trailing comma or
+ * half-saved edit made the next sync replace the user's whole file with the
+ * few keys Intutic owns. This helper separates the two cases: a missing file
+ * is an empty object, and a file that is present but not a plain JSON object
+ * is reported and left alone.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-json-merge');
+/**
+ * Read `filePath` as a JSON object to merge into.
+ *
+ * @returns the parsed object, `{}` when the file does not exist, or `null`
+ *          when the file exists but is not a JSON object. On `null` the
+ *          caller must skip its write; a warning naming the file has already
+ *          been logged.
+ */
+export async function readJsonObjectForMerge(filePath) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return {};
+        log.warn({ action: 'config_merge_skipped', path: filePath, error: String(err) }, `Could not read ${filePath} — left untouched`);
+        return null;
+    }
+    if (raw.trim() === '')
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Reported below with the not-an-object case.
+    }
+    log.warn({ action: 'config_merge_skipped', path: filePath }, `${filePath} is not a plain JSON object (comments, a trailing comma or a syntax error?) — left untouched; fix it and the next sync will add the Intutic entries`);
+    return null;
+}
+//# sourceMappingURL=jsonMergeTarget.js.map

package/dist/harness/jsonMergeTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonMergeTarget.js","sourceRoot":"","sources":["../../src/harness/jsonMergeTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,QAAQ,mBAAmB,CAAC,CAAA;QAC/H,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAiC,CAAA;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClD,GAAG,QAAQ,qJAAqJ,CACjK,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/harness/mcpAutoWrite.d.ts

@@ -3,7 +3,8 @@
  * MCP servers with the @intutic/mcp-governance-proxy.
  *
  * Injects and proxy-wraps MCP server entries in:
- * - Claude Code:      ~/.claude/mcp.json
+ * - Claude Code:      ~/.claude.json (user-scope `mcpServers`, and the
+ *                      local-scope `projects[<workspaceRoot>].mcpServers`)
  * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
  * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
  * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
@@ -15,11 +16,14 @@
  * - Muse Code:        ~/.config/muse/settings.json (`mcp_servers` section)
  * - Grok Build:       ~/.grok/config.toml + <workspaceRoot>/.grok/config.toml
  *                      ([mcp_servers.*] tables)
+ * - OpenCode:         ~/.config/opencode/opencode.json + <workspaceRoot>/opencode.json
+ *                      (`mcp` block — TD-487; see `injectOpenCode`)
  *
- * That is 12 config paths across 10 `HarnessType` values (Cursor and Grok
- * Build each own two paths — global/project for Cursor, user/project for
- * Grok Build). `discoverMcpServers` below reads all twelve read-only, for
- * reporting; the injectors above are the only thing that writes.
+ * That is 14 config paths across 11 `HarnessType` values (Cursor, Grok
+ * Build and OpenCode each own two paths — global/project for Cursor and
+ * OpenCode, user/project for Grok Build). `discoverMcpServers` below reads
+ * all fourteen read-only, for reporting; the injectors above are the only
+ * thing that writes.
  *
  * # Grok Build's compat-path overlap — dedup, not a bug
  *
@@ -92,9 +96,27 @@ export interface DiscoveredMcpServer {
     transport: 'stdio' | 'http' | 'sse' | 'unknown';
     wrapped: boolean;
 }
+/**
+ * Resolve the path to the @intutic/mcp-governance-proxy entry point.
+ *
+ * Resolution order:
+ * 1. The copy installed next to this daemon — a dependency of
+ *    `@intutic/sync-daemon`, so a global `npm install -g @intutic/cli` has it
+ *    in the CLI's own node_modules. This is the normal case: the user's
+ *    project has no reason to depend on the proxy.
+ * 2. `<workspaceRoot>/node_modules/@intutic/mcp-governance-proxy/dist/index.js`
+ *    and `<workspaceRoot>/packages/mcp-proxy/dist/index.js` — for a run from
+ *    a bundled binary, whose bundled modules are not on disk for `node` to
+ *    load (their paths start with `/snapshot/`), and for a source checkout
+ *    that has not built the proxy yet.
+ *
+ * Synchronous on purpose — this runs while building config entries, not in a
+ * hot path.
+ */
+export declare function resolveProxyBin(workspaceRoot: string): string;
 /**
  * Discover every MCP server declared in any harness config this daemon knows
- * how to parse — the same 12 config paths / 10 harnesses `injectMcpServer`
+ * how to parse — the same 14 config paths / 11 harnesses `injectMcpServer`
  * wraps — without writing anything. Used for reporting (agentReporter's
  * `mcp_tools` facet) so visibility does not silently lag behind whatever
  * `injectMcpServer` was last run against.

package/dist/harness/mcpAutoWrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpAutoWrite.d.ts","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAoDH;gEACgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;CACjB;AAw7BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAe9F;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BnG"}
+{"version":3,"file":"mcpAutoWrite.d.ts","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAsDH;gEACgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;CACjB;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAc7D;AAopCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgB9F;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BnG"}