@intutic/sync-daemon 1.6.0

package/dist/harness/hermesHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermesHooks.js","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAEvE,8DAA8D;AAC9D,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,uBAAuB;IACvB,oBAAoB;IACpB,8BAA8B;IAC9B,cAAc;IACd,oCAAoC;IACpC,uBAAuB;IACvB,qBAAqB;IACrB,mCAAmC;CACpC,CAAA;AAED,iFAAiF;AAEjF,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;;;WAIf,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;;;;;kBAO1C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;EAqB7C,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmClD,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;IACrD,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,eAAe;QACf,gBAAgB,cAAc,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,IAAI,MAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,cAAc;QACd,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC5B,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,sDAAsD;QACtD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,OAAO,CACvB,gBAAgB,EAChB,mCAAmC,cAAc,EAAE,CACpD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO;;;;;;;;;;;;;;;uDAe8C,QAAQ;CAC9D,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACzC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACpG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,4BAA4B,CAAC,CAAA;IAEtG,6EAA6E;IAE7E,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EACvD,gDAAgD,CACjD,CAAA;IAED,8EAA8E;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnD,iCAAiC,CAClC,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,iCAAiC;QACjC,uDAAuD;QACvD,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EACnD,4BAA4B,CAC7B,CAAA;AACH,CAAC"}

package/dist/harness/mcpAutoWrite.d.ts

@@ -0,0 +1,35 @@
+/**
+ * mcpAutoWrite.ts — Injects Intutic MCP server configurations and wraps existing
+ * MCP servers with the @intutic/mcp-governance-proxy.
+ *
+ * Injects and proxy-wraps MCP server entries in:
+ * - Claude Code:      ~/.claude/mcp.json
+ * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
+ * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
+ * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
+ * - Cline:            <workspaceRoot>/.cline/mcp.json
+ * - Windsurf:         ~/.codeium/windsurf/mcp_config.json
+ * - Continue:         ~/.continue/config.json (mcpServers section)
+ * - Goose:            ~/.config/goose/config.yaml (mcp section)
+ * - OpenHands:        <workspaceRoot>/.openhands/mcp.json
+ *
+ * Proxy-wrapping convention:
+ *   Each existing MCP server entry is rewritten so that the governance proxy
+ *   binary is the command, and the original server command is passed after `--`.
+ *   A `__intutic_wrapped: true` flag is added to prevent double-wrapping.
+ *
+ * LLD #14 — mcpAutoWrite.ts
+ * HLD §3.14 — GUI Harness Interception (MCP registration + Universal MCP Governance)
+ *
+ * @module
+ */
+/**
+ * Injects and proxy-wraps the Intutic MCP server configuration into all supported harnesses.
+ *
+ * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
+ *
+ * @param workspaceId - The workspace ID for policy lookups and event attribution.
+ * @param workspaceRoot - Absolute path to the project workspace root.
+ */
+export declare function injectMcpServer(workspaceRoot: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=mcpAutoWrite.d.ts.map

package/dist/harness/mcpAutoWrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAutoWrite.d.ts","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiYH;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBnG"}

package/dist/harness/mcpAutoWrite.js

@@ -0,0 +1,334 @@
+/**
+ * mcpAutoWrite.ts — Injects Intutic MCP server configurations and wraps existing
+ * MCP servers with the @intutic/mcp-governance-proxy.
+ *
+ * Injects and proxy-wraps MCP server entries in:
+ * - Claude Code:      ~/.claude/mcp.json
+ * - Claude Desktop:   ~/Library/Application Support/Claude/claude_desktop_config.json
+ * - Cursor (global):  ~/Library/Application Support/Cursor/User/globalSettings.json
+ * - Cursor (project): <workspaceRoot>/.cursor/mcp.json
+ * - Cline:            <workspaceRoot>/.cline/mcp.json
+ * - Windsurf:         ~/.codeium/windsurf/mcp_config.json
+ * - Continue:         ~/.continue/config.json (mcpServers section)
+ * - Goose:            ~/.config/goose/config.yaml (mcp section)
+ * - OpenHands:        <workspaceRoot>/.openhands/mcp.json
+ *
+ * Proxy-wrapping convention:
+ *   Each existing MCP server entry is rewritten so that the governance proxy
+ *   binary is the command, and the original server command is passed after `--`.
+ *   A `__intutic_wrapped: true` flag is added to prevent double-wrapping.
+ *
+ * LLD #14 — mcpAutoWrite.ts
+ * HLD §3.14 — GUI Harness Interception (MCP registration + Universal MCP Governance)
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import * as node_os from 'node:os';
+import { existsSync } from 'node:fs';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-mcp-autowrite');
+// ─── Proxy Binary Resolution ─────────────────────────────────────────────────
+/**
+ * Resolve the path to the @intutic/mcp-governance-proxy binary.
+ *
+ * Resolution order:
+ * 1. `<workspaceRoot>/node_modules/@intutic/mcp-governance-proxy/dist/index.js`
+ *    — created by pnpm after `pnpm install` (post-install production path)
+ * 2. `<workspaceRoot>/packages/mcp-proxy/dist/index.js`
+ *    — direct monorepo source path (dev without pnpm install, or if symlink is missing)
+ *
+ * Using synchronous existsSync is intentional — this runs at daemon init time
+ * (not in a hot path), and avoids async complexity in callers.
+ */
+function resolveProxyBin(workspaceRoot) {
+    const nmPath = node_path.join(workspaceRoot, 'node_modules', '@intutic', 'mcp-governance-proxy', 'dist', 'index.js');
+    if (existsSync(nmPath))
+        return nmPath;
+    // Fallback: direct monorepo package path for dev environments
+    const pkgPath = node_path.join(workspaceRoot, 'packages', 'mcp-proxy', 'dist', 'index.js');
+    return pkgPath;
+}
+// ─── Proxy Wrapping ───────────────────────────────────────────────────────────
+/**
+ * Wrap a single MCP server entry with the governance proxy.
+ * Returns the entry unmodified if it's already wrapped.
+ */
+function wrapWithProxy(entry, workspaceId, workspaceRoot) {
+    if (entry.__intutic_wrapped)
+        return entry;
+    const proxyBin = resolveProxyBin(workspaceRoot);
+    const originalArgs = entry.args ?? [];
+    return {
+        command: 'node',
+        args: [
+            proxyBin,
+            '--workspace-id', workspaceId,
+            '--',
+            entry.command,
+            ...originalArgs,
+        ],
+        env: {
+            ...(entry.env ?? {}),
+            INTUTIC_WORKSPACE_ID: workspaceId,
+        },
+        __intutic_wrapped: true,
+    };
+}
+/**
+ * Wrap all servers in an mcpServers map, preserving the `intutic` entry as-is.
+ * The `intutic` entry is the control plane MCP server — it must NOT be proxied
+ * through itself (circular dependency).
+ */
+function wrapAllServers(servers, workspaceId, workspaceRoot) {
+    const result = {};
+    for (const [name, entry] of Object.entries(servers)) {
+        if (name === 'intutic') {
+            // Never wrap the Intutic server through itself
+            result[name] = entry;
+        }
+        else {
+            result[name] = wrapWithProxy(entry, workspaceId, workspaceRoot);
+        }
+    }
+    return result;
+}
+// ─── Intutic MCP Server Entry ─────────────────────────────────────────────────
+function buildIntuticMcpEntry(workspaceRoot) {
+    return {
+        command: 'node',
+        args: [
+            resolveProxyBin(workspaceRoot),
+        ],
+        env: {
+            NODE_ENV: 'production',
+            // CRITICAL: pino must write to stderr so stdout stays pure JSON-RPC.
+            // ESM hoists imports above process.env mutations in code, so we set
+            // this in the environment before node starts rather than in index.ts.
+            PINO_DEST: 'stderr',
+        },
+    };
+}
+// ─── JSON helpers ─────────────────────────────────────────────────────────────
+async function readJsonFile(filePath, fallback) {
+    try {
+        const raw = await node_fs.readFile(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return fallback;
+    }
+}
+async function writeJsonFile(filePath, data) {
+    await node_fs.mkdir(node_path.dirname(filePath), { recursive: true });
+    await node_fs.writeFile(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+}
+// ─── Target: Claude Code ─────────────────────────────────────────────────────
+async function injectClaudeCode(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    const configPath = node_path.join(home, '.claude', 'mcp.json');
+    const current = await readJsonFile(configPath, {});
+    current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+    await writeJsonFile(configPath, current);
+    log.info({ action: 'claude_code_mcp_injected' }, 'Claude Code ~/.claude/mcp.json updated');
+}
+// ─── Target: Claude Desktop ───────────────────────────────────────────────────
+async function injectClaudeDesktop(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    let configPath;
+    if (process.platform === 'darwin') {
+        configPath = node_path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    }
+    else if (process.platform === 'win32') {
+        configPath = node_path.join(process.env['APPDATA'] ?? '', 'Claude', 'claude_desktop_config.json');
+    }
+    else {
+        configPath = node_path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
+    }
+    // Skip if Claude Desktop directory doesn't exist (not installed)
+    try {
+        await node_fs.access(node_path.dirname(configPath));
+    }
+    catch {
+        log.debug({ action: 'claude_desktop_skip' }, 'Claude Desktop not installed — skipping');
+        return;
+    }
+    const current = await readJsonFile(configPath, {});
+    current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+    await writeJsonFile(configPath, current);
+    log.info({ action: 'claude_desktop_mcp_injected' }, 'Claude Desktop config updated');
+}
+// ─── Target: Cursor (global + project) ───────────────────────────────────────
+async function injectCursor(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    // Global settings
+    let globalPath;
+    if (process.platform === 'darwin') {
+        globalPath = node_path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalSettings.json');
+    }
+    else if (process.platform === 'win32') {
+        globalPath = node_path.join(process.env['APPDATA'] ?? '', 'Cursor', 'User', 'globalSettings.json');
+    }
+    else {
+        globalPath = node_path.join(home, '.config', 'Cursor', 'User', 'globalSettings.json');
+    }
+    try {
+        await node_fs.access(node_path.dirname(globalPath));
+        const current = await readJsonFile(globalPath, {});
+        current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+        await writeJsonFile(globalPath, current);
+        log.info({ action: 'cursor_global_mcp_injected' }, 'Cursor globalSettings.json updated');
+    }
+    catch {
+        log.debug({ action: 'cursor_global_skip' }, 'Cursor not installed — skipping global settings');
+    }
+    // Project-level .cursor/mcp.json
+    const projectPath = node_path.join(workspaceRoot, '.cursor', 'mcp.json');
+    try {
+        const current = await readJsonFile(projectPath, {});
+        current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+        await writeJsonFile(projectPath, current);
+        log.info({ action: 'cursor_project_mcp_injected' }, 'Cursor .cursor/mcp.json updated');
+    }
+    catch (err) {
+        log.warn({ action: 'cursor_project_mcp_failed', err: err.message }, 'Could not update .cursor/mcp.json');
+    }
+}
+// ─── Target: Cline ────────────────────────────────────────────────────────────
+async function injectCline(workspaceId, workspaceRoot) {
+    const configPath = node_path.join(workspaceRoot, '.cline', 'mcp.json');
+    try {
+        const current = await readJsonFile(configPath, {});
+        current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+        await writeJsonFile(configPath, current);
+        log.info({ action: 'cline_mcp_injected' }, 'Cline .cline/mcp.json updated');
+    }
+    catch (err) {
+        log.debug({ action: 'cline_mcp_skip', err: err.message }, 'Cline config not found — skipping');
+    }
+}
+// ─── Target: Windsurf ─────────────────────────────────────────────────────────
+async function injectWindsurf(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    const configPath = node_path.join(home, '.codeium', 'windsurf', 'mcp_config.json');
+    try {
+        await node_fs.access(node_path.dirname(configPath));
+        const current = await readJsonFile(configPath, {});
+        current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+        await writeJsonFile(configPath, current);
+        log.info({ action: 'windsurf_mcp_injected' }, 'Windsurf mcp_config.json updated');
+    }
+    catch {
+        log.debug({ action: 'windsurf_skip' }, 'Windsurf not installed — skipping');
+    }
+}
+async function injectContinue(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    const configPath = node_path.join(home, '.continue', 'config.json');
+    try {
+        await node_fs.access(node_path.dirname(configPath));
+        const current = await readJsonFile(configPath, {});
+        // Continue uses an array format for mcpServers
+        if (!Array.isArray(current.mcpServers)) {
+            current.mcpServers = [];
+        }
+        // Remove any existing intutic entry and add the wrapped one
+        current.mcpServers = current.mcpServers.filter((s) => s.name !== 'intutic');
+        // Wrap existing non-intutic servers
+        current.mcpServers = current.mcpServers.map((s) => {
+            if (s.__intutic_wrapped)
+                return s;
+            return {
+                name: s.name,
+                command: 'node',
+                args: [
+                    resolveProxyBin(workspaceRoot),
+                    '--workspace-id', workspaceId,
+                    '--',
+                    s.command,
+                    ...(s.args ?? []),
+                ],
+                env: { ...(s.env ?? {}), INTUTIC_WORKSPACE_ID: workspaceId },
+                __intutic_wrapped: true,
+            };
+        });
+        // Add Intutic MCP server
+        const entry = buildIntuticMcpEntry(workspaceRoot);
+        current.mcpServers.unshift({ name: 'intutic', ...entry });
+        await writeJsonFile(configPath, current);
+        log.info({ action: 'continue_mcp_injected' }, 'Continue ~/.continue/config.json updated');
+    }
+    catch {
+        log.debug({ action: 'continue_skip' }, 'Continue not installed — skipping');
+    }
+}
+// ─── Target: Goose ────────────────────────────────────────────────────────────
+async function injectGoose(workspaceId, workspaceRoot) {
+    const home = node_os.homedir();
+    const configPath = node_path.join(home, '.config', 'goose', 'config.yaml');
+    try {
+        await node_fs.access(node_path.dirname(configPath));
+        let yaml = '';
+        try {
+            yaml = await node_fs.readFile(configPath, 'utf-8');
+        }
+        catch {
+            yaml = '';
+        }
+        // Inject MCP server block if not present (simple string injection — avoids yaml dep)
+        const proxyBin = resolveProxyBin(workspaceRoot);
+        const intuticBlock = [
+            'mcp:',
+            '  intutic:',
+            `    command: node`,
+            `    args: [${JSON.stringify(proxyBin)}, "--workspace-id", ${JSON.stringify(workspaceId)}]`,
+        ].join('\n');
+        if (!yaml.includes('intutic:')) {
+            yaml = yaml.trimEnd() + '\n\n' + intuticBlock + '\n';
+        }
+        await node_fs.mkdir(node_path.dirname(configPath), { recursive: true });
+        await node_fs.writeFile(configPath, yaml, 'utf-8');
+        log.info({ action: 'goose_mcp_injected' }, 'Goose config.yaml updated');
+    }
+    catch {
+        log.debug({ action: 'goose_skip' }, 'Goose not installed — skipping');
+    }
+}
+// ─── Target: OpenHands ────────────────────────────────────────────────────────
+async function injectOpenHands(workspaceId, workspaceRoot) {
+    const configPath = node_path.join(workspaceRoot, '.openhands', 'mcp.json');
+    try {
+        const current = await readJsonFile(configPath, {});
+        current.mcpServers = wrapAllServers({ intutic: buildIntuticMcpEntry(workspaceRoot), ...(current.mcpServers ?? {}) }, workspaceId, workspaceRoot);
+        await writeJsonFile(configPath, current);
+        log.info({ action: 'openhands_mcp_injected' }, 'OpenHands .openhands/mcp.json updated');
+    }
+    catch (err) {
+        log.debug({ action: 'openhands_mcp_skip', err: err.message }, 'OpenHands config not found — skipping');
+    }
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Injects and proxy-wraps the Intutic MCP server configuration into all supported harnesses.
+ *
+ * Non-fatal: a failure in one harness does not prevent other harnesses from being updated.
+ *
+ * @param workspaceId - The workspace ID for policy lookups and event attribution.
+ * @param workspaceRoot - Absolute path to the project workspace root.
+ */
+export async function injectMcpServer(workspaceRoot, workspaceId = 'unknown') {
+    log.info({ action: 'mcp_inject_start', workspaceRoot, workspaceId }, 'Starting MCP server injection');
+    await Promise.allSettled([
+        injectClaudeCode(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-code' }, 'MCP injection failed')),
+        injectClaudeDesktop(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'claude-desktop' }, 'MCP injection failed')),
+        injectCursor(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cursor' }, 'MCP injection failed')),
+        injectCline(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'cline' }, 'MCP injection failed')),
+        injectWindsurf(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'windsurf' }, 'MCP injection failed')),
+        injectContinue(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'continue' }, 'MCP injection failed')),
+        injectGoose(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'goose' }, 'MCP injection failed')),
+        injectOpenHands(workspaceId, workspaceRoot).catch((err) => log.error({ err: err.message, target: 'openhands' }, 'MCP injection failed')),
+    ]);
+    log.info({ action: 'mcp_inject_complete', workspaceRoot }, 'MCP server injection complete');
+}
+//# sourceMappingURL=mcpAutoWrite.js.map

package/dist/harness/mcpAutoWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAutoWrite.js","sourceRoot":"","sources":["../../src/harness/mcpAutoWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAgB9C,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,aAAqB;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAC3B,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,CACtF,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAErC,8DAA8D;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,aAAa,CACpB,KAAqB,EACrB,WAAmB,EACnB,aAAqB;IAErB,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAEzC,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAC/C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;IAErC,OAAO;QACL,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,QAAQ;YACR,gBAAgB,EAAE,WAAW;YAC7B,IAAI;YACJ,KAAK,CAAC,OAAO;YACb,GAAG,YAAY;SAChB;QACD,GAAG,EAAE;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;YACpB,oBAAoB,EAAE,WAAW;SAClC;QACD,iBAAiB,EAAE,IAAI;KACxB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,OAAsB,EACtB,WAAmB,EACnB,aAAqB;IAErB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,iFAAiF;AAEjF,SAAS,oBAAoB,CAAC,aAAqB;IACjD,OAAO;QACL,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,eAAe,CAAC,aAAa,CAAC;SAC/B;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,YAAY;YACtB,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,SAAS,EAAE,QAAQ;SACpB;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,YAAY,CAAI,QAAgB,EAAE,QAAW;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAa;IAC1D,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AAClF,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,aAAqB;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;IAElF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;IAED,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,wCAAwC,CAAC,CAAA;AAC5F,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9B,IAAI,UAAkB,CAAA;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IAC7G,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACnG,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACtF,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,yCAAyC,CAAC,CAAA;QACvF,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;IAClF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;IAED,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,+BAA+B,CAAC,CAAA;AACtF,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,aAAqB;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAE9B,kBAAkB;IAClB,IAAI,UAAkB,CAAA;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAC9G,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAA;IACpG,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAA;IACvF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;QAClF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;QACD,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,iDAAiD,CAAC,CAAA;IAChG,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,WAAW,EAAE,EAAE,CAAC,CAAA;QACnF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;QACD,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACzC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAA;IACrH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,aAAqB;IACnE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;QAClF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;QACD,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAC3G,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,aAAqB;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAA;IAElF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;QAClF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;QACD,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,kCAAkC,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAeD,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,aAAqB;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;IAEnE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiB,UAAU,EAAE,EAAE,CAAC,CAAA;QAElE,+CAA+C;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAA;QACzB,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QAE3E,oCAAoC;QACpC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChD,IAAI,CAAC,CAAC,iBAAiB;gBAAE,OAAO,CAAC,CAAA;YACjC,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE;oBACJ,eAAe,CAAC,aAAa,CAAC;oBAC9B,gBAAgB,EAAE,WAAW;oBAC7B,IAAI;oBACJ,CAAC,CAAC,OAAO;oBACT,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;iBAClB;gBACD,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,oBAAoB,EAAE,WAAW,EAAE;gBAC5D,iBAAiB,EAAE,IAAI;aACxB,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,yBAAyB;QACzB,MAAM,KAAK,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACjD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAEzD,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,0CAA0C,CAAC,CAAA;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,aAAqB;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IAE1E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QACnD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,CAAA;QACX,CAAC;QAED,qFAAqF;QACrF,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;QAC/C,MAAM,YAAY,GAAG;YACnB,MAAM;YACN,YAAY;YACZ,mBAAmB;YACnB,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;SAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAClD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,aAAqB;IACvE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAiC,UAAU,EAAE,EAAE,CAAC,CAAA;QAClF,OAAO,CAAC,UAAU,GAAG,cAAc,CACjC,EAAE,OAAO,EAAE,oBAAoB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAC/E,WAAW,EACX,aAAa,CACd,CAAA;QACD,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,uCAAuC,CAAC,CAAA;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;IACnH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB,EAAE,WAAW,GAAG,SAAS;IAClF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAErG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvB,gBAAgB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACzD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC5F,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/F,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACrD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACvF,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACpD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACtF,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACzF,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACzF,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACpD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACtF,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACxD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,sBAAsB,CAAC,CAAC;KAC3F,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,EAAE,+BAA+B,CAAC,CAAA;AAC7F,CAAC"}

package/dist/harness/n8nHooks.d.ts

@@ -0,0 +1,28 @@
+/**
+ * n8nHooks.ts — n8n governance workflow generator.
+ *
+ * n8n has no native SDK hook system. Governance is implemented via a
+ * pre-built n8n workflow that users import into their n8n instance:
+ *   - Webhook trigger listening on /webhook/intutic-governance
+ *   - IF node filtering tool_blocked events
+ *   - HTTP Request node forwarding events to the Intutic control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+/**
+ * Write the n8n governance workflow and installation env snippet.
+ *
+ *  1. Writes `~/.intutic/n8n/governance-workflow.json` — importable n8n 1.x workflow.
+ *  2. Writes `.intutic/env/n8n.env` with webhook URL and import instructions.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic control plane URL for the HTTP Request node.
+ * @param workspaceId   - Workspace ID embedded in workflow metadata and HTTP headers.
+ */
+export declare function writeN8nHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=n8nHooks.d.ts.map

package/dist/harness/n8nHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"n8nHooks.d.ts","sourceRoot":"","sources":["../../src/harness/n8nHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA8JH;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf"}

package/dist/harness/n8nHooks.js

@@ -0,0 +1,205 @@
+/**
+ * n8nHooks.ts — n8n governance workflow generator.
+ *
+ * n8n has no native SDK hook system. Governance is implemented via a
+ * pre-built n8n workflow that users import into their n8n instance:
+ *   - Webhook trigger listening on /webhook/intutic-governance
+ *   - IF node filtering tool_blocked events
+ *   - HTTP Request node forwarding events to the Intutic control plane
+ *
+ * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+const log = createLogger('sync-n8n-hooks');
+/** Default n8n governance workflow directory. */
+const N8N_DIR = path.join(os.homedir(), '.intutic', 'n8n');
+// ─── Static node UUIDs (hardcoded for workflow stability) ─────────────────────
+const NODE_ID_WEBHOOK = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
+const NODE_ID_IF = 'b2c3d4e5-f6a7-8901-bcde-f12345678901';
+const NODE_ID_HTTP = 'c3d4e5f6-a7b8-9012-cdef-123456789012';
+const NODE_ID_NO_OP = 'd4e5f6a7-b8c9-0123-defa-234567890123';
+const WORKFLOW_ID = 'e5f6a7b8-c9d0-1234-efab-345678901234';
+// ─── n8n workflow JSON builder ────────────────────────────────────────────────
+function buildN8nWorkflow(proxyUrl, workspaceId) {
+    return {
+        id: WORKFLOW_ID,
+        name: 'Intutic Governance — Hook Events',
+        active: true,
+        meta: {
+            instanceId: 'intutic-sync-daemon',
+            templateCredsSetupCompleted: true,
+        },
+        tags: [{ name: 'intutic' }, { name: 'governance' }],
+        // n8n 1.x settings block
+        settings: {
+            executionOrder: 'v1',
+            saveManualExecutions: false,
+            callerPolicy: 'workflowsFromSameOwner',
+            errorWorkflow: '',
+        },
+        // Static credential placeholders (user fills in API key via n8n UI)
+        staticData: null,
+        nodes: [
+            // ── Webhook trigger ──────────────────────────────────────────────────
+            {
+                id: NODE_ID_WEBHOOK,
+                name: 'Intutic Webhook',
+                type: 'n8n-nodes-base.webhook',
+                typeVersion: 1,
+                position: [240, 300],
+                parameters: {
+                    httpMethod: 'POST',
+                    path: 'intutic-governance',
+                    responseMode: 'onReceived',
+                    responseData: 'allEntries',
+                    options: {},
+                },
+                webhookId: 'intutic-governance',
+            },
+            // ── IF — filter tool_blocked events ──────────────────────────────────
+            {
+                id: NODE_ID_IF,
+                name: 'Is Blocked?',
+                type: 'n8n-nodes-base.if',
+                typeVersion: 1,
+                position: [480, 300],
+                parameters: {
+                    conditions: {
+                        string: [
+                            {
+                                value1: '={{ $json.body.event }}',
+                                operation: 'equal',
+                                value2: 'tool_blocked',
+                            },
+                        ],
+                    },
+                },
+            },
+            // ── HTTP Request — forward to Intutic control plane ───────────────────
+            {
+                id: NODE_ID_HTTP,
+                name: 'Forward to Intutic',
+                type: 'n8n-nodes-base.httpRequest',
+                typeVersion: 3,
+                position: [720, 200],
+                parameters: {
+                    method: 'POST',
+                    url: `${proxyUrl}/api/v1/hook-events`,
+                    sendHeaders: true,
+                    headerParameters: {
+                        parameters: [
+                            {
+                                name: 'Content-Type',
+                                value: 'application/json',
+                            },
+                            {
+                                name: 'Authorization',
+                                // Users should replace this with their API key via n8n Credentials
+                                value: 'Bearer {{ $env.INTUTIC_API_KEY }}',
+                            },
+                            {
+                                name: 'X-Intutic-Workspace-Id',
+                                value: workspaceId,
+                            },
+                        ],
+                    },
+                    sendBody: true,
+                    bodyParameters: {
+                        parameters: [],
+                    },
+                    specifyBody: 'json',
+                    jsonBody: '={{ JSON.stringify({ events: [$json.body] }) }}',
+                    options: {
+                        timeout: 10000,
+                    },
+                },
+            },
+            // ── No-op for non-blocked events ──────────────────────────────────────
+            {
+                id: NODE_ID_NO_OP,
+                name: 'Allowed (no-op)',
+                type: 'n8n-nodes-base.noOp',
+                typeVersion: 1,
+                position: [720, 400],
+                parameters: {},
+            },
+        ],
+        // n8n 1.x connections format
+        connections: {
+            'Intutic Webhook': {
+                main: [
+                    [
+                        { node: 'Is Blocked?', type: 'main', index: 0 },
+                    ],
+                ],
+            },
+            'Is Blocked?': {
+                main: [
+                    // true branch → forward to control plane
+                    [{ node: 'Forward to Intutic', type: 'main', index: 0 }],
+                    // false branch → no-op
+                    [{ node: 'Allowed (no-op)', type: 'main', index: 0 }],
+                ],
+            },
+        },
+        // Workflow metadata
+        _intuticMeta: {
+            generatedBy: 'intutic-sync-daemon',
+            generatedAt: newIso(),
+            workspaceId,
+            proxyUrl,
+            webhookPath: '/webhook/intutic-governance',
+        },
+    };
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Write the n8n governance workflow and installation env snippet.
+ *
+ *  1. Writes `~/.intutic/n8n/governance-workflow.json` — importable n8n 1.x workflow.
+ *  2. Writes `.intutic/env/n8n.env` with webhook URL and import instructions.
+ *
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic control plane URL for the HTTP Request node.
+ * @param workspaceId   - Workspace ID embedded in workflow metadata and HTTP headers.
+ */
+export async function writeN8nHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    // ── 1. Ensure directories ──────────────────────────────────────────────────
+    const envDir = path.join(workspaceRoot, '.intutic', 'env');
+    await Promise.all([
+        fs.mkdir(N8N_DIR, { recursive: true }),
+        fs.mkdir(envDir, { recursive: true }),
+    ]);
+    // ── 2. Write governance-workflow.json (atomic) ────────────────────────────
+    const workflowPath = path.join(N8N_DIR, 'governance-workflow.json');
+    const workflow = buildN8nWorkflow(proxyUrl, workspaceId);
+    const tmpWorkflow = workflowPath + '.intutic-tmp';
+    await fs.writeFile(tmpWorkflow, JSON.stringify(workflow, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmpWorkflow, workflowPath);
+    log.info({ action: 'n8n_workflow_written', path: workflowPath }, 'n8n governance workflow written');
+    // ── 3. Write .intutic/env/n8n.env (atomic) ────────────────────────────────
+    const envContent = [
+        `# Intutic n8n governance env — auto-generated ${newIso()}`,
+        `# This file is managed by the Intutic sync-daemon. DO NOT EDIT.`,
+        `INTUTIC_N8N_WEBHOOK=http://localhost:5678/webhook/intutic-governance`,
+        `# Import ~/.intutic/n8n/governance-workflow.json into your n8n instance.`,
+        `# In n8n: Settings > Import Workflow > select the file above.`,
+        `# Then activate the workflow and set INTUTIC_API_KEY as an n8n credential.`,
+        workspaceId ? `INTUTIC_WORKSPACE_ID=${workspaceId}` : '',
+    ].filter((l) => l !== '').join('\n') + '\n';
+    const envFilePath = path.join(envDir, 'n8n.env');
+    const tmpEnv = envFilePath + '.intutic-tmp';
+    await fs.writeFile(tmpEnv, envContent, 'utf-8');
+    await fs.rename(tmpEnv, envFilePath);
+    log.info({ action: 'n8n_env_written', path: envFilePath }, 'n8n env snippet written');
+}
+//# sourceMappingURL=n8nHooks.js.map