@intutic/sync-daemon 1.6.0

package/dist/harness/claudeDesktopHooks.js

@@ -0,0 +1,267 @@
+/**
+ * claudeDesktopHooks.ts — Claude Desktop PreToolUse hook generator.
+ *
+ * Claude Desktop shares the same hook format as Claude Code (PreToolUse,
+ * exit 2 on stdin JSON) but reads its config from an OS-specific location:
+ *   macOS : ~/Library/Application Support/Claude/claude_desktop_config.json
+ *   Linux : ~/.config/Claude/claude_desktop_config.json
+ *
+ * Hook events are written via dual-path logEvent:
+ *   Path B (reliable)  — synchronous append to .intutic/events/claude-desktop-hook-events.jsonl
+ *   Path A (telemetry) — fire-and-forget https.request to the control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-claude-desktop-hooks');
+/** Governance-sensitive paths that the hook gate protects (mirrors claudeCodeHooks). */
+const PROTECTED_PATHS = [
+    path.join(os.homedir(), '.claude', 'settings.json'),
+    path.join(os.homedir(), '.claude', 'settings.local.json'),
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.intutic/context_integrity.json',
+];
+/** Resolve the OS-specific claude_desktop_config.json path. */
+function resolveClaudeDesktopConfigPath() {
+    switch (process.platform) {
+        case 'darwin':
+            return path.join(os.homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+        case 'linux':
+            return path.join(os.homedir(), '.config', 'Claude', 'claude_desktop_config.json');
+        default:
+            // Fallback to macOS path — Windows is out of scope for now
+            return path.join(os.homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    }
+}
+// ─── Node.js hook script template ─────────────────────────────────────────────
+function buildClaudeDesktopCheckScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'claude-desktop-hook-events.jsonl');
+    const runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+    return `/**
+ * Intutic Claude Desktop PreToolUse execution gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ *
+ * Dual-path logEvent:
+ *   Path B — synchronous file append to hook-events.jsonl
+ *   Path A — fire-and-forget https.request to the control plane
+ *
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ * Workspace: ${workspaceId}
+ */
+'use strict';
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const https = require('https');
+const crypto = require('crypto');
+const url = require('url');
+
+// ── Runtime env loader (Path A credentials) ──────────────────────────────────
+const RUNTIME_ENV_PATH = ${JSON.stringify(runtimeEnvPath)};
+
+function loadRuntimeEnv() {
+  const env = {
+    INTUTIC_HOST: 'https://api.intutic.ai',
+    INTUTIC_API_KEY: '',
+    INTUTIC_WORKSPACE_ID: ${JSON.stringify(workspaceId)},
+  };
+  try {
+    const raw = fs.readFileSync(RUNTIME_ENV_PATH, 'utf-8');
+    for (const line of raw.split('\\n')) {
+      const stripped = line.trim();
+      if (!stripped || stripped.startsWith('#') || !stripped.includes('=')) continue;
+      const eq = stripped.indexOf('=');
+      const k = stripped.slice(0, eq).trim();
+      const v = stripped.slice(eq + 1).trim();
+      env[k] = v;
+    }
+  } catch { /* file may not exist yet */ }
+  return env;
+}
+
+// ── Governance-sensitive paths ────────────────────────────────────────────────
+const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+
+// ── Dual-path logEvent ────────────────────────────────────────────────────────
+const HOOK_EVENTS_LOG = ${JSON.stringify(hookEventsLog)};
+
+function logEvent(env, verdict, toolName, reason) {
+  const ts = new Date().toISOString();
+  const incidentId = crypto.createHash('sha1')
+    .update(ts + toolName + env.INTUTIC_WORKSPACE_ID)
+    .digest('hex').slice(0, 16);
+
+  const entry = {
+    event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+    toolName,
+    reason: reason || '',
+    workspaceId: env.INTUTIC_WORKSPACE_ID,
+    harnessType: 'claude-desktop',
+    timestamp: ts,
+    incidentId,
+  };
+
+  // Path B — reliable file append
+  try {
+    const dir = path.dirname(HOOK_EVENTS_LOG);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(HOOK_EVENTS_LOG, JSON.stringify(entry) + '\\n', { flag: 'a' });
+  } catch { /* never crash the hook */ }
+
+  // Path A — fire-and-forget https.request
+  if (env.INTUTIC_API_KEY) {
+    try {
+      const body = Buffer.from(JSON.stringify({ events: [entry] }));
+      const parsedUrl = url.parse(env.INTUTIC_HOST + '/api/v1/hook-events');
+      const req = https.request({
+        hostname: parsedUrl.hostname,
+        port: parsedUrl.port || 443,
+        path: parsedUrl.path,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': body.length,
+          'Authorization': 'Bearer ' + env.INTUTIC_API_KEY,
+        },
+      });
+      req.on('error', () => {}); // fire-and-forget
+      req.write(body);
+      req.end();
+    } catch { /* never crash the hook */ }
+  }
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+const runtimeEnv = loadRuntimeEnv();
+let inputData = '';
+process.stdin.on('data', (chunk) => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(inputData);
+    const toolName = (ctx.tool_name || ctx.toolName || '').toLowerCase();
+    const toolInput = ctx.tool_input || ctx.toolInput || {};
+    const toolInputStr = JSON.stringify(toolInput);
+
+    // 1. Protected-path guard
+    if (['edit', 'write', 'multiedit'].includes(toolName)) {
+      const targetPath = toolInput.path || toolInput.file_path ||
+        toolInput.new_path || toolInput.target || '';
+      for (const p of PROTECTED_PATHS) {
+        if (targetPath.includes(p) || String(targetPath).startsWith(p)) {
+          const reason = 'Attempt to modify governance-protected path: "' + targetPath + '". ' +
+            'To change governance policy, update your SOP via the Intutic control plane.';
+          console.error('[Intutic Guardrail] BLOCKED: ' + reason);
+          logEvent(runtimeEnv, 'blocked', toolName, reason);
+          process.exit(2);
+        }
+      }
+    }
+
+    // 2. Bash/shell command bypass guard
+    if (toolName === 'bash') {
+      const cmd = toolInput.command || toolInput.cmd || '';
+      const BYPASS_PATTERNS = [
+        'chflags nouchg',
+        'chattr -i',
+        'rm -rf .intutic',
+        'CLAUDE_DESKTOP_HOOKS=',
+      ];
+      for (const pattern of BYPASS_PATTERNS) {
+        if (cmd.includes(pattern)) {
+          const reason = 'Shell command matches governance bypass pattern: "' + pattern + '"';
+          console.error('[Intutic Guardrail] BLOCKED: ' + reason);
+          logEvent(runtimeEnv, 'blocked', toolName, reason);
+          process.exit(2);
+        }
+      }
+    }
+
+    logEvent(runtimeEnv, 'allowed', toolName, '');
+    process.exit(0);
+  } catch (err) {
+    console.error('[Intutic Guardrail] Hook error (blocking for safety):', err);
+    logEvent(runtimeEnv, 'blocked', 'unknown', String(err));
+    process.exit(2);
+  }
+});
+`.trim();
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Write the Claude Desktop governance hook script and merge hook configuration
+ * into the OS-specific claude_desktop_config.json.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ * Does NOT touch the `mcpServers` section of the config.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the hook script header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writeClaudeDesktopHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    // ── 1. Ensure directories ──────────────────────────────────────────────────
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    const hookEventsDir = path.join(workspaceRoot, '.intutic', 'events');
+    const desktopConfigPath = resolveClaudeDesktopConfigPath();
+    const desktopConfigDir = path.dirname(desktopConfigPath);
+    await Promise.all([
+        fs.mkdir(hookScriptDir, { recursive: true }),
+        fs.mkdir(hookEventsDir, { recursive: true }),
+        fs.mkdir(desktopConfigDir, { recursive: true }),
+    ]);
+    // ── 2. Write hook script (atomic) ─────────────────────────────────────────
+    const hookScriptPath = path.join(hookScriptDir, 'claude-desktop-check.js');
+    const tmpScript = hookScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, buildClaudeDesktopCheckScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    log.info({ action: 'claude_desktop_hook_script_written', path: hookScriptPath }, 'Claude Desktop hook script written');
+    // ── 3. Merge into claude_desktop_config.json (safe merge, preserve mcpServers) ──
+    let existingConfig = {};
+    try {
+        const raw = await fs.readFile(desktopConfigPath, 'utf-8');
+        existingConfig = JSON.parse(raw);
+    }
+    catch {
+        // File doesn't exist yet — start fresh
+    }
+    const existingHooks = existingConfig.hooks ?? {};
+    const existingPreToolUse = existingHooks.PreToolUse ?? [];
+    // De-duplicate: remove any existing Intutic entry for Bash then re-add
+    const HOOK_MATCHERS = ['Bash', 'Edit', 'Write', 'MultiEdit'];
+    const intuticCmd = `node ${hookScriptPath}`;
+    const filteredPTU = existingPreToolUse.filter((entry) => {
+        if (typeof entry !== 'object' || entry === null)
+            return true;
+        const e = entry;
+        // Remove entries where all inner hooks use the intutic command
+        const innerHooks = e.hooks ?? [];
+        return !innerHooks.every((h) => typeof h === 'object' && h !== null && h.command === intuticCmd);
+    });
+    const newPreToolUseEntries = HOOK_MATCHERS.map((matcher) => ({
+        matcher,
+        hooks: [{ type: 'command', command: intuticCmd }],
+    }));
+    const mergedConfig = {
+        ...existingConfig,
+        hooks: {
+            ...existingHooks,
+            PreToolUse: [...filteredPTU, ...newPreToolUseEntries],
+        },
+    };
+    const tmpConfig = desktopConfigPath + '.intutic-tmp';
+    await fs.writeFile(tmpConfig, JSON.stringify(mergedConfig, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpConfig, desktopConfigPath);
+    log.info({ action: 'claude_desktop_config_written', path: desktopConfigPath }, 'Merged Intutic hooks into claude_desktop_config.json');
+}
+//# sourceMappingURL=claudeDesktopHooks.js.map

package/dist/harness/claudeDesktopHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeDesktopHooks.js","sourceRoot":"","sources":["../../src/harness/claudeDesktopHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAA;AAErD,wFAAwF;AACxF,MAAM,eAAe,GAAG;IACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;IACzD,uBAAuB;IACvB,6BAA6B;IAC7B,gBAAgB;IAChB,yBAAyB;IACzB,iCAAiC;CAClC,CAAA;AAED,+DAA+D;AAC/D,SAAS,8BAA8B;IACrC,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QAC1G,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QACnF;YACE,2DAA2D;YAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IAC5G,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,6BAA6B,CACpC,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,kCAAkC,CAAC,CAAA;IACxG,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAEhF,OAAO;;;;;;;;YAQG,QAAQ;gBACJ,MAAM,EAAE;gBACR,WAAW;;;;;;;;;;;2BAWA,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;4BAM7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;0BAiB7B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;0BAG/B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqGtD,CAAC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,iBAAiB,GAAG,8BAA8B,EAAE,CAAA;IAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAExD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAChD,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,6BAA6B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC3G,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAEtH,mFAAmF;IAEnF,IAAI,cAAc,GAA4B,EAAE,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;QACzD,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,MAAM,aAAa,GAAI,cAAc,CAAC,KAAiC,IAAI,EAAE,CAAA;IAC7E,MAAM,kBAAkB,GAAI,aAAa,CAAC,UAAwB,IAAI,EAAE,CAAA;IAExE,uEAAuE;IACvE,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;IAC5D,MAAM,UAAU,GAAG,QAAQ,cAAc,EAAE,CAAA;IAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,CAAC,GAAG,KAAgC,CAAA;QAC1C,+DAA+D;QAC/D,MAAM,UAAU,GAAI,CAAC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC/C,OAAO,CAAC,UAAU,CAAC,KAAK,CACtB,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAC7G,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO;QACP,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;KAClD,CAAC,CAAC,CAAA;IAEH,MAAM,YAAY,GAAG;QACnB,GAAG,cAAc;QACjB,KAAK,EAAE;YACL,GAAG,aAAa;YAChB,UAAU,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,oBAAoB,CAAC;SACtD;KACF,CAAA;IAED,MAAM,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAAA;IACpD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACpF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;IAE7C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,iBAAiB,EAAE,EACpE,sDAAsD,CACvD,CAAA;AACH,CAAC"}

package/dist/harness/clineHooks.d.ts

@@ -0,0 +1,23 @@
+/**
+ * clineHooks.ts — Cline PreToolUse governance hook injection.
+ *
+ * Writes .cline/hooks/hooks.json and the Intutic pre-tool-check
+ * script into the workspace. Cline's hook system accepts JSON on stdin
+ * and blocks execution when the script returns {"cancel": true}.
+ *
+ * NOTE: Hooks are placed in .cline/hooks/ (NOT .clinerules/hooks/) to avoid
+ * ENOTDIR conflict — .clinerules is written as a flat file by the CLI adapter.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+/**
+ * Write the Intutic governance hook into .cline/hooks/.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl - Intutic proxy URL for inclusion in block messages.
+ */
+export declare function writeClineHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=clineHooks.d.ts.map

package/dist/harness/clineHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clineHooks.d.ts","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAoCH;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA6Hf"}

package/dist/harness/clineHooks.js

@@ -0,0 +1,169 @@
+/**
+ * clineHooks.ts — Cline PreToolUse governance hook injection.
+ *
+ * Writes .cline/hooks/hooks.json and the Intutic pre-tool-check
+ * script into the workspace. Cline's hook system accepts JSON on stdin
+ * and blocks execution when the script returns {"cancel": true}.
+ *
+ * NOTE: Hooks are placed in .cline/hooks/ (NOT .clinerules/hooks/) to avoid
+ * ENOTDIR conflict — .clinerules is written as a flat file by the CLI adapter.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-cline-hooks');
+/** Tools Cline can invoke that require governance interception. */
+const GOVERNED_TOOLS = [
+    'execute_command',
+    'write_to_file',
+    'str_replace_based_edit_tool',
+    'replace_in_file',
+    'create_file',
+    'delete_file',
+    'rename_file',
+    'read_file', // watch for exfiltration patterns
+];
+/**
+ * Governance-sensitive paths that must never be agent-modified.
+ * Mirrors the protected path list in claudeCodeHooks.ts.
+ */
+const PROTECTED_PATH_FRAGMENTS = [
+    '.cline/hooks',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.claude/settings.json',
+    '.cursor/hooks.json',
+    '.codeium/windsurf/hooks.json',
+    '.agents/plugins/intutic-governance',
+    '.openhands/hooks.json',
+];
+/**
+ * Write the Intutic governance hook into .cline/hooks/.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl - Intutic proxy URL for inclusion in block messages.
+ */
+export async function writeClineHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    const hooksDir = path.join(workspaceRoot, '.cline', 'hooks');
+    const hooksJsonPath = path.join(hooksDir, 'hooks.json');
+    const checkScriptPath = path.join(hooksDir, 'intutic-check.js');
+    await fs.mkdir(hooksDir, { recursive: true });
+    // ── hooks.json ──────────────────────────────────────────────────────
+    // Cline reads this file and runs matched hook scripts before tool execution.
+    // The matcher regex is matched against the tool name.
+    const hooksConfig = {
+        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        hooks: GOVERNED_TOOLS.map((tool) => ({
+            type: 'PreToolUse',
+            matcher: `^${tool}$`,
+            command: `node ${checkScriptPath}`,
+        })),
+    };
+    const tmpJson = hooksJsonPath + '.intutic-tmp';
+    await fs.writeFile(tmpJson, JSON.stringify(hooksConfig, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpJson, hooksJsonPath);
+    // ── pre-tool-check script ────────────────────────────────────────────
+    // Cline passes tool_name + tool_input as JSON on stdin.
+    // Return {"cancel": false} to allow, {"cancel": true, "errorMessage": "..."} to block.
+    const checkScript = `#!/usr/bin/env node
+/**
+ * Intutic Cline PreToolUse governance gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+const HOOK_EVENTS_LOG = path.join(os.homedir(), '.intutic', 'events', 'cline-hook-events.jsonl');
+
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({ event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed', toolName, reason: reason || '', workspaceId: _intuticWsId, harnessType: 'cline', timestamp: ts, incidentId }) + '\\n';
+    try { fs.appendFileSync(HOOK_EVENTS_LOG, entry, { flag: 'a' }); } catch {}
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => {});
+        req.write(body); req.end();
+      } catch {}
+    }
+  } catch {}
+}
+
+const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATH_FRAGMENTS)};
+
+let raw = '';
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(raw);
+    const tool = (ctx.tool_name || '').toLowerCase();
+    const input = ctx.tool_input || {};
+    const inputStr = JSON.stringify(input);
+
+    // Protected-path guard: block any write/edit/delete targeting governance files
+    const targetPath = input.path || input.file_path || input.target || input.source || '';
+    if (['write_to_file','str_replace_based_edit_tool','replace_in_file','create_file','delete_file','rename_file'].includes(tool)) {
+      for (const p of PROTECTED_PATHS) {
+        if (String(targetPath).includes(p)) {
+          logEvent('blocked', tool, 'Blocked: attempt to modify governance-protected path "' + targetPath + '"');
+          process.stdout.write(JSON.stringify({
+            cancel: true,
+            errorMessage: '[Intutic Governance] Blocked: attempt to modify governance-protected path "' + targetPath + '". Update policy via the Intutic control plane.',
+          }));
+          process.exit(0);
+        }
+      }
+    }
+
+    // Allow all other tool calls
+    logEvent('allowed', tool || 'unknown', '');
+    process.stdout.write(JSON.stringify({ cancel: false }));
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED — hook parse error blocks the tool call
+    logEvent('blocked', 'unknown', String(err));
+    process.stdout.write(JSON.stringify({
+      cancel: true,
+      errorMessage: '[Intutic Governance] Hook error (fail-closed): ' + String(err),
+    }));
+    process.exit(0);
+  }
+});
+`;
+    const tmpScript = checkScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, checkScript, 'utf-8');
+    await fs.rename(tmpScript, checkScriptPath);
+    await fs.chmod(checkScriptPath, 0o755);
+    log.info({ action: 'cline_hooks_written', hooksDir, toolCount: GOVERNED_TOOLS.length }, 'Cline governance hooks written');
+}
+//# sourceMappingURL=clineHooks.js.map

package/dist/harness/clineHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clineHooks.js","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,iBAAiB;IACjB,eAAe;IACf,6BAA6B;IAC7B,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW,EAAG,kCAAkC;CACjD,CAAA;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAC/B,cAAc;IACd,gBAAgB;IAChB,yBAAyB;IACzB,uBAAuB;IACvB,oBAAoB;IACpB,8BAA8B;IAC9B,oCAAoC;IACpC,uBAAuB;CACxB,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IAE/D,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,uEAAuE;IACvE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,IAAI,GAAG;YACpB,OAAO,EAAE,QAAQ,eAAe,EAAE;SACnC,CAAC,CAAC;KACJ,CAAA;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACjF,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAEvC,wEAAwE;IACxE,wDAAwD;IACxD,uFAAuF;IACvF,MAAM,WAAW,GAAG;;;;YAIV,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;;;gFAUwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAgCjF,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCjE,CAAA;IAEC,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAA;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAEtC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,EAC7E,gCAAgC,CACjC,CAAA;AACH,CAAC"}

package/dist/harness/continueHooks.d.ts

@@ -0,0 +1,33 @@
+/**
+ * continueHooks.ts — Continue.dev governance via proxy routing.
+ *
+ * Continue.dev has no native hook system. Governance is applied by routing
+ * all model API calls through the Intutic proxy: each model's `apiBase`
+ * field is set to `proxyUrl` in `~/.continue/config.json`.
+ *
+ * JSONC handling: ~/.continue/config.json allows `// comments`. We strip
+ * single-line comments with a regex before parsing, then write back as
+ * standard JSON with a managed-file header comment.
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Configure Continue.dev to route all model API calls through the Intutic proxy.
+ *
+ *  1. Reads `~/.continue/config.json` (JSONC — strips // comments before parsing).
+ *  2. Sets `apiBase = proxyUrl` on each model that doesn't already use it.
+ *  3. Adds a `customInstructions` governance notice.
+ *  4. Writes the merged result back atomically.
+ *  5. Writes `.intutic/env/continue.env` with the proxy URL.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL to set as model apiBase.
+ * @param workspaceId   - Workspace ID stored in the env snippet.
+ */
+export declare function writeContinueHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=continueHooks.d.ts.map

package/dist/harness/continueHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continueHooks.d.ts","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAmCH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAqFf"}

package/dist/harness/continueHooks.js

@@ -0,0 +1,124 @@
+/**
+ * continueHooks.ts — Continue.dev governance via proxy routing.
+ *
+ * Continue.dev has no native hook system. Governance is applied by routing
+ * all model API calls through the Intutic proxy: each model's `apiBase`
+ * field is set to `proxyUrl` in `~/.continue/config.json`.
+ *
+ * JSONC handling: ~/.continue/config.json allows `// comments`. We strip
+ * single-line comments with a regex before parsing, then write back as
+ * standard JSON with a managed-file header comment.
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-continue-hooks');
+/** Default path to the Continue.dev global config file. */
+const CONTINUE_CONFIG_PATH = path.join(os.homedir(), '.continue', 'config.json');
+/** Governance notice injected into customInstructions. */
+const GOVERNANCE_NOTICE = [
+    'This workspace is governed by Intutic SOP policies.',
+    'All LLM API requests are routed through the Intutic governance proxy.',
+    'Do not remove or override the apiBase field in this configuration.',
+].join(' ');
+// ─── JSONC comment stripper ───────────────────────────────────────────────────
+/**
+ * Strip single-line `// ...` comments from a JSONC string so it can be
+ * parsed by JSON.parse. Block comments (`/* ... *\/`) are not stripped
+ * because they are uncommon in Continue config files.
+ */
+function stripJsoncComments(raw) {
+    // Remove // comments that are not inside strings.
+    // Simple approach: replace // up to end-of-line (acceptable for Continue config).
+    return raw.replace(/\/\/[^\n]*/g, '');
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Configure Continue.dev to route all model API calls through the Intutic proxy.
+ *
+ *  1. Reads `~/.continue/config.json` (JSONC — strips // comments before parsing).
+ *  2. Sets `apiBase = proxyUrl` on each model that doesn't already use it.
+ *  3. Adds a `customInstructions` governance notice.
+ *  4. Writes the merged result back atomically.
+ *  5. Writes `.intutic/env/continue.env` with the proxy URL.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL to set as model apiBase.
+ * @param workspaceId   - Workspace ID stored in the env snippet.
+ */
+export async function writeContinueHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    // ── 1. Ensure directories ──────────────────────────────────────────────────
+    const continueDir = path.join(os.homedir(), '.continue');
+    const envDir = path.join(workspaceRoot, '.intutic', 'env');
+    await Promise.all([
+        fs.mkdir(continueDir, { recursive: true }),
+        fs.mkdir(envDir, { recursive: true }),
+    ]);
+    // ── 2. Read and parse ~/.continue/config.json ─────────────────────────────
+    let configObj = {};
+    try {
+        const raw = await fs.readFile(CONTINUE_CONFIG_PATH, 'utf-8');
+        const stripped = stripJsoncComments(raw);
+        configObj = JSON.parse(stripped);
+    }
+    catch {
+        // File doesn't exist or is malformed — start with empty config
+        log.warn({ action: 'continue_config_read_failed', path: CONTINUE_CONFIG_PATH }, 'Could not read ~/.continue/config.json — creating fresh');
+    }
+    // ── 3. Update model apiBase fields ────────────────────────────────────────
+    const models = Array.isArray(configObj.models) ? configObj.models : [];
+    let modifiedCount = 0;
+    const updatedModels = models.map((model) => {
+        if (typeof model !== 'object' || model === null)
+            return model;
+        const m = model;
+        if (m.apiBase === proxyUrl)
+            return m; // Already set — no-op
+        modifiedCount++;
+        return { ...m, apiBase: proxyUrl };
+    });
+    // ── 4. Build merged config ────────────────────────────────────────────────
+    const mergedConfig = {
+        ...configObj,
+        // Re-attach updated models array (or keep original if empty)
+        ...(models.length > 0 ? { models: updatedModels } : {}),
+        // Add/overwrite customInstructions with governance notice
+        customInstructions: GOVERNANCE_NOTICE,
+        // Metadata fields
+        _intutic_managed: true,
+        _intutic_last_sync: newIso(),
+        _intutic_workspace_id: workspaceId,
+    };
+    // ── 5. Write back atomically ──────────────────────────────────────────────
+    // Prepend a managed-file warning as a comment (will be lost on next read —
+    // that's acceptable; we re-add it on each sync).
+    const managedHeader = `// AUTO-MANAGED by Intutic sync-daemon. Last sync: ${newIso()}\n// Do not edit apiBase fields — they are governance proxy routes.\n`;
+    const serialized = managedHeader + JSON.stringify(mergedConfig, null, 2) + '\n';
+    const tmpConfig = CONTINUE_CONFIG_PATH + '.intutic-tmp';
+    await fs.writeFile(tmpConfig, serialized, 'utf-8');
+    await fs.rename(tmpConfig, CONTINUE_CONFIG_PATH);
+    log.info({ action: 'continue_config_written', path: CONTINUE_CONFIG_PATH, modifiedModels: modifiedCount }, 'Continue.dev config patched with Intutic proxy apiBase');
+    // ── 6. Write .intutic/env/continue.env ────────────────────────────────────
+    const envContent = [
+        `# Intutic Continue.dev governance env — auto-generated ${newIso()}`,
+        `# This file is managed by the Intutic sync-daemon. DO NOT EDIT.`,
+        `CONTINUE_PROXY_URL=${proxyUrl}`,
+        workspaceId ? `INTUTIC_WORKSPACE_ID=${workspaceId}` : '',
+        `# All Continue.dev model requests are routed through CONTINUE_PROXY_URL.`,
+    ].filter((l) => l !== '').join('\n') + '\n';
+    const envFilePath = path.join(envDir, 'continue.env');
+    const tmpEnv = envFilePath + '.intutic-tmp';
+    await fs.writeFile(tmpEnv, envContent, 'utf-8');
+    await fs.rename(tmpEnv, envFilePath);
+    log.info({ action: 'continue_env_written', path: envFilePath }, 'Continue.dev env snippet written');
+}
+//# sourceMappingURL=continueHooks.js.map

package/dist/harness/continueHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continueHooks.js","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AAEhF,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG;IACxB,qDAAqD;IACrD,uEAAuE;IACvE,oEAAoE;CACrE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEX,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,kDAAkD;IAClD,kFAAkF;IAClF,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAE1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC1C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACtC,CAAC,CAAA;IAEF,6EAA6E;IAE7E,IAAI,SAAS,GAA4B,EAAE,CAAA;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACxC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,yDAAyD,CAAC,CAAA;IAC5I,CAAC;IAED,6EAA6E;IAE7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACtE,IAAI,aAAa,GAAG,CAAC,CAAA;IAErB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;QAC1C,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA,CAAC,sBAAsB;QAC3D,aAAa,EAAE,CAAA;QACf,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,YAAY,GAA4B;QAC5C,GAAG,SAAS;QACZ,6DAA6D;QAC7D,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,0DAA0D;QAC1D,kBAAkB,EAAE,iBAAiB;QACrC,kBAAkB;QAClB,gBAAgB,EAAE,IAAI;QACtB,kBAAkB,EAAE,MAAM,EAAE;QAC5B,qBAAqB,EAAE,WAAW;KACnC,CAAA;IAED,6EAA6E;IAE7E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,aAAa,GAAG,sDAAsD,MAAM,EAAE,uEAAuE,CAAA;IAC3J,MAAM,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAE/E,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAA;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAA;IAEhD,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,EAChG,wDAAwD,CACzD,CAAA;IAED,6EAA6E;IAE7E,MAAM,UAAU,GAAG;QACjB,0DAA0D,MAAM,EAAE,EAAE;QACpE,iEAAiE;QACjE,sBAAsB,QAAQ,EAAE;QAChC,WAAW,CAAC,CAAC,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;QACxD,0EAA0E;KAC3E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,EACrD,kCAAkC,CACnC,CAAA;AACH,CAAC"}