@intutic/sync-daemon 1.6.0

package/dist/harness/piHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"piHooks.js","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAA;AAEzC,mCAAmC;AACnC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;AAEpE,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAEtE,8DAA8D;AAC9D,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,uBAAuB;IACvB,oBAAoB;IACpB,8BAA8B;IAC9B,cAAc;IACd,oCAAoC;IACpC,uBAAuB;IACvB,gBAAgB;IAChB,iBAAiB;CAClB,CAAA;AAgCD,iFAAiF;AAEjF,SAAS,kBAAkB,CACzB,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;;;WAIf,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;;;;;mBAOzC,aAAa;;;;;;;;;;;;;;;;;;;;;EAqB9B,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoClD,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,cAAsB;IACjD,OAAO;QACL,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC1E,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC3E,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;KACzE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAuB,EAAE,cAAsB;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAA;IAEnD,iEAAiE;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAC1D,CAAA;IAED,OAAO;QACL,GAAG,QAAQ;QACX,KAAK,EAAE;YACL,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAClE;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAwB,EAAE,QAAgB;IAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAEzD,MAAM,eAAe,GAA+B,EAAE,GAAG,SAAS,EAAE,CAAA;IACpE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,eAAe,CAAC,QAAQ,CAAC,GAAG;YAC1B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,QAAQ;SAClB,CAAA;IACH,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,eAAe;KAC3B,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACrC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAChG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAA;IAE9F,6EAA6E;IAE7E,IAAI,aAAa,GAAkB,EAAE,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QACvD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAE/D,MAAM,QAAQ,GAAG,eAAe,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,EACrD,uBAAuB,CACxB,CAAA;IAED,6EAA6E;IAE7E,IAAI,cAAc,GAAmB,EAAE,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACxD,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAE5D,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACpF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,EACvD,wBAAwB,CACzB,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,6BAA6B;QAC7B,+CAA+C;QAC/C,2CAA2C;QAC3C,6CAA6C;QAC7C,mBAAmB,QAAQ,EAAE;QAC7B,sBAAsB,QAAQ,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,EAC/C,wBAAwB,CACzB,CAAA;AACH,CAAC"}

package/dist/harness/rooCodeHooks.d.ts

@@ -0,0 +1,31 @@
+/**
+ * rooCodeHooks.ts — Roo Code (ZooCode) governance hook generator.
+ *
+ * Roo Code uses `.roorules` for SOP rules and `.roomodes` for custom modes.
+ * For hook interception, it reads hook config from `.roorules/hooks/hooks.json`.
+ * The hook result format uses stdout JSON: {"cancel": true, "errorMessage": "..."}
+ * rather than exit codes (unlike Claude Code's exit 2).
+ *
+ * Hook events are written via dual-path logEvent:
+ *   Path B (reliable)  — synchronous append to .intutic/events/roo-hook-events.jsonl
+ *   Path A (telemetry) — fire-and-forget https.request to the control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write the Roo Code governance hook configuration:
+ *  1. `.roorules` — SOP rules in Roo Code markdown format.
+ *  2. `.roorules/hooks/hooks.json` — hook config pointing to the Node.js gate.
+ *  3. `.intutic/hooks/roo-check.js` — Node.js dual-path hook (stdout cancel JSON).
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the hook script header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export declare function writeRooCodeHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=rooCodeHooks.d.ts.map

package/dist/harness/rooCodeHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rooCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmOH;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAuEf"}

package/dist/harness/rooCodeHooks.js

@@ -0,0 +1,300 @@
+/**
+ * rooCodeHooks.ts — Roo Code (ZooCode) governance hook generator.
+ *
+ * Roo Code uses `.roorules` for SOP rules and `.roomodes` for custom modes.
+ * For hook interception, it reads hook config from `.roorules/hooks/hooks.json`.
+ * The hook result format uses stdout JSON: {"cancel": true, "errorMessage": "..."}
+ * rather than exit codes (unlike Claude Code's exit 2).
+ *
+ * Hook events are written via dual-path logEvent:
+ *   Path B (reliable)  — synchronous append to .intutic/events/roo-hook-events.jsonl
+ *   Path A (telemetry) — fire-and-forget https.request to the control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-roo-code-hooks');
+/** Governance-sensitive paths that the hook gate protects. */
+const PROTECTED_PATHS = [
+    path.join(os.homedir(), '.claude', 'settings.json'),
+    path.join(os.homedir(), '.claude', 'settings.local.json'),
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.intutic/context_integrity.json',
+    '.roorules/hooks',
+];
+// ─── Node.js hook script template ─────────────────────────────────────────────
+function buildRooCheckScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'roo-hook-events.jsonl');
+    const runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+    return `/**
+ * Intutic Roo Code PreToolUse execution gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ *
+ * Block format: stdout JSON {"cancel": true, "errorMessage": "..."}
+ * Allow format: stdout JSON {"cancel": false}
+ *
+ * Dual-path logEvent:
+ *   Path B — synchronous file append to roo-hook-events.jsonl
+ *   Path A — fire-and-forget https.request to the control plane
+ *
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ * Workspace: ${workspaceId}
+ */
+'use strict';
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const https = require('https');
+const crypto = require('crypto');
+const url = require('url');
+
+// ── Runtime env loader (Path A credentials) ──────────────────────────────────
+const RUNTIME_ENV_PATH = ${JSON.stringify(runtimeEnvPath)};
+
+function loadRuntimeEnv() {
+  const env = {
+    INTUTIC_HOST: 'https://api.intutic.ai',
+    INTUTIC_API_KEY: '',
+    INTUTIC_WORKSPACE_ID: ${JSON.stringify(workspaceId)},
+  };
+  try {
+    const raw = fs.readFileSync(RUNTIME_ENV_PATH, 'utf-8');
+    for (const line of raw.split('\\n')) {
+      const stripped = line.trim();
+      if (!stripped || stripped.startsWith('#') || !stripped.includes('=')) continue;
+      const eq = stripped.indexOf('=');
+      const k = stripped.slice(0, eq).trim();
+      const v = stripped.slice(eq + 1).trim();
+      env[k] = v;
+    }
+  } catch { /* file may not exist yet */ }
+  return env;
+}
+
+// ── Governance-sensitive paths ────────────────────────────────────────────────
+const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+
+// ── Dual-path logEvent ────────────────────────────────────────────────────────
+const HOOK_EVENTS_LOG = ${JSON.stringify(hookEventsLog)};
+
+function logEvent(env, verdict, toolName, reason) {
+  const ts = new Date().toISOString();
+  const incidentId = crypto.createHash('sha1')
+    .update(ts + toolName + env.INTUTIC_WORKSPACE_ID)
+    .digest('hex').slice(0, 16);
+
+  const entry = {
+    event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+    toolName,
+    reason: reason || '',
+    workspaceId: env.INTUTIC_WORKSPACE_ID,
+    harnessType: 'roo-code',
+    timestamp: ts,
+    incidentId,
+  };
+
+  // Path B — reliable file append
+  try {
+    const dir = path.dirname(HOOK_EVENTS_LOG);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(HOOK_EVENTS_LOG, JSON.stringify(entry) + '\\n', { flag: 'a' });
+  } catch { /* never crash the hook */ }
+
+  // Path A — fire-and-forget https.request
+  if (env.INTUTIC_API_KEY) {
+    try {
+      const body = Buffer.from(JSON.stringify({ events: [entry] }));
+      const parsedUrl = url.parse(env.INTUTIC_HOST + '/api/v1/hook-events');
+      const req = https.request({
+        hostname: parsedUrl.hostname,
+        port: parsedUrl.port || 443,
+        path: parsedUrl.path,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': body.length,
+          'Authorization': 'Bearer ' + env.INTUTIC_API_KEY,
+        },
+      });
+      req.on('error', () => {}); // fire-and-forget
+      req.write(body);
+      req.end();
+    } catch { /* never crash the hook */ }
+  }
+}
+
+function block(env, toolName, reason) {
+  logEvent(env, 'blocked', toolName, reason);
+  process.stdout.write(JSON.stringify({ cancel: true, errorMessage: reason }));
+  process.exit(0);
+}
+
+function allow(env, toolName) {
+  logEvent(env, 'allowed', toolName, '');
+  process.stdout.write(JSON.stringify({ cancel: false }));
+  process.exit(0);
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+const runtimeEnv = loadRuntimeEnv();
+let inputData = '';
+process.stdin.on('data', (chunk) => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(inputData);
+    const toolName = (ctx.tool_name || ctx.toolName || '').toLowerCase();
+    const toolInput = ctx.tool_input || ctx.toolInput || {};
+    const toolInputStr = JSON.stringify(toolInput);
+
+    // 1. Protected-path guard
+    if (['edit', 'write', 'multiedit'].includes(toolName)) {
+      const targetPath = toolInput.path || toolInput.file_path ||
+        toolInput.new_path || toolInput.target || '';
+      for (const p of PROTECTED_PATHS) {
+        if (targetPath.includes(p) || String(targetPath).startsWith(p)) {
+          const reason = 'Attempt to modify governance-protected path: "' + targetPath + '". ' +
+            'To change governance policy, update your SOP via the Intutic control plane.';
+          block(runtimeEnv, toolName, reason);
+          return;
+        }
+      }
+    }
+
+    // 2. Bash/shell command bypass guard
+    if (toolName === 'bash') {
+      const cmd = toolInput.command || toolInput.cmd || '';
+      const BYPASS_PATTERNS = [
+        'chflags nouchg',
+        'chattr -i',
+        'rm -rf .intutic',
+        'rm -rf .roorules',
+      ];
+      for (const pattern of BYPASS_PATTERNS) {
+        if (cmd.includes(pattern)) {
+          const reason = 'Shell command matches governance bypass pattern: "' + pattern + '"';
+          block(runtimeEnv, toolName, reason);
+          return;
+        }
+      }
+    }
+
+    allow(runtimeEnv, toolName);
+  } catch (err) {
+    // Fail closed on parse error
+    const env = runtimeEnv;
+    logEvent(env, 'blocked', 'unknown', String(err));
+    process.stdout.write(JSON.stringify({ cancel: true, errorMessage: '[Intutic] Hook error: ' + String(err) }));
+    process.exit(0);
+  }
+});
+`.trim();
+}
+// ─── .roorules SOP content ────────────────────────────────────────────────────
+function buildRooRulesContent() {
+    return [
+        '# Intutic Governance Rules (auto-generated)',
+        '# DO NOT EDIT — managed by intutic sync daemon',
+        `# Last sync: ${newIso()}`,
+        '',
+        '## Roo Code SOP Governance',
+        '',
+        'This workspace is governed by Intutic SOP policies. All tool executions are',
+        'monitored and may be blocked according to the active SOPs configured in the',
+        'Intutic control plane.',
+        '',
+        '### Protected Paths',
+        '',
+        'The following paths must not be modified by any agent:',
+        '',
+        ...PROTECTED_PATHS.map((p) => `- \`${p}\``),
+        '',
+        '### Hook Events',
+        '',
+        'All tool executions are logged to `.intutic/events/roo-hook-events.jsonl`',
+        'and forwarded to the Intutic control plane on each sync cycle.',
+        '',
+    ].join('\n');
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Write the Roo Code governance hook configuration:
+ *  1. `.roorules` — SOP rules in Roo Code markdown format.
+ *  2. `.roorules/hooks/hooks.json` — hook config pointing to the Node.js gate.
+ *  3. `.intutic/hooks/roo-check.js` — Node.js dual-path hook (stdout cancel JSON).
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the hook script header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writeRooCodeHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    // ── 1. Ensure directories ──────────────────────────────────────────────────
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    const hookEventsDir = path.join(workspaceRoot, '.intutic', 'events');
+    const rooRulesDir = path.join(workspaceRoot, '.roorules');
+    const rooHooksDir = path.join(rooRulesDir, 'hooks');
+    await Promise.all([
+        fs.mkdir(hookScriptDir, { recursive: true }),
+        fs.mkdir(hookEventsDir, { recursive: true }),
+        fs.mkdir(rooHooksDir, { recursive: true }),
+    ]);
+    // ── 2. Write hook script (atomic) ─────────────────────────────────────────
+    const hookScriptPath = path.join(hookScriptDir, 'roo-check.js');
+    const tmpScript = hookScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, buildRooCheckScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    log.info({ action: 'roo_hook_script_written', path: hookScriptPath }, 'Roo Code hook script written');
+    // ── 3. Write .roorules (atomic) ───────────────────────────────────────────
+    const rooRulesPath = path.join(workspaceRoot, '.roorules');
+    // .roorules is a file (not the directory used for hooks), so we check if
+    // it's already a directory and write a README inside it instead.
+    let rooRulesIsDir = false;
+    try {
+        const stat = await fs.stat(rooRulesPath);
+        rooRulesIsDir = stat.isDirectory();
+    }
+    catch {
+        // Doesn't exist — write as file
+    }
+    if (rooRulesIsDir) {
+        // Write README.md inside the directory
+        const readmePath = path.join(rooRulesPath, 'README.md');
+        const tmpReadme = readmePath + '.intutic-tmp';
+        await fs.writeFile(tmpReadme, buildRooRulesContent(), 'utf-8');
+        await fs.rename(tmpReadme, readmePath);
+    }
+    else {
+        const tmpRooRules = rooRulesPath + '.intutic-tmp';
+        await fs.writeFile(tmpRooRules, buildRooRulesContent(), 'utf-8');
+        await fs.rename(tmpRooRules, rooRulesPath);
+    }
+    log.info({ action: 'roo_rules_written' }, 'Roo Code .roorules written');
+    // ── 4. Write .roorules/hooks/hooks.json (atomic) ──────────────────────────
+    const hooksJsonPath = path.join(rooHooksDir, 'hooks.json');
+    const hooksConfig = {
+        hooks: [
+            {
+                type: 'PreToolUse',
+                matcher: '.*',
+                command: `node ${hookScriptPath}`,
+            },
+        ],
+    };
+    const tmpHooksJson = hooksJsonPath + '.intutic-tmp';
+    await fs.writeFile(tmpHooksJson, JSON.stringify(hooksConfig, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpHooksJson, hooksJsonPath);
+    log.info({ action: 'roo_hooks_json_written', path: hooksJsonPath }, 'Roo Code hooks.json written');
+}
+//# sourceMappingURL=rooCodeHooks.js.map

package/dist/harness/rooCodeHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rooCodeHooks.js","sourceRoot":"","sources":["../../src/harness/rooCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,8DAA8D;AAC9D,MAAM,eAAe,GAAG;IACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;IACzD,uBAAuB;IACvB,6BAA6B;IAC7B,gBAAgB;IAChB,yBAAyB;IACzB,iCAAiC;IACjC,iBAAiB;CAClB,CAAA;AAED,iFAAiF;AAEjF,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAA;IAC7F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAEhF,OAAO;;;;;;;;;;;YAWG,QAAQ;gBACJ,MAAM,EAAE;gBACR,WAAW;;;;;;;;;;;2BAWA,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;4BAM7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;0BAiB7B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;0BAG/B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgHtD,CAAC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB;IAC3B,OAAO;QACL,6CAA6C;QAC7C,gDAAgD;QAChD,gBAAgB,MAAM,EAAE,EAAE;QAC1B,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,wBAAwB;QACxB,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,wDAAwD;QACxD,EAAE;QACF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACjG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,8BAA8B,CAAC,CAAA;IAErG,6EAA6E;IAE7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC1D,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,uCAAuC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAC9D,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAA;QACjD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;QAChE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC5C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEvE,6EAA6E;IAE7E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,QAAQ,cAAc,EAAE;aAClC;SACF;KACF,CAAA;IAED,MAAM,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE,EACzD,6BAA6B,CAC9B,CAAA;AACH,CAAC"}

package/dist/harness/windsurfHooks.d.ts

@@ -0,0 +1,27 @@
+/**
+ * windsurfHooks.ts — Windsurf Cascade hooks.json injection.
+ *
+ * Writes user-level (~/.codeium/windsurf/hooks.json) and workspace-level
+ * (.windsurf/hooks.json) governance hooks using the Windsurf Cascade
+ * hook system (exit code 2 = block).
+ *
+ * Also writes the proxy settings into ~/.codeium/windsurf/settings.json
+ * so that Windsurf routes HTTP traffic through the Intutic TLS MITM proxy,
+ * enabling governance of Cascade AI traffic that has no native base URL override.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+/**
+ * Write Windsurf hooks at user-level and workspace-level.
+ * Also configures the HTTP proxy to route through Intutic's TLS MITM layer.
+ *
+ * @param workspaceRoot - Absolute workspace root.
+ * @param proxyUrl      - Intutic proxy URL (used in the hook script comment).
+ * @param proxyPort     - Local port where the Intutic proxy is listening (for TLS MITM).
+ * @param workspaceId   - Workspace ID embedded in hook event payloads.
+ */
+export declare function writeWindsurfHooks(workspaceRoot: string, proxyUrl: string, proxyPort?: number, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=windsurfHooks.d.ts.map

package/dist/harness/windsurfHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windsurfHooks.d.ts","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAiJH;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dist/harness/windsurfHooks.js

@@ -0,0 +1,202 @@
+/**
+ * windsurfHooks.ts — Windsurf Cascade hooks.json injection.
+ *
+ * Writes user-level (~/.codeium/windsurf/hooks.json) and workspace-level
+ * (.windsurf/hooks.json) governance hooks using the Windsurf Cascade
+ * hook system (exit code 2 = block).
+ *
+ * Also writes the proxy settings into ~/.codeium/windsurf/settings.json
+ * so that Windsurf routes HTTP traffic through the Intutic TLS MITM proxy,
+ * enabling governance of Cascade AI traffic that has no native base URL override.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-windsurf-hooks');
+const WINDSURF_USER_DIR = path.join(os.homedir(), '.codeium', 'windsurf');
+const PROTECTED_PATHS = [
+    '.codeium/windsurf/hooks.json',
+    '.windsurf/hooks.json',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.claude/settings.json',
+    '.cursor/hooks.json',
+    '.cline/hooks',
+    '.agents/plugins/intutic-governance',
+    '.openhands/hooks.json',
+];
+function buildHooksConfig(hookScriptPath) {
+    return {
+        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        hooks: {
+            beforeShellExecution: {
+                command: `node "${hookScriptPath}"`,
+                failClosed: true,
+            },
+            beforeMCPExecution: {
+                command: `node "${hookScriptPath}"`,
+                failClosed: true,
+            },
+            beforeFileEdit: {
+                command: `node "${hookScriptPath}"`,
+                failClosed: true,
+            },
+        },
+    };
+}
+function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    return `#!/usr/bin/env node
+/**
+ * Intutic Windsurf governance gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = require('path').join(require('os').homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'windsurf',
+      timestamp: ts,
+      incidentId,
+    }) + '\\n';
+    fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+let raw = '';
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(raw);
+    const event = (ctx.event || '').toLowerCase();
+    const input = ctx.input || ctx;
+
+    const targetPath = input.path || input.file || input.target || '';
+    for (const p of PROTECTED_PATHS) {
+      if (String(targetPath).includes(p)) {
+        const reason = 'Attempt to modify protected path "' + targetPath + '"';
+        process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
+        logEvent('blocked', 'edit', reason);
+        process.exit(2);
+      }
+    }
+
+    // Scan shell commands for governance bypass patterns
+    const command = input.command || input.cmd || '';
+    const dangerPatterns = [
+      /chflags\\s+nouchg/,
+      /chattr\\s+-i\\s+/,
+      /chmod\\s+[0-9]*[2367][0-9]*\\s+.*hooks/,
+    ];
+    for (const pat of dangerPatterns) {
+      if (pat.test(command)) {
+        const reason = 'Command matches bypass pattern: "' + command + '"';
+        process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
+        logEvent('blocked', 'bash', reason);
+        process.exit(2);
+      }
+    }
+
+    logEvent('allowed', event || 'tool', '');
+    process.exit(0);
+  } catch (err) {
+    const errMsg = String(err);
+    process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
+    logEvent('blocked', 'unknown', errMsg);
+    process.exit(2);
+  }
+});
+`;
+}
+/**
+ * Write Windsurf hooks at user-level and workspace-level.
+ * Also configures the HTTP proxy to route through Intutic's TLS MITM layer.
+ *
+ * @param workspaceRoot - Absolute workspace root.
+ * @param proxyUrl      - Intutic proxy URL (used in the hook script comment).
+ * @param proxyPort     - Local port where the Intutic proxy is listening (for TLS MITM).
+ * @param workspaceId   - Workspace ID embedded in hook event payloads.
+ */
+export async function writeWindsurfHooks(workspaceRoot, proxyUrl, proxyPort = 8877, workspaceId = '') {
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    await fs.mkdir(hookScriptDir, { recursive: true });
+    // Ensure hook events log directory exists
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    const hookScriptPath = path.join(hookScriptDir, 'windsurf-check.js');
+    const tmpScript = hookScriptPath + '.ws-tmp';
+    await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    const config = buildHooksConfig(hookScriptPath);
+    // 1. User-level hooks
+    await fs.mkdir(WINDSURF_USER_DIR, { recursive: true });
+    await atomicWriteJson(path.join(WINDSURF_USER_DIR, 'hooks.json'), config);
+    log.info({ action: 'windsurf_hooks_written', level: 'user' }, 'Windsurf user-level hooks written');
+    // 2. Workspace-level hooks (.windsurf/hooks.json)
+    const wsWindsurfDir = path.join(workspaceRoot, '.windsurf');
+    await fs.mkdir(wsWindsurfDir, { recursive: true });
+    await atomicWriteJson(path.join(wsWindsurfDir, 'hooks.json'), {
+        ...config,
+        _note: 'Workspace-level hooks — agent may be able to modify this file. User-level hooks take precedence.',
+    });
+    log.info({ action: 'windsurf_hooks_written', level: 'workspace' }, 'Windsurf workspace-level hooks written');
+    // 3. HTTP proxy settings → routes Windsurf's Cascade AI traffic through Intutic TLS MITM
+    const wsSettings = {
+        _comment: 'Intutic proxy settings — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        'http.proxy': `http://127.0.0.1:${proxyPort}`,
+        'http.proxyStrictSSL': false, // Our CA cert handles validation
+        'codeium.proxy': `http://127.0.0.1:${proxyPort}`,
+    };
+    await atomicWriteJson(path.join(WINDSURF_USER_DIR, 'settings.json'), wsSettings);
+    log.info({ action: 'windsurf_proxy_configured', port: proxyPort }, 'Windsurf HTTP proxy configured for TLS MITM interception');
+}
+async function atomicWriteJson(filePath, data) {
+    const tmp = filePath + '.intutic-tmp';
+    await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmp, filePath);
+}
+//# sourceMappingURL=windsurfHooks.js.map

package/dist/harness/windsurfHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windsurfHooks.js","sourceRoot":"","sources":["../../src/harness/windsurfHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAEzE,MAAM,eAAe,GAAG;IACtB,8BAA8B;IAC9B,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;IACd,oCAAoC;IACpC,uBAAuB;CACxB,CAAA;AAED,SAAS,gBAAgB,CAAC,cAAsB;IAC9C,OAAO;QACL,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,oBAAoB,EAAE;gBACpB,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;YACD,kBAAkB,EAAE;gBAClB,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;YACD,cAAc,EAAE;gBACd,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;gFAQwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;0BAWjF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;wBAcjC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDpD,CAAA;AACD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,SAAS,GAAG,IAAI,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAE/C,sBAAsB;IACtB,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACzE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAElG,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;QAC5D,GAAG,MAAM;QACT,KAAK,EAAE,kGAAkG;KAC1G,CAAC,CAAA;IACF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,wCAAwC,CAAC,CAAA;IAE5G,yFAAyF;IACzF,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,uDAAuD;QACjE,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,oBAAoB,SAAS,EAAE;QAC7C,qBAAqB,EAAE,KAAK,EAAE,iCAAiC;QAC/D,eAAe,EAAE,oBAAoB,SAAS,EAAE;KACjD,CAAA;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,2BAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,EACxD,0DAA0D,CAC3D,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}

package/dist/hashReporter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * hashReporter.ts — SHA-256 hash computation + integrity comparison.
+ *
+ * Computes SHA-256 hashes of local harness config files and compares
+ * them against canonical hashes from the control plane. This enables
+ * SOP drift detection: if a developer manually edits a governed file,
+ * the daemon flags it as drifted in the next sync report.
+ *
+ * HLD §3.14 — SOP Integrity Verification
+ * LLD #8 — Sync Daemon / CLI
+ *
+ * @module
+ */
+import type { HarnessType, SopFileHash } from '@intutic/shared-types';
+/**
+ * Compute SHA-256 hashes for all harness config files and compare
+ * against canonical hashes from the control plane.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param harnesses - Harness types detected in the workspace.
+ * @param canonicalHashes - Expected hashes from last sync (filePath → SHA-256).
+ * @returns Array of SopFileHash entries with drift detection flags.
+ */
+export declare function computeFileHashes(workspaceRoot: string, harnesses: HarnessType[], canonicalHashes: Record<string, string>): Promise<SopFileHash[]>;
+/**
+ * Compute the SHA-256 hex digest of a file's contents.
+ *
+ * @param filePath - Absolute path to the file.
+ * @returns 64-character lowercase hex SHA-256 hash.
+ * @throws If the file does not exist or is not readable.
+ */
+export declare function hashFile(filePath: string): Promise<string>;
+//# sourceMappingURL=hashReporter.d.ts.map

package/dist/hashReporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashReporter.d.ts","sourceRoot":"","sources":["../src/hashReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGrE;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,EACxB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,WAAW,EAAE,CAAC,CAiCxB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhE"}