@intutic/sync-daemon 1.6.0

package/dist/harness/claudeCodeHooks.js

@@ -0,0 +1,414 @@
+/**
+ * claudeCodeHooks.ts — Claude Code PreToolUse hook generator.
+ *
+ * Compiles SOP evaluation criteria and high risk tools into native Claude Code
+ * settings.json configurations (both permissions.deny rules and PreToolUse hooks).
+ * Writes configurations locally to the workspace and globally to ~/.claude/.
+ *
+ * LLD #14 — claudeCodeHooks.ts
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import * as node_os from 'node:os';
+import { z } from 'zod';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-claude-hooks');
+/** Path to the local hook event log file appended by generated hook scripts. */
+export const HOOK_EVENTS_LOG = '.intutic/events/hook-events.jsonl';
+// Zod schema to parse SOP evaluation criteria and tool restrictions
+export const SopHookConstraintsSchema = z.object({
+    highRiskTools: z.array(z.string()).default([]),
+    patterns: z.array(z.string()).default([]),
+});
+/**
+ * Extracts constraints from SOP registry entries.
+ * Looks inside SOP markdown content for structured JSON/YAML blocks or parses settings.
+ */
+export function parseSopConstraints(sops, settings) {
+    const highRiskToolsSet = new Set();
+    const patternsSet = new Set();
+    // 1. Parse from workspace settings if present
+    // Treat settings as Record<string, unknown> for legacy field access (highRiskTools, patterns)
+    if (settings) {
+        const s = settings;
+        if (Array.isArray(s['highRiskTools'])) {
+            s['highRiskTools'].forEach((t) => typeof t === 'string' && highRiskToolsSet.add(t));
+        }
+        if (Array.isArray(s['patterns'])) {
+            s['patterns'].forEach((p) => typeof p === 'string' && patternsSet.add(p));
+        }
+    }
+    // 2. Parse from SOP content
+    for (const sop of sops) {
+        const content = sop.content;
+        const startIdx = content.indexOf('```json');
+        if (startIdx !== -1) {
+            const jsonStart = content.indexOf('\n', startIdx);
+            const endIdx = content.indexOf('```', jsonStart !== -1 ? jsonStart : startIdx + 7);
+            if (jsonStart !== -1 && endIdx !== -1 && endIdx > jsonStart) {
+                const jsonText = content.slice(jsonStart + 1, endIdx).trim();
+                try {
+                    const parsed = JSON.parse(jsonText);
+                    const validated = SopHookConstraintsSchema.safeParse(parsed);
+                    if (validated.success) {
+                        validated.data.highRiskTools.forEach((t) => highRiskToolsSet.add(t));
+                        validated.data.patterns.forEach((p) => patternsSet.add(p));
+                    }
+                }
+                catch {
+                    // Ignore parsing failures
+                }
+            }
+        }
+        // Also look for inline patterns
+        // e.g., "Blacklist Pattern: rm -rf"
+        const patternRegexes = [/Blacklist Pattern:\s*`?([^`\n]+)`?/gi, /Deny Pattern:\s*`?([^`\n]+)`?/gi];
+        for (const regex of patternRegexes) {
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                if (match[1]) {
+                    patternsSet.add(match[1].trim());
+                }
+            }
+        }
+        // e.g., "High Risk Tool: Bash"
+        const toolRegex = /High Risk Tool:\s*`?([^`\n]+)`?/gi;
+        let toolMatch;
+        while ((toolMatch = toolRegex.exec(content)) !== null) {
+            if (toolMatch[1]) {
+                highRiskToolsSet.add(toolMatch[1].trim());
+            }
+        }
+    }
+    return {
+        highRiskTools: Array.from(highRiskToolsSet),
+        patterns: Array.from(patternsSet),
+    };
+}
+/**
+ * Compiles constraints into Claude Code settings.json format and writes it.
+ *
+ * @param workspaceRoot    - Workspace root path.
+ * @param sops             - The sync SOP list.
+ * @param settings         - Passthrough settings.
+ * @param controlPlaneUrl  - Control plane base URL embedded into the hook events log path comment.
+ * @param workspaceId      - Workspace ID embedded into hook event payloads.
+ * @param harnessType      - Harness type tag written into each hook event.
+ */
+export async function updatePreToolUseHooks(workspaceRoot, sops, settings, controlPlaneUrl, workspaceId, harnessType = 'claude-code') {
+    const constraints = parseSopConstraints(sops, settings);
+    log.info({ action: 'update_hooks', toolCount: constraints.highRiskTools.length, patternCount: constraints.patterns.length }, 'Compiling PreToolUse hook configurations for Claude Code');
+    // Build the permissions.deny rules and hooks structure
+    const denyRules = [];
+    // High risk tools deny rules
+    for (const tool of constraints.highRiskTools) {
+        denyRules.push(tool);
+    }
+    // Pattern-based deny rules (e.g. Bash(rm -rf *))
+    for (const pattern of constraints.patterns) {
+        denyRules.push(`Bash(*${pattern}*)`);
+    }
+    // Build settings object matching Claude Code schema.
+    // We hook Bash, Edit, Write, and MultiEdit so that the policy gate
+    // covers file-modification tools in addition to shell execution.
+    const hookEntry = (matcher) => ({
+        matcher,
+        hooks: [
+            {
+                type: 'command',
+                command: `node ${node_path.join(workspaceRoot, '.intutic', 'hooks', 'pre-tool-check.js')}`,
+                timeout: 10,
+                statusMessage: 'Verifying tool execution against Intutic SOP policy...',
+            },
+        ],
+    });
+    const newSettings = {
+        permissions: {
+            deny: denyRules,
+        },
+        hooks: {
+            PreToolUse: [
+                hookEntry('Bash'),
+                hookEntry('Edit'),
+                hookEntry('Write'),
+                hookEntry('MultiEdit'),
+            ],
+        },
+    };
+    // Create hook script locally in workspace root (.intutic/hooks/pre-tool-check.js)
+    const hookScriptDir = node_path.join(workspaceRoot, '.intutic', 'hooks');
+    await node_fs.mkdir(hookScriptDir, { recursive: true });
+    // Ensure hook events log directory exists
+    const hookEventsDir = node_path.join(workspaceRoot, '.intutic', 'events');
+    await node_fs.mkdir(hookEventsDir, { recursive: true });
+    const hookEventsLog = node_path.join(hookEventsDir, 'hook-events.jsonl');
+    const hookScriptContent = `
+/**
+ * Intutic PreToolUse execution gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ *
+ * Governance events are appended to .intutic/events/hook-events.jsonl
+ * and drained to the control plane by the sync-daemon on each cycle.
+ * Control plane: ${controlPlaneUrl ?? 'https://api.intutic.ai'}
+ */
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// ── Runtime credentials (sourced from ~/.intutic/env/runtime.env at invocation time) ──
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId ?? '')};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch { /* runtime.env not yet written — use defaults */ }
+
+// Governance-sensitive paths that no agent may modify.
+// Editing these files is how privilege escalation occurs.
+const PROTECTED_PATHS = [
+  path.join(os.homedir(), '.claude', 'settings.json'),
+  path.join(os.homedir(), '.claude', 'settings.local.json'),
+  '.claude/settings.json',
+  '.claude/settings.local.json',
+  '.intutic/hooks',
+  '.intutic/integrity.json',
+  '.intutic/context_integrity.json',
+];
+
+/**
+ * Appends a governance event to the local hook-events log.
+ * Uses synchronous append (O_APPEND is atomic for single-write < PIPE_BUF).
+ * The sync-daemon drains this file on each cycle and POSTs to the control plane.
+ */
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+      toolName,
+      reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: ${JSON.stringify(harnessType)},
+      timestamp: ts,
+      incidentId,
+    }) + '\\n';
+    // Path B: reliable file append (sync-daemon drains on FSEvents change)
+    fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
+    // Path A: fire-and-forget HTTP POST (near-real-time dashboard, non-blocking)
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const isHttps = urlObj.protocol === 'https:';
+        const mod = isHttps ? https : require('http');
+        const req = mod.request({
+          hostname: urlObj.hostname,
+          port: urlObj.port || (isHttps ? 443 : 80),
+          path: urlObj.pathname,
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+            'Authorization': 'Bearer ' + _intuticKey,
+          },
+        });
+        req.on('error', () => { /* fire-and-forget — ignore errors */ });
+        req.write(body);
+        req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+// Read stdin containing Claude's tool context
+let inputData = '';
+process.stdin.on('data', (chunk) => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(inputData);
+    const toolName = (ctx.tool_name || ctx.toolName || '').toLowerCase();
+    const toolInput = ctx.tool_input || ctx.toolInput || {};
+    const toolInputStr = JSON.stringify(toolInput);
+
+    // 1. Protected-path guard — block any file-modification tool targeting
+    //    governance-sensitive paths regardless of SOP pattern list.
+    if (['edit', 'write', 'multiedit'].includes(toolName)) {
+      const targetPath = toolInput.path || toolInput.file_path ||
+        toolInput.new_path || toolInput.target || '';
+      for (const p of PROTECTED_PATHS) {
+        if (targetPath.includes(p) || String(targetPath).startsWith(p)) {
+          const reason = \`Attempt to modify governance-protected path: "\${targetPath}". \` +
+            'To change governance policy, update your SOP via the Intutic control plane.';
+          console.error(\`[Intutic Guardrail] BLOCKED: \${reason}\`);
+          logEvent('blocked', toolName, reason);
+          process.exit(2);
+        }
+      }
+    }
+
+    // 2. SOP-compiled pattern blacklist
+    const patterns = ${JSON.stringify(constraints.patterns)};
+    for (const pattern of patterns) {
+      if (toolInputStr.includes(pattern)) {
+        const reason = \`Policy violation matching pattern: "\${pattern}"\`;
+        console.error(\`[Intutic Guardrail] Blocked execution of tool "\${toolName}" due to \${reason}\`);
+        logEvent('blocked', toolName, reason);
+        process.exit(2);
+      }
+    }
+
+    logEvent('allowed', toolName, '');
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED — any hook execution error blocks the tool call.
+    // The sync daemon will rewrite this hook on the next sync cycle.
+    console.error('[Intutic Guardrail] Hook error (blocking for safety):', err);
+    logEvent('blocked', 'unknown', String(err));
+    process.exit(2);
+  }
+});
+`.trim();
+    await node_fs.writeFile(node_path.join(hookScriptDir, 'pre-tool-check.js'), hookScriptContent, 'utf-8');
+    // Write local settings config
+    const localClaudeDir = node_path.join(workspaceRoot, '.claude');
+    await node_fs.mkdir(localClaudeDir, { recursive: true });
+    const localSettingsPath = node_path.join(localClaudeDir, 'settings.json');
+    let existingLocal = {};
+    try {
+        const raw = await node_fs.readFile(localSettingsPath, 'utf-8');
+        existingLocal = JSON.parse(raw);
+    }
+    catch {
+        // Ignore
+    }
+    const mergedLocal = {
+        ...existingLocal,
+        permissions: {
+            ...existingLocal.permissions,
+            deny: denyRules,
+        },
+        hooks: {
+            ...existingLocal.hooks,
+            PreToolUse: newSettings.hooks.PreToolUse,
+        },
+    };
+    await node_fs.writeFile(localSettingsPath, JSON.stringify(mergedLocal, null, 2) + '\n', 'utf-8');
+    // Write global settings config ~/.claude/settings.json
+    //
+    // GUARD (bugfix): never touch the user's real global settings from a test
+    // run. Vitest sets VITEST=1; without this guard, every run of
+    // __tests__/harness/claudeCodeHooks.test.ts merged the MOCK SOP denies
+    // (Bash/Write/rm -rf/…) into the developer's real ~/.claude/settings.json
+    // and pointed global hooks at a mkdtemp dir the test then deleted —
+    // leaving dead fail-closed hooks and a denied Bash/Write toolset.
+    // INTUTIC_SKIP_GLOBAL_HOOKS=1 is an explicit opt-out for dev machines.
+    if (process.env['VITEST'] || process.env['INTUTIC_SKIP_GLOBAL_HOOKS']) {
+        log.info({ action: 'global_hooks_skipped' }, 'Skipping global ~/.claude settings write (test or opt-out environment)');
+        return;
+    }
+    const globalClaudeDir = node_path.join(node_os.homedir(), '.claude');
+    await node_fs.mkdir(globalClaudeDir, { recursive: true });
+    const globalSettingsPath = node_path.join(globalClaudeDir, 'settings.json');
+    let existingGlobal = {};
+    try {
+        const raw = await node_fs.readFile(globalSettingsPath, 'utf-8');
+        existingGlobal = JSON.parse(raw);
+    }
+    catch {
+        // Ignore
+    }
+    // Merge, prioritizing global user settings but updating permissions/hooks
+    const mergedGlobal = {
+        ...existingGlobal,
+        permissions: {
+            ...existingGlobal.permissions,
+            deny: Array.from(new Set([...(existingGlobal.permissions?.deny || []), ...denyRules])),
+        },
+        hooks: {
+            ...existingGlobal.hooks,
+            PreToolUse: newSettings.hooks.PreToolUse,
+        },
+    };
+    await node_fs.writeFile(globalSettingsPath, JSON.stringify(mergedGlobal, null, 2) + '\n', 'utf-8');
+    log.info({ action: 'hooks_written' }, 'Successfully updated settings.json hooks globally and locally');
+}
+// ─── Event Drain Helper ──────────────────────────────────────────────────────
+/**
+ * Drains the local hook-events log file and POSTs all accumulated governance
+ * events to the control plane in a single batch request.
+ *
+ * Called by the sync-daemon's main loop (syncLoop.ts) on every cycle, after
+ * the main sync operations. On success, the log file is truncated to prevent
+ * unbounded growth. On network failure, events remain in the log and will be
+ * retried on the next cycle.
+ *
+ * @param workspaceRoot    - Workspace root (log file is at workspaceRoot/.intutic/events/hook-events.jsonl)
+ * @param controlPlaneUrl  - Control plane base URL
+ * @param apiKey           - Workspace API key (Bearer token)
+ * @returns number of events drained (0 if log was empty or network failed)
+ */
+export async function drainHookEvents(workspaceRoot, controlPlaneUrl, apiKey) {
+    const logPath = node_path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    let raw;
+    try {
+        raw = await node_fs.readFile(logPath, 'utf-8');
+    }
+    catch {
+        return 0; // File doesn't exist yet — nothing to drain
+    }
+    const lines = raw.trim().split('\n').filter(Boolean);
+    if (lines.length === 0)
+        return 0;
+    const events = [];
+    for (const line of lines) {
+        try {
+            events.push(JSON.parse(line));
+        }
+        catch {
+            log.warn({ line }, 'Skipping malformed hook event log line');
+        }
+    }
+    if (events.length === 0) {
+        await node_fs.writeFile(logPath, '', 'utf-8');
+        return 0;
+    }
+    try {
+        // Use native fetch (Node 18+ — required minimum for this monorepo)
+        const response = await fetch(`${controlPlaneUrl}/api/v1/hook-events`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ events }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (response.ok) {
+            // Truncate the log — events successfully delivered
+            await node_fs.writeFile(logPath, '', 'utf-8');
+            log.info({ count: events.length }, 'Hook events drained to control plane');
+            return events.length;
+        }
+        else {
+            log.warn({ status: response.status, count: events.length }, 'Control plane rejected hook events — retaining log for next cycle');
+            return 0;
+        }
+    }
+    catch (err) {
+        // Network failure — retain log for retry on next cycle
+        log.warn({ err, count: events.length }, 'Failed to drain hook events — will retry on next sync cycle');
+        return 0;
+    }
+}
+//# sourceMappingURL=claudeCodeHooks.js.map

package/dist/harness/claudeCodeHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeHooks.js","sourceRoot":"","sources":["../../src/harness/claudeCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAA;AAElE,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAoB,EACpB,QAAsF;IAEtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,8CAA8C;IAC9C,8FAA8F;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,QAAmC,CAAA;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrC,CAAC,CAAC,eAAe,CAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,UAAU,CAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;YAClF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC5D,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;oBACnC,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;oBAC5D,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;wBACtB,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;wBACpE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC5D,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,oCAAoC;QACpC,MAAM,cAAc,GAAG,CAAC,sCAAsC,EAAE,iCAAiC,CAAC,CAAA;QAClG,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,KAAK,CAAA;YACT,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACb,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,SAAS,GAAG,mCAAmC,CAAA;QACrD,IAAI,SAAS,CAAA;QACb,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjB,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC3C,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;KAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,IAAoB,EACpB,QAAsF,EACtF,eAAwB,EACxB,WAAoB,EACpB,WAAW,GAAG,aAAa;IAE3B,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAEvD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,EAClH,0DAA0D,CAC3D,CAAA;IAED,uDAAuD;IACvD,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QAC7C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtB,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,qDAAqD;IACrD,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE;gBAC1F,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,wDAAwD;aACxE;SACF;KACF,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG;QAClB,WAAW,EAAE;YACX,IAAI,EAAE,SAAS;SAChB;QACD,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC;gBACjB,SAAS,CAAC,MAAM,CAAC;gBACjB,SAAS,CAAC,OAAO,CAAC;gBAClB,SAAS,CAAC,WAAW,CAAC;aACvB;SACF;KACF,CAAA;IAED,kFAAkF;IAClF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvD,0CAA0C;IAC1C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACzE,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAExE,MAAM,iBAAiB,GAAG;;;;;;;oBAOR,eAAe,IAAI,wBAAwB;;;;;;;;;;gFAUiB,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAqC5F,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;wBAKxB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAsD9B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;CAoB1D,CAAC,IAAI,EAAE,CAAA;IAEN,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAEvG,8BAA8B;IAC9B,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAC/D,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;IAEzE,IAAI,aAAa,GAA4B,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;QAC9D,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,GAAG,aAAa;QAChB,WAAW,EAAE;YACX,GAAI,aAAa,CAAC,WAAuC;YACzD,IAAI,EAAE,SAAS;SAChB;QACD,KAAK,EAAE;YACL,GAAI,aAAa,CAAC,KAAiC;YACnD,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU;SACzC;KACF,CAAA;IAED,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAEhG,uDAAuD;IACvD,EAAE;IACF,0EAA0E;IAC1E,8DAA8D;IAC9D,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,kEAAkE;IAClE,uEAAuE;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAClC,wEAAwE,CACzE,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpE,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA;IAE3E,IAAI,cAAc,GAA4B,EAAE,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;QAC/D,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,0EAA0E;IAC1E,MAAM,YAAY,GAAG;QACnB,GAAG,cAAc;QACjB,WAAW,EAAE;YACX,GAAI,cAAc,CAAC,WAAuC;YAC1D,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAE,cAAc,CAAC,WAAmB,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;SAChG;QACD,KAAK,EAAE;YACL,GAAI,cAAc,CAAC,KAAiC;YACpD,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU;SACzC;KACF,CAAA;IAED,MAAM,OAAO,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,+DAA+D,CAAC,CAAA;AACxG,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,eAAuB,EACvB,MAAc;IAEd,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IAExF,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA,CAAC,4CAA4C;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAC7C,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,qBAAqB,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,MAAM,EAAE;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;YAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,mDAAmD;YACnD,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,sCAAsC,CAAC,CAAA;YAC1E,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EACjD,mEAAmE,CACpE,CAAA;YACD,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,6DAA6D,CAAC,CAAA;QACtG,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC"}

package/dist/harness/claudeDesktopHooks.d.ts

@@ -0,0 +1,30 @@
+/**
+ * claudeDesktopHooks.ts — Claude Desktop PreToolUse hook generator.
+ *
+ * Claude Desktop shares the same hook format as Claude Code (PreToolUse,
+ * exit 2 on stdin JSON) but reads its config from an OS-specific location:
+ *   macOS : ~/Library/Application Support/Claude/claude_desktop_config.json
+ *   Linux : ~/.config/Claude/claude_desktop_config.json
+ *
+ * Hook events are written via dual-path logEvent:
+ *   Path B (reliable)  — synchronous append to .intutic/events/claude-desktop-hook-events.jsonl
+ *   Path A (telemetry) — fire-and-forget https.request to the control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write the Claude Desktop governance hook script and merge hook configuration
+ * into the OS-specific claude_desktop_config.json.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ * Does NOT touch the `mcpServers` section of the config.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the hook script header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export declare function writeClaudeDesktopHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=claudeDesktopHooks.d.ts.map

package/dist/harness/claudeDesktopHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeDesktopHooks.d.ts","sourceRoot":"","sources":["../../src/harness/claudeDesktopHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAqMH;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAsEf"}