@intutic/sync-daemon 1.6.0

package/dist/harness/cursorHooks.d.ts

@@ -0,0 +1,27 @@
+/**
+ * cursorHooks.ts — Cursor beforeShellExecution/beforeMCPExecution hook injection.
+ *
+ * Writes hooks.json at THREE levels per enterprise-readiness requirement:
+ *   1. Project-level:  <workspaceRoot>/.cursor/hooks.json
+ *   2. User-level:     ~/.cursor/hooks.json
+ *   3. System-level:   /etc/cursor/hooks.json (Linux) — written only by system administrators
+ *
+ * All three levels use failClosed: true so that if the governance script
+ * fails or is missing the tool call is blocked, not allowed.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+/**
+ * Write Cursor hooks at user-level and project-level.
+ * System-level (/etc/cursor) is handled by the corporate policy installer.
+ *
+ * @param workspaceRoot    - Absolute workspace root.
+ * @param proxyUrl         - Intutic proxy URL.
+ * @param workspaceId      - Workspace ID embedded in hook event payloads.
+ * @param writeSystemLevel - If true, also attempt /etc/cursor (requires root).
+ */
+export declare function writeCursorHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string, writeSystemLevel?: boolean): Promise<void>;
+//# sourceMappingURL=cursorHooks.d.ts.map

package/dist/harness/cursorHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursorHooks.d.ts","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqKH;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,EAChB,gBAAgB,UAAQ,GACvB,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/harness/cursorHooks.js

@@ -0,0 +1,221 @@
+/**
+ * cursorHooks.ts — Cursor beforeShellExecution/beforeMCPExecution hook injection.
+ *
+ * Writes hooks.json at THREE levels per enterprise-readiness requirement:
+ *   1. Project-level:  <workspaceRoot>/.cursor/hooks.json
+ *   2. User-level:     ~/.cursor/hooks.json
+ *   3. System-level:   /etc/cursor/hooks.json (Linux) — written only by system administrators
+ *
+ * All three levels use failClosed: true so that if the governance script
+ * fails or is missing the tool call is blocked, not allowed.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-cursor-hooks');
+/** Hook events Cursor fires before execution. */
+const HOOK_EVENTS = [
+    'beforeShellExecution',
+    'beforeMCPExecution',
+    'beforeFileEdit',
+];
+/**
+ * Build a Cursor hooks.json config object.
+ *
+ * @param hookScriptPath - Absolute path to the pre-tool-check script.
+ */
+function buildHooksConfig(hookScriptPath) {
+    return {
+        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        failClosed: true,
+        hooks: Object.fromEntries(HOOK_EVENTS.map((event) => [
+            event,
+            {
+                command: `node "${hookScriptPath}"`,
+                failClosed: true,
+            },
+        ])),
+    };
+}
+/**
+ * Governance-sensitive paths — mirrors the list in claudeCodeHooks.ts.
+ * Any write/edit targeting these paths is blocked.
+ */
+const PROTECTED_PATHS = [
+    '.cursor/hooks.json',
+    '.claude/settings.json',
+    '.cline/hooks',
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.codeium/windsurf/hooks.json',
+    '.agents/plugins/intutic-governance',
+    '.openhands/hooks.json',
+];
+/**
+ * The pre-tool-check.js script content — receives JSON context from Cursor
+ * on stdin, exits 0 to allow or exits 2 to block.
+ */
+function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    return `#!/usr/bin/env node
+/**
+ * Intutic Cursor governance gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+const PROTECTED_PATHS = ${JSON.stringify(PROTECTED_PATHS)};
+
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      event: verdict === 'blocked' ? 'tool_blocked' : 'tool_allowed',
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'cursor',
+      timestamp: ts,
+      incidentId,
+    }) + '\\n';
+    fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+let raw = '';
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(raw);
+    const event = (ctx.event || '').toLowerCase();
+    const input = ctx.input || ctx.tool_input || ctx;
+
+    // For file edits: check target path
+    const targetPath = input.path || input.file || input.target || '';
+    if (event === 'beforefileedit' || (input.path && input.path.length > 0)) {
+      for (const p of PROTECTED_PATHS) {
+        if (String(targetPath).includes(p)) {
+          const reason = 'Attempt to modify governance-protected path "' + targetPath + '"';
+          process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
+          logEvent('blocked', 'edit', reason);
+          process.exit(2);
+        }
+      }
+    }
+
+    // Shell execution: scan command for dangerous patterns
+    const command = input.command || input.cmd || '';
+    const dangerPatterns = [
+      /chmod\\s+[0-9]*7[0-9]*\\s+.*hooks/,  // chmod on hook files
+      /chattr\\s+-i\\s+/,                    // remove immutable flag
+      /chflags\\s+nouchg/,                   // macOS remove uchg
+    ];
+    for (const pat of dangerPatterns) {
+      if (pat.test(command)) {
+        const reason = 'Command matches governance bypass pattern: "' + command + '"';
+        process.stderr.write('[Intutic Governance] BLOCKED: ' + reason + '\\n');
+        logEvent('blocked', 'bash', reason);
+        process.exit(2);
+      }
+    }
+
+    // Allow
+    logEvent('allowed', event || 'tool', '');
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED
+    const errMsg = String(err);
+    process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
+    logEvent('blocked', 'unknown', errMsg);
+    process.exit(2);
+  }
+});
+`;
+}
+/**
+ * Write Cursor hooks at user-level and project-level.
+ * System-level (/etc/cursor) is handled by the corporate policy installer.
+ *
+ * @param workspaceRoot    - Absolute workspace root.
+ * @param proxyUrl         - Intutic proxy URL.
+ * @param workspaceId      - Workspace ID embedded in hook event payloads.
+ * @param writeSystemLevel - If true, also attempt /etc/cursor (requires root).
+ */
+export async function writeCursorHooks(workspaceRoot, proxyUrl, workspaceId = '', writeSystemLevel = false) {
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    await fs.mkdir(hookScriptDir, { recursive: true });
+    // Ensure hook events log directory exists
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    const hookScriptPath = path.join(hookScriptDir, 'pre-tool-check.js');
+    // Write the hook script
+    const tmpScript = hookScriptPath + '.cursor-tmp';
+    await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    const config = buildHooksConfig(hookScriptPath);
+    // 1. Project-level: .cursor/hooks.json
+    const projectCursorDir = path.join(workspaceRoot, '.cursor');
+    await fs.mkdir(projectCursorDir, { recursive: true });
+    await atomicWriteJson(path.join(projectCursorDir, 'hooks.json'), config);
+    log.info({ action: 'cursor_hooks_written', level: 'project', path: projectCursorDir }, 'Cursor project-level hooks written');
+    // 2. User-level: ~/.cursor/hooks.json
+    const userCursorDir = path.join(os.homedir(), '.cursor');
+    await fs.mkdir(userCursorDir, { recursive: true });
+    await atomicWriteJson(path.join(userCursorDir, 'hooks.json'), config);
+    log.info({ action: 'cursor_hooks_written', level: 'user', path: userCursorDir }, 'Cursor user-level hooks written');
+    // 3. System-level: /etc/cursor/hooks.json (system administrator installation only)
+    if (writeSystemLevel) {
+        const systemCursorDir = '/etc/cursor';
+        try {
+            await fs.mkdir(systemCursorDir, { recursive: true });
+            await atomicWriteJson(path.join(systemCursorDir, 'hooks.json'), config);
+            log.info({ action: 'cursor_hooks_written', level: 'system', path: systemCursorDir }, 'Cursor system-level hooks written');
+        }
+        catch (err) {
+            log.error({ action: 'cursor_system_hooks_failed', err }, 'System-level Cursor hooks require root — skipping');
+        }
+    }
+}
+async function atomicWriteJson(filePath, data) {
+    const tmp = filePath + '.intutic-tmp';
+    await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmp, filePath);
+}
+//# sourceMappingURL=cursorHooks.js.map

package/dist/harness/cursorHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursorHooks.js","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,iDAAiD;AACjD,MAAM,WAAW,GAAG;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;CACR,CAAA;AAEV;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,cAAsB;IAC9C,OAAO;QACL,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,KAAK;YACL;gBACE,OAAO,EAAE,SAAS,cAAc,GAAG;gBACnC,UAAU,EAAE,IAAI;aACjB;SACF,CAAC,CACH;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,cAAc;IACd,gBAAgB;IAChB,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,uBAAuB;CACxB,CAAA;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;;;gFAUwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;0BAWjF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;wBAcjC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DpD,CAAA;AACD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE,EAChB,gBAAgB,GAAG,KAAK;IAExB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEpE,wBAAwB;IACxB,MAAM,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;IAChD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAE/C,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACxE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAE5H,sCAAsC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACxD,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;IACrE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEnH,mFAAmF;IACnF,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,eAAe,GAAG,aAAa,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACpD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;QAC3H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAA;QAC/G,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}

package/dist/harness/cursorHooksJson.d.ts

@@ -0,0 +1,29 @@
+/**
+ * cursorHooksJson.ts — Cursor native hooks.json writer (v1.7+ hook API).
+ *
+ * Writes Cursor's native hooks.json at two levels:
+ *   1. User-level:    ~/.cursor/hooks.json
+ *   2. Project-level: <workspaceRoot>/.cursor/hooks.json
+ *
+ * The hook command references the shared pre-tool-check.js script installed
+ * by WS-4A. On beforeMCPExecution and beforeShellExecution events, Cursor
+ * invokes this script with the tool context on stdin; exit 0 allows,
+ * exit 2 blocks (fail-closed).
+ *
+ * Deep-merges into any existing hooks.json so other hooks are preserved.
+ *
+ * LLD #14 — Phase 4 WS-4C native hook script writers
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write Cursor native hooks.json at user-level and project-level.
+ *
+ * The hook command (`node ~/.intutic/hooks/pre-tool-check.js`) is installed
+ * by WS-4A; this writer only registers it in hooks.json.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ */
+export declare function writeCursorHooksJson(workspaceRoot: string): Promise<void>;
+//# sourceMappingURL=cursorHooksJson.d.ts.map

package/dist/harness/cursorHooksJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursorHooksJson.d.ts","sourceRoot":"","sources":["../../src/harness/cursorHooksJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA+GH;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/E"}

package/dist/harness/cursorHooksJson.js

@@ -0,0 +1,130 @@
+/**
+ * cursorHooksJson.ts — Cursor native hooks.json writer (v1.7+ hook API).
+ *
+ * Writes Cursor's native hooks.json at two levels:
+ *   1. User-level:    ~/.cursor/hooks.json
+ *   2. Project-level: <workspaceRoot>/.cursor/hooks.json
+ *
+ * The hook command references the shared pre-tool-check.js script installed
+ * by WS-4A. On beforeMCPExecution and beforeShellExecution events, Cursor
+ * invokes this script with the tool context on stdin; exit 0 allows,
+ * exit 2 blocks (fail-closed).
+ *
+ * Deep-merges into any existing hooks.json so other hooks are preserved.
+ *
+ * LLD #14 — Phase 4 WS-4C native hook script writers
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import * as node_os from 'node:os';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-cursor-hooks-json');
+/** Absolute path to the shared pre-tool-check.js installed by WS-4A. */
+const HOOK_SCRIPT = node_path.join(node_os.homedir(), '.intutic', 'hooks', 'pre-tool-check.js');
+/** Hook events covered by this writer (Cursor v1.7+ API). */
+const HOOK_EVENTS = ['beforeMCPExecution', 'beforeShellExecution'];
+/**
+ * Build the Intutic hook entry for a given event.
+ *
+ * @param hookScriptPath - Absolute path to the pre-tool-check.js script.
+ */
+function buildHookEntry(hookScriptPath) {
+    return { command: `node ${hookScriptPath}` };
+}
+/**
+ * Read and parse an existing hooks.json, returning a default document if
+ * the file does not exist or is not valid JSON.
+ */
+async function readExistingHooksJson(filePath) {
+    try {
+        const raw = await node_fs.readFile(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed !== null &&
+            typeof parsed === 'object' &&
+            !Array.isArray(parsed) &&
+            'hooks' in parsed &&
+            typeof parsed.hooks === 'object') {
+            return parsed;
+        }
+    }
+    catch {
+        // File absent or malformed — start from scratch
+    }
+    return { version: 1, hooks: {} };
+}
+/**
+ * Deep-merge our Intutic hook entries into an existing hooks map.
+ *
+ * For each covered event, we append our entry if a hook with the same
+ * command is not already present, preserving all other hooks.
+ *
+ * @param existing - The existing hooks map (mutated in place).
+ * @param hookScriptPath - Absolute path to the governance hook script.
+ * @returns The merged hooks map.
+ */
+function mergeHooks(existing, hookScriptPath) {
+    const entry = buildHookEntry(hookScriptPath);
+    for (const event of HOOK_EVENTS) {
+        const current = Array.isArray(existing[event])
+            ? existing[event]
+            : [];
+        const alreadyPresent = current.some((h) => h.command === entry.command);
+        if (!alreadyPresent) {
+            existing[event] = [...current, entry];
+        }
+        else {
+            existing[event] = current;
+        }
+    }
+    return existing;
+}
+/**
+ * Write hooks.json atomically (tmp → rename) to the given path,
+ * deep-merging our entries into any existing configuration.
+ *
+ * @param filePath - Absolute path to the hooks.json to write.
+ * @param hookScriptPath - Absolute path to the governance hook script.
+ * @param level - Human-readable label for log context.
+ */
+async function writeHooksJson(filePath, hookScriptPath, level) {
+    await node_fs.mkdir(node_path.dirname(filePath), { recursive: true });
+    const doc = await readExistingHooksJson(filePath);
+    doc.version = 1;
+    doc.hooks = mergeHooks(doc.hooks, hookScriptPath);
+    const tmp = filePath + '.intutic-tmp';
+    await node_fs.writeFile(tmp, JSON.stringify(doc, null, 2) + '\n', 'utf-8');
+    await node_fs.rename(tmp, filePath);
+    log.info({ action: 'cursor_hooks_json_written', level, path: filePath }, `Cursor hooks.json written (${level})`);
+}
+/**
+ * Write Cursor native hooks.json at user-level and project-level.
+ *
+ * The hook command (`node ~/.intutic/hooks/pre-tool-check.js`) is installed
+ * by WS-4A; this writer only registers it in hooks.json.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ */
+export async function writeCursorHooksJson(workspaceRoot) {
+    // 1. User-level: ~/.cursor/hooks.json
+    //
+    // GUARD (bugfix): never touch the user's real global Cursor config from a
+    // test run — the same failure already fixed for ~/.claude in
+    // claudeCodeHooks.ts. Vitest sets VITEST=1; without this guard every run of
+    // the sync-daemon suite rewrote the developer's real ~/.cursor/hooks.json
+    // and pointed it at a temp dir the test then deleted, leaving a dead hook.
+    // INTUTIC_SKIP_GLOBAL_HOOKS=1 is an explicit opt-out for dev machines.
+    if (process.env['VITEST'] || process.env['INTUTIC_SKIP_GLOBAL_HOOKS']) {
+        log.info({ action: 'cursor_user_hooks_skipped' }, 'Skipping global ~/.cursor/hooks.json write (test or opt-out environment)');
+    }
+    else {
+        const userHooksPath = node_path.join(node_os.homedir(), '.cursor', 'hooks.json');
+        await writeHooksJson(userHooksPath, HOOK_SCRIPT, 'user');
+    }
+    // 2. Project-level: <workspaceRoot>/.cursor/hooks.json
+    const projectHooksPath = node_path.join(workspaceRoot, '.cursor', 'hooks.json');
+    await writeHooksJson(projectHooksPath, HOOK_SCRIPT, 'project');
+}
+//# sourceMappingURL=cursorHooksJson.js.map

package/dist/harness/cursorHooksJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursorHooksJson.js","sourceRoot":"","sources":["../../src/harness/cursorHooksJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAElD,wEAAwE;AACxE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAA;AAE/F,6DAA6D;AAC7D,MAAM,WAAW,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAU,CAAA;AAY3E;;;;GAIG;AACH,SAAS,cAAc,CAAC,cAAsB;IAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,cAAc,EAAE,EAAE,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,OAAO,IAAI,MAAM;YACjB,OAAQ,MAAkC,CAAC,KAAK,KAAK,QAAQ,EAC7D,CAAC;YACD,OAAO,MAAyB,CAAA;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,QAAwB,EAAE,cAAsB;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;IAE5C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAA+B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAgC;YACjD,CAAC,CAAC,EAAE,CAAA;QAEN,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAA;QACvE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,CAAC,GAAG,OAAO,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,cAAsB,EAAE,KAAa;IACnF,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAErE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IACjD,GAAG,CAAC,OAAO,GAAG,CAAC,CAAA;IACf,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAC1E,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAEnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC9D,8BAA8B,KAAK,GAAG,CACvC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,6DAA6D;IAC7D,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,2BAA2B,EAAE,EACvC,0EAA0E,CAC3E,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QAChF,MAAM,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IAED,uDAAuD;IACvD,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;IAC/E,MAAM,cAAc,CAAC,gBAAgB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AAChE,CAAC"}

package/dist/harness/gooseHardener.d.ts

@@ -0,0 +1,39 @@
+/**
+ * gooseHardener.ts — Cross-platform immutable flag management for Goose plugin files.
+ *
+ * After the Goose governance plugin is written, this module applies:
+ *   1. chmod 444 — no write for owner, group, or others
+ *   2. OS-level immutable flag:
+ *        macOS: chflags uchg (user immutable, does not require root)
+ *        Linux: chattr +i (requires root; graceful fallback on permission error)
+ *
+ * The drift watcher checks for immutable status before auto-restoring.
+ * If a file is immutable but has been tampered with, a governance_override_attempt
+ * incident is emitted to the control plane instead of a silent restore.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+/**
+ * Apply chmod 444 and OS immutable flags to all files in the
+ * Goose governance plugin directory.
+ *
+ * @param pluginDir - Absolute path to the plugin directory
+ *                    (e.g. ~/.agents/plugins/intutic-governance)
+ */
+export declare function hardenGoosePlugin(pluginDir: string): Promise<void>;
+/**
+ * Remove immutable flags from a file (needed before sync daemon can overwrite
+ * during a legitimate governance refresh).
+ *
+ * @param filePath - Absolute path to the file
+ */
+export declare function unharden(filePath: string): Promise<void>;
+/**
+ * Check whether a file has an OS immutable flag set.
+ * Used by the drift watcher to decide whether to restore or emit an incident.
+ */
+export declare function isImmutable(filePath: string): Promise<boolean>;
+//# sourceMappingURL=gooseHardener.d.ts.map

package/dist/harness/gooseHardener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gooseHardener.d.ts","sourceRoot":"","sources":["../../src/harness/gooseHardener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBxE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB9D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBpE"}

package/dist/harness/gooseHardener.js

@@ -0,0 +1,152 @@
+/**
+ * gooseHardener.ts — Cross-platform immutable flag management for Goose plugin files.
+ *
+ * After the Goose governance plugin is written, this module applies:
+ *   1. chmod 444 — no write for owner, group, or others
+ *   2. OS-level immutable flag:
+ *        macOS: chflags uchg (user immutable, does not require root)
+ *        Linux: chattr +i (requires root; graceful fallback on permission error)
+ *
+ * The drift watcher checks for immutable status before auto-restoring.
+ * If a file is immutable but has been tampered with, a governance_override_attempt
+ * incident is emitted to the control plane instead of a silent restore.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-goose-hardener');
+const execFileAsync = promisify(execFile);
+/**
+ * Apply chmod 444 and OS immutable flags to all files in the
+ * Goose governance plugin directory.
+ *
+ * @param pluginDir - Absolute path to the plugin directory
+ *                    (e.g. ~/.agents/plugins/intutic-governance)
+ */
+export async function hardenGoosePlugin(pluginDir) {
+    const targets = [
+        path.join(pluginDir, 'hooks', 'hooks.json'),
+        path.join(pluginDir, 'scripts', 'intutic-check.sh'),
+    ];
+    for (const target of targets) {
+        try {
+            await fs.access(target);
+        }
+        catch {
+            log.warn({ action: 'harden_skip', target }, 'Goose plugin file not found — skipping hardening');
+            continue;
+        }
+        // Step 1: chmod 444
+        try {
+            await fs.chmod(target, 0o444);
+            log.debug({ action: 'chmod_444', target }, 'chmod 444 applied');
+        }
+        catch (err) {
+            log.error({ action: 'chmod_failed', target, err }, 'chmod 444 failed');
+        }
+        // Step 2: OS immutable flag
+        await applyImmutableFlag(target);
+    }
+}
+/**
+ * Remove immutable flags from a file (needed before sync daemon can overwrite
+ * during a legitimate governance refresh).
+ *
+ * @param filePath - Absolute path to the file
+ */
+export async function unharden(filePath) {
+    if (process.platform === 'darwin') {
+        try {
+            await execFileAsync('chflags', ['nouchg', filePath]);
+            log.debug({ action: 'chflags_nouchg', filePath }, 'Removed macOS uchg flag');
+        }
+        catch (err) {
+            log.warn({ action: 'chflags_nouchg_failed', filePath, err }, 'chflags nouchg failed');
+        }
+    }
+    else if (process.platform === 'linux') {
+        try {
+            await execFileAsync('chattr', ['-i', filePath]);
+            log.debug({ action: 'chattr_minus_i', filePath }, 'Removed Linux immutable flag');
+        }
+        catch {
+            // Best-effort — may not have root
+        }
+    }
+    // Restore writable mode temporarily
+    try {
+        await fs.chmod(filePath, 0o644);
+    }
+    catch { /* ignore */ }
+}
+/**
+ * Check whether a file has an OS immutable flag set.
+ * Used by the drift watcher to decide whether to restore or emit an incident.
+ */
+export async function isImmutable(filePath) {
+    if (process.platform === 'darwin') {
+        try {
+            const { stdout } = await execFileAsync('ls', ['-lO', filePath]);
+            return stdout.includes('uchg') || stdout.includes('uimmutable');
+        }
+        catch {
+            return false;
+        }
+    }
+    else if (process.platform === 'linux') {
+        try {
+            const { stdout } = await execFileAsync('lsattr', [filePath]);
+            return stdout.includes('-i-') || /\bi\b/.test(stdout.split(' ')[0] ?? '');
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+// ─── Internal ────────────────────────────────────────────────────────
+async function applyImmutableFlag(target) {
+    if (process.platform === 'darwin') {
+        try {
+            await execFileAsync('chflags', ['uchg', target]);
+            log.info({ action: 'chflags_uchg', target }, 'macOS uchg immutable flag applied');
+        }
+        catch (err) {
+            log.error({ action: 'chflags_uchg_failed', target, err }, 'chflags uchg failed');
+        }
+    }
+    else if (process.platform === 'linux') {
+        try {
+            await execFileAsync('chattr', ['+i', target]);
+            log.info({ action: 'chattr_plus_i', target }, 'Linux immutable flag applied');
+        }
+        catch (err) {
+            // chattr requires root on most distros; fail gracefully
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes('Operation not permitted') || msg.includes('EPERM')) {
+                log.warn({ action: 'chattr_needs_root', target }, 'chattr +i requires root — immutable flag not applied (chmod 444 still in effect)');
+            }
+            else {
+                log.error({ action: 'chattr_failed', target, err }, 'chattr +i failed unexpectedly');
+            }
+        }
+    }
+    else if (process.platform === 'win32') {
+        // Windows: SetFileAttributes READONLY via attrib
+        try {
+            await execFileAsync('attrib', ['+R', target]);
+            log.info({ action: 'attrib_readonly', target }, 'Windows read-only attribute applied');
+        }
+        catch (err) {
+            log.warn({ action: 'attrib_failed', target, err }, 'Windows attrib +R failed');
+        }
+    }
+}
+//# sourceMappingURL=gooseHardener.js.map

package/dist/harness/gooseHardener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gooseHardener.js","sourceRoot":"","sources":["../../src/harness/gooseHardener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAC/C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC;KACpD,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,kDAAkD,CAAC,CAAA;YAC/F,SAAQ;QACV,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC7B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACxE,CAAC;QAED,4BAA4B;QAC5B,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;YACpD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,oCAAoC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;YAChD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,wDAAwD;YACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC5D,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,EACvC,kFAAkF,CACnF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/harness/gooseHooks.d.ts

@@ -0,0 +1,24 @@
+/**
+ * gooseHooks.ts — Goose PreToolUse governance plugin injection.
+ *
+ * Writes the Intutic governance plugin to the Goose plugin directory:
+ *   ~/.agents/plugins/intutic-governance/hooks/hooks.json
+ *   ~/.agents/plugins/intutic-governance/scripts/intutic-check.sh
+ *
+ * Also merges the Intutic proxy URL into ~/.config/goose/config.yaml.
+ * After writing, calls gooseHardener to apply chmod 444 + immutable flags.
+ *
+ * LLD #14 — Phase 3 cross-harness defence
+ * HLD §3.14 — Three-Tier Defense Cascade
+ *
+ * @module
+ */
+/**
+ * Write Goose governance plugin and harden it.
+ *
+ * @param proxyUrl    - Intutic proxy URL written into the plugin script.
+ * @param workspaceRoot - Absolute workspace root (for hook events log path).
+ * @param workspaceId - Workspace ID embedded in hook event payloads.
+ */
+export declare function writeGooseHooks(proxyUrl: string, workspaceRoot?: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=gooseHooks.d.ts.map