@intutic/sync-daemon 1.6.0

package/dist/harness/openhandsHooks.js

@@ -0,0 +1,178 @@
+/**
+ * openhandsHooks.ts — OpenHands .openhands/hooks.json injection
+ * and llm.base_url proxy write.
+ *
+ * OpenHands supports PreToolUse, Stop, SessionStart hooks via
+ * a JSON file at .openhands/hooks.json in the repository root.
+ * The hooks file lives within the agent's sandbox working directory,
+ * so we also register it with the drift watcher.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-openhands-hooks');
+const PROTECTED_PATHS = [
+    '.openhands/hooks.json',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.claude/settings.json',
+    '.cursor/hooks.json',
+    '.codeium/windsurf/hooks.json',
+    '.cline/hooks',
+    '.agents/plugins/intutic-governance',
+];
+/**
+ * Write .openhands/hooks.json and the pre-tool-check shell script.
+ * Also merges llm.base_url into config.toml if it exists.
+ *
+ * @param workspaceRoot - Absolute workspace root.
+ * @param proxyUrl      - Intutic proxy URL.
+ * @param workspaceId   - Workspace ID embedded in hook event payloads.
+ */
+export async function writeOpenHandsHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    const openhandsDir = path.join(workspaceRoot, '.openhands');
+    await fs.mkdir(openhandsDir, { recursive: true });
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    await fs.mkdir(hookScriptDir, { recursive: true });
+    const hookScriptPath = path.join(hookScriptDir, 'openhands-check.sh');
+    // Ensure hook events log directory exists
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    // ── Shell hook script ──────────────────────────────────────────────
+    // OpenHands passes tool name and input as env vars + JSON body.
+    // Exits 2 to block, 0 to allow.
+    const hookScript = `#!/usr/bin/env bash
+# Intutic OpenHands PreToolUse governance gate.
+# Auto-generated by intutic sync-daemon. DO NOT EDIT.
+# Proxy: ${proxyUrl}
+# Generated: ${newIso()}
+set -euo pipefail
+
+INPUT="$(cat)"
+TOOL_NAME="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)"
+TARGET_PATH="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); i=d.get('tool_input',{}); print(i.get('path',i.get('file_path','')))" 2>/dev/null || true)"
+
+HOOK_EVENTS_LOG=${JSON.stringify(hookEventsLog)}
+
+# ── Runtime credentials (sourced from ~/.intutic/env/runtime.env) ────────────────────────
+RUNTIME_ENV="$HOME/.intutic/env/runtime.env"
+INTUITIC_HOST="https://api.intutic.ai"
+INTUITIC_API_KEY=""
+INTUITIC_WORKSPACE_ID=${JSON.stringify(workspaceId)}
+[ -f "$RUNTIME_ENV" ] && source "$RUNTIME_ENV" 2>/dev/null || true
+
+log_event() {
+  local verdict="\$1" tool="\$2" reason="\$3"
+  local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  local incident_id; incident_id="\$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo \"\$(date +%s)\")"
+  local entry="{\"event\":\"\${verdict}\",\"toolName\":\"\${tool}\",\"reason\":\"\${reason}\",\"workspaceId\":\"\${INTUTIC_WORKSPACE_ID}\",\"harnessType\":\"openhands\",\"timestamp\":\"\${ts}\",\"incidentId\":\"\${incident_id}\"}"
+  # Path B: reliable file append
+  printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
+  # Path A: fire-and-forget HTTP (non-blocking, near-real-time)
+  if [ -n "\$INTUTIC_API_KEY" ]; then
+    curl -s -o /dev/null --max-time 3 -X POST \\
+      -H "Content-Type: application/json" \\
+      -H "Authorization: Bearer \$INTUTIC_API_KEY" \\
+      -d "{\"events\":[\$entry]}" \\
+      "\${INTUTIC_HOST}/api/v1/hook-events" & disown 2>/dev/null || true
+  fi
+}
+
+PROTECTED_PATHS=(
+  ".openhands/hooks.json"
+  ".intutic/hooks"
+  ".intutic/integrity.json"
+  ".claude/settings.json"
+  ".cursor/hooks.json"
+  ".codeium/windsurf/hooks.json"
+  ".cline/hooks"
+  ".agents/plugins/intutic-governance"
+)
+
+# Protected-path guard
+for p in "\${PROTECTED_PATHS[@]}"; do
+  if echo "$TARGET_PATH" | grep -qF "$p"; then
+    REASON="Attempt to modify governance-protected path \\"$TARGET_PATH\\""
+    echo "[Intutic Governance] BLOCKED: $REASON" >&2
+    log_event "tool_blocked" "\$TOOL_NAME" "\$REASON"
+    exit 2
+  fi
+done
+
+log_event "tool_allowed" "\$TOOL_NAME" ""
+exit 0
+`;
+    const tmpScript = hookScriptPath + '.oh-tmp';
+    await fs.writeFile(tmpScript, hookScript, 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    // ── .openhands/hooks.json ──────────────────────────────────────────
+    const hooksConfig = {
+        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        hooks: [
+            {
+                type: 'PreToolUse',
+                command: hookScriptPath,
+                failClosed: true,
+            },
+            {
+                type: 'Stop',
+                command: `${hookScriptPath} --event stop`,
+                failClosed: false,
+            },
+        ],
+    };
+    const hooksPath = path.join(openhandsDir, 'hooks.json');
+    const tmpHooks = hooksPath + '.intutic-tmp';
+    await fs.writeFile(tmpHooks, JSON.stringify(hooksConfig, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpHooks, hooksPath);
+    log.info({ action: 'openhands_hooks_written', path: hooksPath }, 'OpenHands hooks written');
+    // ── config.toml llm.base_url injection ────────────────────────────
+    await mergeOpenHandsConfig(workspaceRoot, proxyUrl);
+}
+/**
+ * Merge llm.base_url into OpenHands config.toml.
+ * Looks for the file in the workspace root and the user config directory.
+ */
+async function mergeOpenHandsConfig(workspaceRoot, proxyUrl) {
+    const candidates = [
+        path.join(workspaceRoot, 'config.toml'),
+        path.join(process.env.HOME ?? '', '.openhands', 'config.toml'),
+    ];
+    for (const configPath of candidates) {
+        let existing = '';
+        try {
+            existing = await fs.readFile(configPath, 'utf-8');
+        }
+        catch {
+            // File doesn't exist — create minimal config
+            existing = '';
+        }
+        // Inject or update [llm] section with base_url
+        if (existing.includes('[llm]')) {
+            // Update existing [llm] section
+            if (existing.includes('base_url')) {
+                existing = existing.replace(/^base_url\s*=\s*.*/m, `base_url = "${proxyUrl}"`);
+            }
+            else {
+                existing = existing.replace(/\[llm\]/, `[llm]\nbase_url = "${proxyUrl}"`);
+            }
+        }
+        else {
+            existing += `\n[llm]\nbase_url = "${proxyUrl}"\n`;
+        }
+        const tmpConfig = configPath + '.intutic-tmp';
+        await fs.mkdir(path.dirname(configPath), { recursive: true });
+        await fs.writeFile(tmpConfig, existing, 'utf-8');
+        await fs.rename(tmpConfig, configPath);
+        log.info({ action: 'openhands_config_written', path: configPath }, 'OpenHands config.toml updated with proxy base_url');
+    }
+}
+//# sourceMappingURL=openhandsHooks.js.map

package/dist/harness/openhandsHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openhandsHooks.js","sourceRoot":"","sources":["../../src/harness/openhandsHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,yBAAyB;IACzB,uBAAuB;IACvB,oBAAoB;IACpB,8BAA8B;IAC9B,cAAc;IACd,oCAAoC;CACrC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IAErE,0CAA0C;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,sEAAsE;IACtE,gEAAgE;IAChE,gCAAgC;IAChC,MAAM,UAAU,GAAG;;;WAGV,QAAQ;eACJ,MAAM,EAAE;;;;;;;kBAOL,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;wBAMvB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2ClD,CAAA;IAEC,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,sEAAsE;IACtE,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,cAAc;gBACvB,UAAU,EAAE,IAAI;aACjB;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,GAAG,cAAc,eAAe;gBACzC,UAAU,EAAE,KAAK;aAClB;SACF;KACF,CAAA;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,CAAC,CAAA;IAE3F,qEAAqE;IACrE,MAAM,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,QAAgB;IACzE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC;KAC/D,CAAA;IAED,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,QAAQ,GAAG,EAAE,CAAA;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;YAC7C,QAAQ,GAAG,EAAE,CAAA;QACf,CAAC;QAED,+CAA+C;QAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,gCAAgC;YAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,qBAAqB,EACrB,eAAe,QAAQ,GAAG,CAC3B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,SAAS,EACT,sBAAsB,QAAQ,GAAG,CAClC,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,IAAI,wBAAwB,QAAQ,KAAK,CAAA;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,mDAAmD,CAAC,CAAA;IACzH,CAAC;AACH,CAAC"}

package/dist/harness/openhandsHooksWriter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * openhandsHooksWriter.ts — OpenHands PreToolUse native hook writer.
+ *
+ * Writes two artefacts:
+ *   1. `~/.intutic/hooks/pre-tool-check.sh` — shared bash gate script that
+ *      sources runtime credentials, POSTs to the Intutic hook-gate endpoint,
+ *      exits 2 on block (fail-open on curl error). Sets HARNESS=openhands in
+ *      the request body so the control plane can route correctly.
+ *   2. `<workspaceRoot>/.openhands/hooks.json` — registers the script as the
+ *      PreToolUse handler with a 10-second timeout.
+ *
+ * LLD #14 — Phase 4 WS-4C native hook script writers
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write OpenHands PreToolUse hook script and hooks.json.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ */
+export declare function writeOpenHandsHooks(workspaceRoot: string): Promise<void>;
+//# sourceMappingURL=openhandsHooksWriter.d.ts.map

package/dist/harness/openhandsHooksWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openhandsHooksWriter.d.ts","sourceRoot":"","sources":["../../src/harness/openhandsHooksWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA+GH;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B9E"}

package/dist/harness/openhandsHooksWriter.js

@@ -0,0 +1,146 @@
+/**
+ * openhandsHooksWriter.ts — OpenHands PreToolUse native hook writer.
+ *
+ * Writes two artefacts:
+ *   1. `~/.intutic/hooks/pre-tool-check.sh` — shared bash gate script that
+ *      sources runtime credentials, POSTs to the Intutic hook-gate endpoint,
+ *      exits 2 on block (fail-open on curl error). Sets HARNESS=openhands in
+ *      the request body so the control plane can route correctly.
+ *   2. `<workspaceRoot>/.openhands/hooks.json` — registers the script as the
+ *      PreToolUse handler with a 10-second timeout.
+ *
+ * LLD #14 — Phase 4 WS-4C native hook script writers
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import * as node_os from 'node:os';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-openhands-hooks-writer');
+const HOOKS_DIR = node_path.join(node_os.homedir(), '.intutic', 'hooks');
+const EVENTS_DIR = node_path.join(node_os.homedir(), '.intutic', 'events');
+const HOOK_SCRIPT = node_path.join(HOOKS_DIR, 'pre-tool-check.sh');
+const HOOK_EVENTS_LOG = node_path.join(EVENTS_DIR, 'hook-events.jsonl');
+/**
+ * Build the shared bash gate script.
+ *
+ * The script is designed to be shared across harnesses that invoke a bash
+ * pre-tool-use hook. It sets HARNESS=openhands in the POST body so the
+ * control-plane can distinguish the origin.
+ *
+ * Logic:
+ *   1. Source ~/.intutic/env/runtime.env for credentials.
+ *   2. Read full stdin JSON payload.
+ *   3. Merge HARNESS=openhands into the payload.
+ *   4. POST to $INTUTIC_CONTROL_PLANE_URL/api/v1/hook-gate (10 s timeout).
+ *   5. Fail-open if curl returns an error or no API key is set.
+ *   6. Exit 2 + append JSONL event if `"allowed":false`.
+ *   7. Exit 0 otherwise.
+ */
+function buildPreToolCheckScript() {
+    return `#!/usr/bin/env bash
+# Intutic shared pre-tool-check governance gate.
+# Auto-generated by intutic sync-daemon. DO NOT EDIT.
+# Used by: OpenHands (and any other bash-based hook harness).
+set -euo pipefail
+
+HARNESS="openhands"
+RUNTIME_ENV="$HOME/.intutic/env/runtime.env"
+HOOK_EVENTS_LOG=${JSON.stringify(HOOK_EVENTS_LOG)}
+INTUTIC_CONTROL_PLANE_URL="https://api.intutic.ai"
+INTUTIC_API_KEY=""
+INTUTIC_WORKSPACE_ID=""
+
+# Source runtime credentials (key rotation is automatic on next tool call)
+[ -f "$RUNTIME_ENV" ] && source "$RUNTIME_ENV" 2>/dev/null || true
+
+INPUT="$(cat)"
+TOOL_NAME="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)"
+
+# Augment body with harness identifier
+BODY="$(echo "$INPUT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+d['harness'] = '$HARNESS'
+d['workspaceId'] = '$INTUTIC_WORKSPACE_ID'
+print(json.dumps(d))
+" 2>/dev/null || echo "$INPUT")"
+
+# ── POST to hook-gate ─────────────────────────────────────────────────
+GATE_URL="\${INTUTIC_CONTROL_PLANE_URL}/api/v1/hook-gate"
+RESPONSE=""
+if [ -n "$INTUTIC_API_KEY" ]; then
+  RESPONSE="$(curl -s --max-time 10 -X POST \\
+    -H "Content-Type: application/json" \\
+    -H "Authorization: Bearer $INTUTIC_API_KEY" \\
+    -d "$BODY" \\
+    "$GATE_URL" 2>/dev/null)" || true
+fi
+
+# Fail-open: empty response (curl error / no key) → allow
+if [ -z "$RESPONSE" ]; then
+  exit 0
+fi
+
+# Parse decision
+ALLOWED="$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(str(d.get('allowed', True)).lower())" 2>/dev/null || echo "true")"
+
+if [ "$ALLOWED" = "false" ]; then
+  REASON="$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('reason',''))" 2>/dev/null || true)"
+  TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  INCIDENT_ID="$(printf '%s' "\${TS}\${TOOL_NAME}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo "$(date +%s)")"
+  ENTRY="{\\"event\\":\\"tool_blocked\\",\\"toolName\\":\\"\${TOOL_NAME}\\",\\"reason\\":\\"\${REASON}\\",\\"workspaceId\\":\\"\${INTUTIC_WORKSPACE_ID}\\",\\"harnessType\\":\\"\${HARNESS}\\",\\"timestamp\\":\\"\${TS}\\",\\"incidentId\\":\\"\${INCIDENT_ID}\\"}"
+  mkdir -p "$(dirname "$HOOK_EVENTS_LOG")"
+  printf '%s\\n' "$ENTRY" >> "$HOOK_EVENTS_LOG" 2>/dev/null || true
+  echo "[Intutic Governance] BLOCKED: $REASON" >&2
+  exit 2
+fi
+
+exit 0
+`;
+}
+/**
+ * Build the .openhands/hooks.json document that registers the PreToolUse hook.
+ *
+ * @param hookScriptPath - Absolute path to the bash gate script.
+ */
+function buildOpenHandsHooksJson(hookScriptPath) {
+    return {
+        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
+        hooks: [
+            {
+                type: 'PreToolUse',
+                command: hookScriptPath,
+                timeout: 10,
+            },
+        ],
+    };
+}
+/**
+ * Write OpenHands PreToolUse hook script and hooks.json.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ */
+export async function writeOpenHandsHooks(workspaceRoot) {
+    // ── Ensure directories exist ─────────────────────────────────────────
+    await node_fs.mkdir(HOOKS_DIR, { recursive: true });
+    await node_fs.mkdir(EVENTS_DIR, { recursive: true });
+    // ── 1. Write shared bash gate script ────────────────────────────────
+    const tmpScript = HOOK_SCRIPT + '.intutic-tmp';
+    await node_fs.writeFile(tmpScript, buildPreToolCheckScript(), 'utf-8');
+    await node_fs.rename(tmpScript, HOOK_SCRIPT);
+    await node_fs.chmod(HOOK_SCRIPT, 0o755);
+    log.info({ action: 'openhands_hook_script_written', path: HOOK_SCRIPT }, 'Shared pre-tool-check.sh written');
+    // ── 2. Write .openhands/hooks.json ──────────────────────────────────
+    const openhandsDir = node_path.join(workspaceRoot, '.openhands');
+    await node_fs.mkdir(openhandsDir, { recursive: true });
+    const hooksJsonPath = node_path.join(openhandsDir, 'hooks.json');
+    const hooksDoc = buildOpenHandsHooksJson(HOOK_SCRIPT);
+    const tmpHooks = hooksJsonPath + '.intutic-tmp';
+    await node_fs.writeFile(tmpHooks, JSON.stringify(hooksDoc, null, 2) + '\n', 'utf-8');
+    await node_fs.rename(tmpHooks, hooksJsonPath);
+    log.info({ action: 'openhands_hooks_json_written', path: hooksJsonPath }, 'OpenHands hooks.json written');
+}
+//# sourceMappingURL=openhandsHooksWriter.js.map

package/dist/harness/openhandsHooksWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openhandsHooksWriter.js","sourceRoot":"","sources":["../../src/harness/openhandsHooksWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,6BAA6B,CAAC,CAAA;AAEvD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACxE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;AAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAClE,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;kBAQS,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDhD,CAAA;AACD,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,cAAsB;IACrD,OAAO;QACL,QAAQ,EAAE,yDAAyD;QACnE,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,EAAE;aACZ;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,wEAAwE;IACxE,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEpD,uEAAuE;IACvE,MAAM,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;IAC9C,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,uBAAuB,EAAE,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC5C,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,WAAW,EAAE,EAC9D,kCAAkC,CACnC,CAAA;IAED,uEAAuE;IACvE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAChE,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAA;IAErD,MAAM,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAA;IAC/C,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACpF,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAE7C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,aAAa,EAAE,EAC/D,8BAA8B,CAC/B,CAAA;AACH,CAAC"}

package/dist/harness/piHooks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * piHooks.ts — Pi (earendil-works/pi) coding agent governance hook injection.
+ *
+ * Pi uses:
+ * - `~/.pi/hooks.json` for PreToolUse hook matchers (stdin JSON, exit 2 = block)
+ * - `~/.pi/models.json` for per-provider base URL routing
+ *
+ * This module:
+ * 1. Writes/merges `~/.pi/hooks.json` with intutic-governance hook entries.
+ * 2. Writes/merges `~/.pi/models.json` to redirect LLM providers via proxyUrl.
+ * 3. Writes `~/.intutic/hooks/pi-check.sh` — dual-path bash governance hook.
+ * 4. Writes `.intutic/env/pi.env` — env snippet for IDE/shell integration.
+ *
+ * WS-C3 — Pi harness (Phase 3 cross-harness defence)
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write the Pi governance hook script, merge hooks.json and models.json,
+ * and write the env snippet.
+ *
+ * Safe to call repeatedly — uses atomic rename so partial writes never
+ * leave a corrupt state.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL for LLM provider routing.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export declare function writePiHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=piHooks.d.ts.map

package/dist/harness/piHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piHooks.d.ts","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2NH;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAuFf"}

package/dist/harness/piHooks.js

@@ -0,0 +1,257 @@
+/**
+ * piHooks.ts — Pi (earendil-works/pi) coding agent governance hook injection.
+ *
+ * Pi uses:
+ * - `~/.pi/hooks.json` for PreToolUse hook matchers (stdin JSON, exit 2 = block)
+ * - `~/.pi/models.json` for per-provider base URL routing
+ *
+ * This module:
+ * 1. Writes/merges `~/.pi/hooks.json` with intutic-governance hook entries.
+ * 2. Writes/merges `~/.pi/models.json` to redirect LLM providers via proxyUrl.
+ * 3. Writes `~/.intutic/hooks/pi-check.sh` — dual-path bash governance hook.
+ * 4. Writes `.intutic/env/pi.env` — env snippet for IDE/shell integration.
+ *
+ * WS-C3 — Pi harness (Phase 3 cross-harness defence)
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-pi-hooks');
+/** Path to the Pi hooks config. */
+const PI_HOOKS_CONFIG = path.join(os.homedir(), '.pi', 'hooks.json');
+/** Path to the Pi models config. */
+const PI_MODELS_CONFIG = path.join(os.homedir(), '.pi', 'models.json');
+/** Governance-sensitive paths that the hook gate protects. */
+const PROTECTED_PATHS = [
+    '.gemini/settings.json',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.intutic/events',
+    '.claude/settings.json',
+    '.cursor/hooks.json',
+    '.codeium/windsurf/hooks.json',
+    '.cline/hooks',
+    '.agents/plugins/intutic-governance',
+    '.openhands/hooks.json',
+    '.pi/hooks.json',
+    '.pi/models.json',
+];
+// ─── Bash hook script template ────────────────────────────────────────────────
+function buildPiCheckScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    const runtimeEnv = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+    return `#!/usr/bin/env bash
+# Intutic Pi (earendil-works/pi) PreToolUse governance gate.
+# Auto-generated by intutic sync-daemon. DO NOT EDIT.
+# Proxy: ${proxyUrl}
+# Generated: ${newIso()}
+# Workspace: ${workspaceId}
+set -euo pipefail
+
+# Source runtime credentials (never embedded in this file)
+if [ -f "${runtimeEnv}" ]; then
+  # shellcheck disable=SC1090
+  source "${runtimeEnv}"
+fi
+
+INTUTIC_HOST="\${INTUTIC_HOST:-https://api.intutic.ai}"
+INTUTIC_API_KEY="\${INTUTIC_API_KEY:-}"
+INTUTIC_WORKSPACE_ID="\${INTUTIC_WORKSPACE_ID:-${workspaceId}}"
+
+INPUT="$(cat)"
+TOOL_NAME="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)"
+TARGET_PATH="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); i=d.get('tool_input',{}); print(i.get('path',i.get('file_path','')))" 2>/dev/null || true)"
+COMMAND="$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); i=d.get('tool_input',{}); print(i.get('command',i.get('cmd','')))" 2>/dev/null || true)"
+
+HOOK_EVENTS_LOG="${hookEventsLog}"
+
+log_event() {
+  local verdict="$1" tool="$2" reason="$3"
+  local ts; ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  # incidentId = sha1(timestamp + toolName + workspaceId).slice(0,16)
+  local incident_id; incident_id="$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo "$(date +%s)")"
+  local entry="{\\"event\\":\\"toolGovernance\\",\\"verdict\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${INTUTIC_WORKSPACE_ID}\\",\\"harnessType\\":\\"pi\\",\\"incidentId\\":\\"\${incident_id}\\",\\"timestamp\\":\\"\${ts}\\"}"
+  # Path B: reliable file append (sync-daemon drains on FSEvents change)
+  printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
+  # Path A: fire-and-forget HTTP POST (near-real-time dashboard, non-blocking)
+  if [ -n "\$INTUTIC_API_KEY" ]; then
+    curl -s -o /dev/null --max-time 3 -X POST \\
+      -H "Content-Type: application/json" \\
+      -H "Authorization: Bearer \$INTUTIC_API_KEY" \\
+      -d "{\\"events\\":[\$entry]}" \\
+      "\${INTUTIC_HOST}/api/v1/hook-events" & disown 2>/dev/null || true
+  fi
+}
+
+PROTECTED_PATHS=(
+${PROTECTED_PATHS.map((p) => `  "${p}"`).join('\n')}
+)
+
+# 1. Protected-path guard
+for p in "\${PROTECTED_PATHS[@]}"; do
+  if echo "$TARGET_PATH" | grep -qF "$p"; then
+    REASON="Attempt to modify governance-protected path \\"$TARGET_PATH\\""
+    echo "[Intutic Governance] BLOCKED: $REASON" >&2
+    log_event "tool_blocked" "$TOOL_NAME" "$REASON"
+    exit 2
+  fi
+done
+
+# 2. Bash/shell command guard — block governance bypass patterns
+if [ -n "$COMMAND" ]; then
+  BYPASS_PATTERNS=(
+    "chflags nouchg"
+    "chattr -i"
+    "rm -rf .intutic"
+    "rm -rf .pi/hooks"
+    "rm -rf .pi/models"
+    "PI_PRE_TOOL_HOOK="
+    "rm -rf .gemini/settings"
+  )
+  for pattern in "\${BYPASS_PATTERNS[@]}"; do
+    if echo "$COMMAND" | grep -qF "$pattern"; then
+      REASON="Shell command matches governance bypass pattern: \\"$pattern\\""
+      echo "[Intutic Governance] BLOCKED: $REASON" >&2
+      log_event "tool_blocked" "$TOOL_NAME" "$REASON"
+      exit 2
+    fi
+  done
+fi
+
+log_event "tool_allowed" "$TOOL_NAME" ""
+exit 0
+`;
+}
+// ─── Pi hooks.json merge ──────────────────────────────────────────────────────
+/**
+ * Build the 4 canonical Pi PreToolUse hook matchers pointing at the given
+ * hook script path. The wildcard `.*` matcher catches all tools not matched
+ * by the more specific matchers above it.
+ */
+function buildPiHookMatchers(hookScriptPath) {
+    return [
+        { matcher: 'Bash', hooks: [{ type: 'command', command: hookScriptPath }] },
+        { matcher: 'Edit', hooks: [{ type: 'command', command: hookScriptPath }] },
+        { matcher: 'Write', hooks: [{ type: 'command', command: hookScriptPath }] },
+        { matcher: '.*', hooks: [{ type: 'command', command: hookScriptPath }] },
+    ];
+}
+/**
+ * Merge Pi hooks.json — upsert intutic-governance entries under
+ * `hooks.PreToolUse`. Existing entries with our command path are filtered out
+ * then re-added so there are no duplicates.
+ */
+function mergePiHooks(existing, hookScriptPath) {
+    const preToolUse = existing.hooks?.PreToolUse ?? [];
+    // Filter out any existing entries that reference our hook script
+    const filtered = preToolUse.filter((m) => !m.hooks.some((h) => h.command === hookScriptPath));
+    return {
+        ...existing,
+        hooks: {
+            ...(existing.hooks ?? {}),
+            PreToolUse: [...filtered, ...buildPiHookMatchers(hookScriptPath)],
+        },
+    };
+}
+// ─── Pi models.json merge ─────────────────────────────────────────────────────
+/**
+ * Merge Pi models.json — update existing providers' baseUrl and add
+ * missing providers. The three canonical providers are anthropic, openai,
+ * and google.
+ */
+function mergePiModels(existing, proxyUrl) {
+    const providers = existing.providers ?? {};
+    const targetProviders = ['anthropic', 'openai', 'google'];
+    const mergedProviders = { ...providers };
+    for (const provider of targetProviders) {
+        mergedProviders[provider] = {
+            ...(providers[provider] ?? {}),
+            baseUrl: proxyUrl,
+        };
+    }
+    return {
+        ...existing,
+        providers: mergedProviders,
+    };
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Write the Pi governance hook script, merge hooks.json and models.json,
+ * and write the env snippet.
+ *
+ * Safe to call repeatedly — uses atomic rename so partial writes never
+ * leave a corrupt state.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL for LLM provider routing.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writePiHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    // ── 1. Ensure directories ──────────────────────────────────────────────────
+    const globalHookDir = path.join(os.homedir(), '.intutic', 'hooks');
+    const hookEventsDir = path.join(workspaceRoot, '.intutic', 'events');
+    const envDir = path.join(workspaceRoot, '.intutic', 'env');
+    const piDir = path.join(os.homedir(), '.pi');
+    await Promise.all([
+        fs.mkdir(globalHookDir, { recursive: true }),
+        fs.mkdir(hookEventsDir, { recursive: true }),
+        fs.mkdir(envDir, { recursive: true }),
+        fs.mkdir(piDir, { recursive: true }),
+    ]);
+    // ── 2. Write bash hook script ──────────────────────────────────────────────
+    const hookScriptPath = path.join(globalHookDir, 'pi-check.sh');
+    const tmpScript = hookScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, buildPiCheckScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    log.info({ action: 'pi_hook_script_written', path: hookScriptPath }, 'Pi hook script written');
+    // ── 3. Write/merge ~/.pi/hooks.json ───────────────────────────────────────
+    let existingHooks = {};
+    try {
+        const raw = await fs.readFile(PI_HOOKS_CONFIG, 'utf-8');
+        existingHooks = JSON.parse(raw);
+    }
+    catch {
+        // File doesn't exist or is unparseable — start fresh
+    }
+    const mergedHooks = mergePiHooks(existingHooks, hookScriptPath);
+    const tmpHooks = PI_HOOKS_CONFIG + '.intutic-tmp';
+    await fs.writeFile(tmpHooks, JSON.stringify(mergedHooks, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpHooks, PI_HOOKS_CONFIG);
+    log.info({ action: 'pi_hooks_written', path: PI_HOOKS_CONFIG }, 'Pi hooks.json written');
+    // ── 4. Write/merge ~/.pi/models.json ──────────────────────────────────────
+    let existingModels = {};
+    try {
+        const raw = await fs.readFile(PI_MODELS_CONFIG, 'utf-8');
+        existingModels = JSON.parse(raw);
+    }
+    catch {
+        // File doesn't exist or is unparseable — start fresh
+    }
+    const mergedModels = mergePiModels(existingModels, proxyUrl);
+    const tmpModels = PI_MODELS_CONFIG + '.intutic-tmp';
+    await fs.writeFile(tmpModels, JSON.stringify(mergedModels, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpModels, PI_MODELS_CONFIG);
+    log.info({ action: 'pi_models_written', path: PI_MODELS_CONFIG }, 'Pi models.json written');
+    // ── 5. Write env snippet ───────────────────────────────────────────────────
+    const envSnippet = [
+        `# Intutic pi governance env`,
+        `INTUITIC_PI_HOOK=~/.intutic/hooks/pi-check.sh`,
+        `INTUITIC_PI_HOOKS_CONFIG=~/.pi/hooks.json`,
+        `INTUITIC_PI_MODELS_CONFIG=~/.pi/models.json`,
+        `OPENAI_BASE_URL=${proxyUrl}`,
+        `ANTHROPIC_BASE_URL=${proxyUrl}`,
+    ].join('\n') + '\n';
+    const envFilePath = path.join(envDir, 'pi.env');
+    const tmpEnv = envFilePath + '.intutic-tmp';
+    await fs.writeFile(tmpEnv, envSnippet, 'utf-8');
+    await fs.rename(tmpEnv, envFilePath);
+    log.info({ action: 'pi_env_written', path: envFilePath }, 'Pi env snippet written');
+}
+//# sourceMappingURL=piHooks.js.map