@intutic/sync-daemon 1.9.0 → 1.10.1

package/dist/harness/n8nHooks.js

@@ -1,11 +1,24 @@
 /**
- * n8nHooks.ts — n8n governance workflow generator.
+ * n8nHooks.ts — n8n governance: workflow-level blocking gate + event workflow.
  *
- * n8n has no native SDK hook system. Governance is implemented via a
- * pre-built n8n workflow that users import into their n8n instance:
- *   - Webhook trigger listening on /webhook/intutic-governance
- *   - IF node filtering tool_blocked events
- *   - HTTP Request node forwarding events to the Intutic control plane
+ * Two artifacts, honest about what each is:
+ *
+ * 1. **The blocking gate** (`~/.intutic/hooks/n8n-governance-hook.js`) — an
+ *    n8n *external hook* module. n8n's only pre-execution mechanism is
+ *    deployment-level: the operator sets
+ *    `EXTERNAL_HOOK_FILES=/path/to/n8n-governance-hook.js` in the n8n
+ *    process's environment, and the module's `workflow.preExecute` function
+ *    then runs before every workflow execution, receiving the full Workflow
+ *    object (all nodes and their parameters). **Throwing aborts the
+ *    execution** — this is genuinely blocking, but per WORKFLOW, not per tool
+ *    call, and installation is manual and deployment-side: this daemon cannot
+ *    set another process's environment (the same reason open-webui's filter
+ *    is installed by hand — see openWebuiHooks.ts). `INSTALL.md` next to the
+ *    workflow JSON explains the env var.
+ *
+ * 2. **The event-forwarding workflow** (`~/.intutic/n8n/governance-workflow.json`)
+ *    — an importable n8n workflow (webhook → IF → HTTP Request) that forwards
+ *    tool_blocked events to the control plane. Telemetry, not enforcement.
  *
  * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
@@ -17,6 +30,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { newIso } from '@intutic/id';
+import { emitN8nWorkflowGate } from './gateBody.js';
 const log = createLogger('sync-n8n-hooks');
 /** Default n8n governance workflow directory. */
 const N8N_DIR = path.join(os.homedir(), '.intutic', 'n8n');
@@ -159,12 +173,145 @@ function buildN8nWorkflow(proxyUrl, workspaceId) {
         },
     };
 }
+// ─── External-hook gate builder ───────────────────────────────────────────────
+/**
+ * The blocking gate — an n8n external-hook module whose `workflow.preExecute`
+ * throws to abort an execution. See the module header for the
+ * `EXTERNAL_HOOK_FILES` contract and why installation is manual.
+ */
+function buildN8nGovernanceHook(proxyUrl, workspaceId) {
+    return `/**
+ * Intutic n8n governance gate (external hook module).
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ *
+ * MANUAL INSTALL (deployment-side): set, in the n8n process's environment,
+ *   EXTERNAL_HOOK_FILES=/path/to/this/file
+ * and restart n8n. The daemon cannot set another process's environment — see
+ * INSTALL.md next to ~/.intutic/n8n/governance-workflow.json.
+ *
+ * workflow.preExecute runs before every execution with the full Workflow
+ * object; a throw here ABORTS the execution. Per-workflow granularity: one
+ * offending node stops the whole run, and the error names the node and rule.
+ *
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+'use strict';
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+${emitN8nWorkflowGate()}
+
+// Events land under HOME, not a workspace: this runs inside the n8n server
+// process, which has no workspace root — the same reason cline logs there.
+const HOOK_EVENTS_LOG = path.join(os.homedir(), '.intutic', 'events', 'n8n-hook-events.jsonl');
+
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      // Passed through, not collapsed to two values: the advisory tier emits
+      // 'tool_flagged', and a ternary here silently recorded it as an allow.
+      event: verdict,
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'n8n',
+      timestamp: ts,
+      incidentId,
+    }) + '\\n';
+    const dir = path.dirname(HOOK_EVENTS_LOG);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(HOOK_EVENTS_LOG, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+module.exports = {
+  workflow: {
+    preExecute: [
+      // No try/catch around the gate: a BLOCKED throw is the refusal, and an
+      // internal fault throwing also aborts the execution — fail closed. n8n
+      // shows the error message on the aborted execution.
+      async function intuticPreExecute(workflow) {
+        intuticGateWorkflow(workflow, logEvent, _intuticWsId);
+      },
+    ],
+  },
+};
+`;
+}
+/** INSTALL.md explaining the deployment-side env var the daemon cannot set. */
+function buildInstallMd(hookPath, workflowPath) {
+    return `# Intutic governance for n8n — installation
+
+Auto-generated by the Intutic sync-daemon. Two artifacts, two install steps.
+
+## 1. The blocking gate (manual, deployment-side)
+
+n8n's only pre-execution hook mechanism is the \`EXTERNAL_HOOK_FILES\`
+environment variable, read by the **n8n server process at startup**. The
+Intutic daemon cannot set another process's environment, so this step is
+yours:
+
+\`\`\`bash
+export EXTERNAL_HOOK_FILES=${hookPath}
+# then (re)start n8n; for Docker:
+#   docker run -e EXTERNAL_HOOK_FILES=/hooks/n8n-governance-hook.js \\
+#     -v ${hookPath}:/hooks/n8n-governance-hook.js ...
+\`\`\`
+
+Once loaded, the module's \`workflow.preExecute\` hook runs before **every
+workflow execution**, evaluates each node's type and parameters against the
+compiled floor and the policy snapshot, and **throws** on a block-severity
+match — which aborts the execution with an error naming the node and rule.
+
+Granularity is per workflow, not per tool call: that is all n8n's hook
+surface offers. If the env var is not set, no gate runs — the daemon
+regenerates this file every sync cycle, but only your deployment can load it.
+
+## 2. The event-forwarding workflow (import via the n8n UI)
+
+Import \`${workflowPath}\`
+(Settings > Import Workflow), activate it, and set \`INTUTIC_API_KEY\` as an
+n8n credential. It forwards tool_blocked events to the Intutic control plane.
+This workflow is telemetry only; the gate above is what blocks.
+`;
+}
 // ─── Main export ──────────────────────────────────────────────────────────────
 /**
- * Write the n8n governance workflow and installation env snippet.
+ * Write the n8n governance gate, workflow, and installation notes.
  *
- *  1. Writes `~/.intutic/n8n/governance-workflow.json` — importable n8n 1.x workflow.
- *  2. Writes `.intutic/env/n8n.env` with webhook URL and import instructions.
+ *  1. Writes `~/.intutic/hooks/n8n-governance-hook.js` — the blocking
+ *     EXTERNAL_HOOK_FILES module (manual, deployment-side install).
+ *  2. Writes `~/.intutic/n8n/governance-workflow.json` — importable n8n 1.x workflow.
+ *  3. Writes `~/.intutic/n8n/INSTALL.md` — the EXTERNAL_HOOK_FILES instructions.
+ *  4. Writes `.intutic/env/n8n.env` with webhook URL and import instructions.
  *
  * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
  *
@@ -175,10 +322,20 @@ function buildN8nWorkflow(proxyUrl, workspaceId) {
 export async function writeN8nHooks(workspaceRoot, proxyUrl, workspaceId = '') {
     // ── 1. Ensure directories ──────────────────────────────────────────────────
     const envDir = path.join(workspaceRoot, '.intutic', 'env');
+    // homedir() read at call time (unlike the module-scope N8N_DIR) so tests
+    // that move HOME before invoking are honoured — the gooseHooks lesson.
+    const hooksDir = path.join(os.homedir(), '.intutic', 'hooks');
     await Promise.all([
         fs.mkdir(N8N_DIR, { recursive: true }),
         fs.mkdir(envDir, { recursive: true }),
+        fs.mkdir(hooksDir, { recursive: true }),
     ]);
+    // ── 1b. Write the blocking external-hook gate (atomic) ────────────────────
+    const hookPath = path.join(hooksDir, 'n8n-governance-hook.js');
+    const tmpHook = hookPath + '.intutic-tmp';
+    await fs.writeFile(tmpHook, buildN8nGovernanceHook(proxyUrl, workspaceId), 'utf-8');
+    await fs.rename(tmpHook, hookPath);
+    log.info({ action: 'n8n_governance_hook_written', path: hookPath }, 'n8n workflow-level gate written (requires EXTERNAL_HOOK_FILES — see INSTALL.md)');
     // ── 2. Write governance-workflow.json (atomic) ────────────────────────────
     const workflowPath = path.join(N8N_DIR, 'governance-workflow.json');
     const workflow = buildN8nWorkflow(proxyUrl, workspaceId);
@@ -186,11 +343,19 @@ export async function writeN8nHooks(workspaceRoot, proxyUrl, workspaceId = '') {
     await fs.writeFile(tmpWorkflow, JSON.stringify(workflow, null, 2) + '\n', 'utf-8');
     await fs.rename(tmpWorkflow, workflowPath);
     log.info({ action: 'n8n_workflow_written', path: workflowPath }, 'n8n governance workflow written');
+    // ── 2b. Write INSTALL.md (atomic) ─────────────────────────────────────────
+    const installPath = path.join(N8N_DIR, 'INSTALL.md');
+    const tmpInstall = installPath + '.intutic-tmp';
+    await fs.writeFile(tmpInstall, buildInstallMd(hookPath, workflowPath), 'utf-8');
+    await fs.rename(tmpInstall, installPath);
     // ── 3. Write .intutic/env/n8n.env (atomic) ────────────────────────────────
     const envContent = [
         `# Intutic n8n governance env — auto-generated ${newIso()}`,
         `# This file is managed by the Intutic sync-daemon. DO NOT EDIT.`,
         `INTUTIC_N8N_WEBHOOK=http://localhost:5678/webhook/intutic-governance`,
+        `# BLOCKING GATE (manual, deployment-side): set in the n8n process's env`,
+        `#   EXTERNAL_HOOK_FILES=${hookPath}`,
+        `# and restart n8n. See ~/.intutic/n8n/INSTALL.md.`,
         `# Import ~/.intutic/n8n/governance-workflow.json into your n8n instance.`,
         `# In n8n: Settings > Import Workflow > select the file above.`,
         `# Then activate the workflow and set INTUTIC_API_KEY as an n8n credential.`,

package/dist/harness/n8nHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"n8nHooks.js","sourceRoot":"","sources":["../../src/harness/n8nHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,iDAAiD;AACjD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;AAE1D,iFAAiF;AAEjF,MAAM,eAAe,GAAK,sCAAsC,CAAA;AAChE,MAAM,UAAU,GAAU,sCAAsC,CAAA;AAChE,MAAM,YAAY,GAAQ,sCAAsC,CAAA;AAChE,MAAM,aAAa,GAAO,sCAAsC,CAAA;AAChE,MAAM,WAAW,GAAS,sCAAsC,CAAA;AAEhE,iFAAiF;AAEjF,SAAS,gBAAgB,CAAC,QAAgB,EAAE,WAAmB;IAC7D,OAAO;QACL,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,kCAAkC;QACxC,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACJ,UAAU,EAAE,qBAAqB;YACjC,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,yBAAyB;QACzB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAI;YACpB,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,wBAAwB;YACtC,aAAa,EAAE,EAAE;SAClB;QACD,oEAAoE;QACpE,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE;YACL,wEAAwE;YACxE;gBACE,EAAE,EAAE,eAAe;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,UAAU,EAAE,MAAM;oBAClB,IAAI,EAAE,oBAAoB;oBAC1B,YAAY,EAAE,YAAY;oBAC1B,YAAY,EAAE,YAAY;oBAC1B,OAAO,EAAE,EAAE;iBACZ;gBACD,SAAS,EAAE,oBAAoB;aAChC;YACD,wEAAwE;YACxE;gBACE,EAAE,EAAE,UAAU;gBACd,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN;gCACE,MAAM,EAAE,yBAAyB;gCACjC,SAAS,EAAE,OAAO;gCAClB,MAAM,EAAE,cAAc;6BACvB;yBACF;qBACF;iBACF;aACF;YACD,yEAAyE;YACzE;gBACE,EAAE,EAAE,YAAY;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,GAAG,QAAQ,qBAAqB;oBACrC,WAAW,EAAE,IAAI;oBACjB,gBAAgB,EAAE;wBAChB,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,kBAAkB;6BAC1B;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,mEAAmE;gCACnE,KAAK,EAAE,mCAAmC;6BAC3C;4BACD;gCACE,IAAI,EAAE,wBAAwB;gCAC9B,KAAK,EAAE,WAAW;6BACnB;yBACF;qBACF;oBACD,QAAQ,EAAE,IAAI;oBACd,cAAc,EAAE;wBACd,UAAU,EAAE,EAAE;qBACf;oBACD,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,iDAAiD;oBAC3D,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK;qBACf;iBACF;aACF;YACD,yEAAyE;YACzE;gBACE,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE,EAAE;aACf;SACF;QACD,6BAA6B;QAC7B,WAAW,EAAE;YACX,iBAAiB,EAAE;gBACjB,IAAI,EAAE;oBACJ;wBACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;qBAChD;iBACF;aACF;YACD,aAAa,EAAE;gBACb,IAAI,EAAE;oBACJ,yCAAyC;oBACzC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBACxD,uBAAuB;oBACvB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;iBACtD;aACF;SACF;QACD,oBAAoB;QACpB,YAAY,EAAE;YACZ,WAAW,EAAE,qBAAqB;YAClC,WAAW,EAAE,MAAM,EAAE;YACrB,WAAW;YACX,QAAQ;YACR,WAAW,EAAE,6BAA6B;SAC3C;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAE1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACtC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACtC,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,EACtD,iCAAiC,CAClC,CAAA;IAED,6EAA6E;IAE7E,MAAM,UAAU,GAAG;QACjB,iDAAiD,MAAM,EAAE,EAAE;QAC3D,iEAAiE;QACjE,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,4EAA4E;QAC5E,WAAW,CAAC,CAAC,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;KACzD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAChD,yBAAyB,CAC1B,CAAA;AACH,CAAC"}
+{"version":3,"file":"n8nHooks.js","sourceRoot":"","sources":["../../src/harness/n8nHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,iDAAiD;AACjD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;AAE1D,iFAAiF;AAEjF,MAAM,eAAe,GAAK,sCAAsC,CAAA;AAChE,MAAM,UAAU,GAAU,sCAAsC,CAAA;AAChE,MAAM,YAAY,GAAQ,sCAAsC,CAAA;AAChE,MAAM,aAAa,GAAO,sCAAsC,CAAA;AAChE,MAAM,WAAW,GAAS,sCAAsC,CAAA;AAEhE,iFAAiF;AAEjF,SAAS,gBAAgB,CAAC,QAAgB,EAAE,WAAmB;IAC7D,OAAO;QACL,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,kCAAkC;QACxC,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACJ,UAAU,EAAE,qBAAqB;YACjC,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,yBAAyB;QACzB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAI;YACpB,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,wBAAwB;YACtC,aAAa,EAAE,EAAE;SAClB;QACD,oEAAoE;QACpE,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE;YACL,wEAAwE;YACxE;gBACE,EAAE,EAAE,eAAe;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,UAAU,EAAE,MAAM;oBAClB,IAAI,EAAE,oBAAoB;oBAC1B,YAAY,EAAE,YAAY;oBAC1B,YAAY,EAAE,YAAY;oBAC1B,OAAO,EAAE,EAAE;iBACZ;gBACD,SAAS,EAAE,oBAAoB;aAChC;YACD,wEAAwE;YACxE;gBACE,EAAE,EAAE,UAAU;gBACd,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN;gCACE,MAAM,EAAE,yBAAyB;gCACjC,SAAS,EAAE,OAAO;gCAClB,MAAM,EAAE,cAAc;6BACvB;yBACF;qBACF;iBACF;aACF;YACD,yEAAyE;YACzE;gBACE,EAAE,EAAE,YAAY;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE;oBACV,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,GAAG,QAAQ,qBAAqB;oBACrC,WAAW,EAAE,IAAI;oBACjB,gBAAgB,EAAE;wBAChB,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,kBAAkB;6BAC1B;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,mEAAmE;gCACnE,KAAK,EAAE,mCAAmC;6BAC3C;4BACD;gCACE,IAAI,EAAE,wBAAwB;gCAC9B,KAAK,EAAE,WAAW;6BACnB;yBACF;qBACF;oBACD,QAAQ,EAAE,IAAI;oBACd,cAAc,EAAE;wBACd,UAAU,EAAE,EAAE;qBACf;oBACD,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,iDAAiD;oBAC3D,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK;qBACf;iBACF;aACF;YACD,yEAAyE;YACzE;gBACE,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACpB,UAAU,EAAE,EAAE;aACf;SACF;QACD,6BAA6B;QAC7B,WAAW,EAAE;YACX,iBAAiB,EAAE;gBACjB,IAAI,EAAE;oBACJ;wBACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;qBAChD;iBACF;aACF;YACD,aAAa,EAAE;gBACb,IAAI,EAAE;oBACJ,yCAAyC;oBACzC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBACxD,uBAAuB;oBACvB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;iBACtD;aACF;SACF;QACD,oBAAoB;QACpB,YAAY,EAAE;YACZ,WAAW,EAAE,qBAAqB;YAClC,WAAW,EAAE,MAAM,EAAE;YACrB,WAAW;YACX,QAAQ;YACR,WAAW,EAAE,6BAA6B;SAC3C;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,WAAmB;IACnE,OAAO;;;;;;;;;;;;;YAaG,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;;;;gFAWwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,mBAAmB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDtB,CAAA;AACD,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,QAAgB,EAAE,YAAoB;IAC5D,OAAO;;;;;;;;;;;;6BAYoB,QAAQ;;;WAG1B,QAAQ;;;;;;;;;;;;;;WAcR,YAAY;;;;CAItB,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAE7D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACtC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,6EAA6E;IAE7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACnF,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAElC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,QAAQ,EAAE,EACzD,iFAAiF,CAClF,CAAA;IAED,6EAA6E;IAE7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAE1C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,EACtD,iCAAiC,CAClC,CAAA;IAED,6EAA6E;IAE7E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,WAAW,GAAG,cAAc,CAAA;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAA;IAC/E,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAExC,6EAA6E;IAE7E,MAAM,UAAU,GAAG;QACjB,iDAAiD,MAAM,EAAE,EAAE;QAC3D,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,2BAA2B,QAAQ,EAAE;QACrC,mDAAmD;QACnD,0EAA0E;QAC1E,+DAA+D;QAC/D,4EAA4E;QAC5E,WAAW,CAAC,CAAC,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;KACzD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAChD,yBAAyB,CAC1B,CAAA;AACH,CAAC"}

package/dist/harness/openCodeHooks.d.ts

@@ -0,0 +1,93 @@
+/**
+ * openCodeHooks.ts — OpenCode plugin gate (TD-397).
+ *
+ * OpenCode (the open-source terminal coding agent: npm `opencode-ai` 1.x,
+ * `@opencode/cli` 2.x) has no hook file, no hook JSON and no stdin/stdout
+ * gate contract. What it has is a **plugin**: a JavaScript module OpenCode
+ * loads INTO ITS OWN PROCESS from `.opencode/plugins/*.{js,ts}` (project) or
+ * `~/.config/opencode/plugins/`, or from an npm package named in
+ * `opencode.json`. The plugin returns hooks; one of them runs before every
+ * tool call and vetoes it by throwing:
+ *
+ *   - 1.x: `export default async (input) => ({ "tool.execute.before": async (i, o) => { … } })`,
+ *     `i = { tool, sessionID, callID }`, `o = { args }`. Fired from
+ *     `packages/opencode/src/session/tools.ts` before `item.execute(args, ctx)`,
+ *     for built-in tools, the `task` tool and MCP tools alike. A thrown Error
+ *     becomes a `tool-error` part whose message the model reads; the tool
+ *     never runs. (OpenCode's own docs demonstrate exactly this shape to keep
+ *     `read` away from `.env`.)
+ *   - 2.x: `ctx.tool.hook("execute.before", (event) => { … })` with
+ *     `event = { tool, input, sessionID, … }`; "only tool execute.before may
+ *     fail: a Tool.Error rejects the call before it runs". 2.x does NOT run
+ *     1.x-shaped plugins, and it discovers local plugins as DIRECTORIES —
+ *     `.opencode/plugins/<name>/index.{js,ts}` — while 1.x globs FILES —
+ *     `.opencode/{plugin,plugins}/*.{js,ts}` — so each line sees only its
+ *     own layout. The same module is therefore written twice: the flat file
+ *     for 1.x and `<name>/index.js` for 2.x. Its default export is the 1.x
+ *     plugin function, which also carries `id`, `server` and `setup` so a
+ *     2.x loader reading `default.setup()` finds the same gate. The 1.x
+ *     loader accepts a function (or an object with a `.server` function) and
+ *     rejects anything else, which is why the file exports exactly one value.
+ *
+ * The typed 1.x `permission.ask` hook is NOT used: it has had no trigger site
+ * since v1.0.182 and would be a gate that never fires.
+ *
+ * ## Same gate as every other hook harness
+ *
+ * The file embeds the shared `emitJsGate` body with the `'throw'` contract:
+ * the compiled-in floor, `~/.intutic/hooks/policy-snapshot.rules`, the WHERE
+ * clauses and the audit line are exactly what `codex-check.js` or
+ * `muse-check.js` enforce. This is why the plugin is a generated file and not
+ * an `@intutic/gate` npm dependency: gate-js does not carry the floor, and a
+ * dependency the user's project has to `bun install` is one more thing to
+ * drift. Nothing to register — OpenCode globs the directory.
+ *
+ * ## In-process, so no process-level handlers
+ *
+ * The plugin runs inside OpenCode. `emitJsFailClosedPrelude` (an
+ * `uncaughtException` handler that exits 2) would exit the user's editor on
+ * any unrelated fault, so it is deliberately absent — the same reasoning
+ * `emitN8nWorkflowGate` records. Fail-closed is local instead: the hook
+ * wraps the evaluation and rethrows ANY fault as a BLOCKED error, so a gate
+ * that cannot decide refuses rather than allows.
+ *
+ * ## What is not written
+ *
+ * `opencode.json` is left alone: the model base URL is a `provider.<id>.
+ * options.baseURL` field there (or `OPENCODE_CONFIG_CONTENT`), and the static
+ * `permission` deny map cannot express argument rules — both are documented
+ * for the user, not generated. OpenCode's MCP servers are not proxy-wrapped
+ * this phase (its MCP tool ids are `<server>_<tool>`, not `mcp__<server>__
+ * <tool>`, so the allowlist backstop does not compose yet — see TD-487).
+ *
+ * @module
+ */
+/** Where OpenCode looks for project plugins (1.x globs files here, 2.x reads sub-directories). */
+export declare const OPENCODE_PLUGIN_DIR: string;
+/** The 1.x layout: one flat file. */
+export declare const OPENCODE_PLUGIN_FILE = "intutic-governance.js";
+/** The 2.x layout: `<name>/index.js`. Same bytes as the flat file. */
+export declare const OPENCODE_PLUGIN_V2_FILE: string;
+/**
+ * The plugin source. ESM, because a 1.x loader does `Object.values(module)`
+ * and a CommonJS file would surface every `module.exports` property as a
+ * named export (Bun and Node both synthesise them) — a string `id` among
+ * them is a `TypeError` at load. `createRequire` keeps the gate body's own
+ * `require()` calls (fs, os, path, crypto, http) working under ESM.
+ */
+export declare function buildPluginScript(proxyUrl: string, workspaceRoot: string, workspaceId: string): string;
+/**
+ * Write the OpenCode plugin under `<workspaceRoot>/.opencode/plugins/`, in
+ * both layouts (see the module doc): `intutic-governance.js` for 1.x and
+ * `intutic-governance/index.js` for 2.x — identical bytes.
+ *
+ * Safe to call repeatedly — atomic rename (`.intutic-tmp` → final path) and
+ * fixed file names, so repeated syncs replace rather than stack. Nothing
+ * else is touched: OpenCode discovers the files by scanning the directory.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the plugin header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export declare function writeOpenCodeHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+//# sourceMappingURL=openCodeHooks.d.ts.map

package/dist/harness/openCodeHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/openCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAUH,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,QAAoC,CAAA;AACpE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB,0BAA0B,CAAA;AAC3D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,QAA8C,CAAA;AAElF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAwItG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/harness/openCodeHooks.js

@@ -0,0 +1,248 @@
+/**
+ * openCodeHooks.ts — OpenCode plugin gate (TD-397).
+ *
+ * OpenCode (the open-source terminal coding agent: npm `opencode-ai` 1.x,
+ * `@opencode/cli` 2.x) has no hook file, no hook JSON and no stdin/stdout
+ * gate contract. What it has is a **plugin**: a JavaScript module OpenCode
+ * loads INTO ITS OWN PROCESS from `.opencode/plugins/*.{js,ts}` (project) or
+ * `~/.config/opencode/plugins/`, or from an npm package named in
+ * `opencode.json`. The plugin returns hooks; one of them runs before every
+ * tool call and vetoes it by throwing:
+ *
+ *   - 1.x: `export default async (input) => ({ "tool.execute.before": async (i, o) => { … } })`,
+ *     `i = { tool, sessionID, callID }`, `o = { args }`. Fired from
+ *     `packages/opencode/src/session/tools.ts` before `item.execute(args, ctx)`,
+ *     for built-in tools, the `task` tool and MCP tools alike. A thrown Error
+ *     becomes a `tool-error` part whose message the model reads; the tool
+ *     never runs. (OpenCode's own docs demonstrate exactly this shape to keep
+ *     `read` away from `.env`.)
+ *   - 2.x: `ctx.tool.hook("execute.before", (event) => { … })` with
+ *     `event = { tool, input, sessionID, … }`; "only tool execute.before may
+ *     fail: a Tool.Error rejects the call before it runs". 2.x does NOT run
+ *     1.x-shaped plugins, and it discovers local plugins as DIRECTORIES —
+ *     `.opencode/plugins/<name>/index.{js,ts}` — while 1.x globs FILES —
+ *     `.opencode/{plugin,plugins}/*.{js,ts}` — so each line sees only its
+ *     own layout. The same module is therefore written twice: the flat file
+ *     for 1.x and `<name>/index.js` for 2.x. Its default export is the 1.x
+ *     plugin function, which also carries `id`, `server` and `setup` so a
+ *     2.x loader reading `default.setup()` finds the same gate. The 1.x
+ *     loader accepts a function (or an object with a `.server` function) and
+ *     rejects anything else, which is why the file exports exactly one value.
+ *
+ * The typed 1.x `permission.ask` hook is NOT used: it has had no trigger site
+ * since v1.0.182 and would be a gate that never fires.
+ *
+ * ## Same gate as every other hook harness
+ *
+ * The file embeds the shared `emitJsGate` body with the `'throw'` contract:
+ * the compiled-in floor, `~/.intutic/hooks/policy-snapshot.rules`, the WHERE
+ * clauses and the audit line are exactly what `codex-check.js` or
+ * `muse-check.js` enforce. This is why the plugin is a generated file and not
+ * an `@intutic/gate` npm dependency: gate-js does not carry the floor, and a
+ * dependency the user's project has to `bun install` is one more thing to
+ * drift. Nothing to register — OpenCode globs the directory.
+ *
+ * ## In-process, so no process-level handlers
+ *
+ * The plugin runs inside OpenCode. `emitJsFailClosedPrelude` (an
+ * `uncaughtException` handler that exits 2) would exit the user's editor on
+ * any unrelated fault, so it is deliberately absent — the same reasoning
+ * `emitN8nWorkflowGate` records. Fail-closed is local instead: the hook
+ * wraps the evaluation and rethrows ANY fault as a BLOCKED error, so a gate
+ * that cannot decide refuses rather than allows.
+ *
+ * ## What is not written
+ *
+ * `opencode.json` is left alone: the model base URL is a `provider.<id>.
+ * options.baseURL` field there (or `OPENCODE_CONFIG_CONTENT`), and the static
+ * `permission` deny map cannot express argument rules — both are documented
+ * for the user, not generated. OpenCode's MCP servers are not proxy-wrapped
+ * this phase (its MCP tool ids are `<server>_<tool>`, not `mcp__<server>__
+ * <tool>`, so the allowlist backstop does not compose yet — see TD-487).
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { createLogger } from '@intutic/logger';
+import { newIso } from '@intutic/id';
+import { emitJsGate, REVIEW_REQUESTS_BASENAME } from './gateBody.js';
+const log = createLogger('sync-opencode-hooks');
+/** Where OpenCode looks for project plugins (1.x globs files here, 2.x reads sub-directories). */
+export const OPENCODE_PLUGIN_DIR = path.join('.opencode', 'plugins');
+/** The 1.x layout: one flat file. */
+export const OPENCODE_PLUGIN_FILE = 'intutic-governance.js';
+/** The 2.x layout: `<name>/index.js`. Same bytes as the flat file. */
+export const OPENCODE_PLUGIN_V2_FILE = path.join('intutic-governance', 'index.js');
+/**
+ * The plugin source. ESM, because a 1.x loader does `Object.values(module)`
+ * and a CommonJS file would surface every `module.exports` property as a
+ * named export (Bun and Node both synthesise them) — a string `id` among
+ * them is a `TypeError` at load. `createRequire` keeps the gate body's own
+ * `require()` calls (fs, os, path, crypto, http) working under ESM.
+ */
+export function buildPluginScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    return `/**
+ * Intutic OpenCode governance plugin.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ *
+ * Runs INSIDE OpenCode as a plugin (1.x: tool.execute.before; 2.x: tool
+ * execute.before). Refuses a tool call by throwing — OpenCode turns the
+ * thrown message into the tool-error the model reads, and the tool never
+ * runs. See services/sync-daemon/src/harness/openCodeHooks.ts.
+ */
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+${emitJsGate({ harness: 'opencode', contract: 'throw', reviewRequestFile: path.join(workspaceRoot, '.intutic', 'events', REVIEW_REQUESTS_BASENAME) })}
+
+let _intuticSessionId = '';
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    const entry = JSON.stringify({
+      event: verdict,
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'opencode',
+      timestamp: ts,
+      incidentId,
+      ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
+    }) + '\\n';
+    const logPath = ${JSON.stringify(hookEventsLog)};
+    try { fs.mkdirSync(path.dirname(logPath), { recursive: true }); } catch {}
+    fs.appendFileSync(logPath, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+/**
+ * One tool call. Returns to allow; throws '[Intutic Governance] BLOCKED: …'
+ * to refuse. \`args\` is the tool's argument object (1.x: output.args; 2.x:
+ * event.input). Anything that is not an object is refused outright — the
+ * gate reads paths and commands out of it, and an argument shape it cannot
+ * read is the same anomaly the stdin gates' envelope guard refuses.
+ */
+function intuticEvaluate(toolName, args, sessionID) {
+  _intuticSessionId = sessionID || '';
+  const tool = String(toolName || 'tool');
+  if (!args || typeof args !== 'object' || Array.isArray(args)) {
+    const reason = '[Intutic Governance] BLOCKED: tool "' + tool + '" was called with arguments the gate cannot read (' +
+      (args === null ? 'null' : typeof args) + '); refusing rather than allowing a call it cannot evaluate.';
+    try { logEvent('tool_blocked', tool, reason); } catch (e) {}
+    throw new Error(reason);
+  }
+  const targetPath = args.filePath || args.path || args.file_path || args.file || args.target || args.notebook_path || '';
+  const command = args.command || args.cmd || args.script || '';
+  intuticGate(tool, targetPath, command, logEvent, _intuticWsId, args);
+  logEvent('tool_allowed', tool, '');
+}
+
+/** Fail CLOSED: a fault inside the gate is a refusal, never an allow. */
+function intuticGuarded(toolName, args, sessionID) {
+  try {
+    intuticEvaluate(toolName, args, sessionID);
+  } catch (err) {
+    const msg = String((err && err.message) || err);
+    if (msg.indexOf('[Intutic Governance]') === 0) throw err;
+    const reason = '[Intutic Governance] BLOCKED: gate fault (failing closed): ' + msg;
+    try { logEvent('tool_blocked', String(toolName || 'unknown'), reason); } catch (e) {}
+    throw new Error(reason);
+  }
+}
+
+// One load-time line, so a missing or stale snapshot is visible in OpenCode's
+// stderr rather than silently enforcing only the floor.
+function intuticAnnounce() {
+  try {
+    const snap = intuticLoadSnapshot(_intuticWsId);
+    const line = '[Intutic Governance] OpenCode plugin loaded (snapshot: ' + snap.state + ', rules: ' + snap.rules.length + ')';
+    try { process.stderr.write(line + '\\n'); } catch (e) {}
+    try { logEvent('plugin_loaded', 'opencode', 'snapshot ' + snap.state); } catch (e) {}
+  } catch (e) { /* never fail the load */ }
+}
+
+// ── 1.x: Plugin = (input) => Promise<Hooks> ───────────────────────────────
+async function intuticServer(_input) {
+  if (!globalThis.__intuticOpencode) { globalThis.__intuticOpencode = true; intuticAnnounce(); }
+  return {
+    'tool.execute.before': async (input, output) => {
+      intuticGuarded(input && input.tool, output && output.args, input && input.sessionID);
+    },
+  };
+}
+
+// ── 2.x: plugin.setup(ctx) registering a tool execute.before hook ─────────
+async function intuticSetup(ctx) {
+  if (!globalThis.__intuticOpencode) { globalThis.__intuticOpencode = true; intuticAnnounce(); }
+  await ctx.tool.hook('execute.before', (event) => {
+    intuticGuarded(event && event.tool, event && event.input, event && event.sessionID);
+  });
+}
+
+const plugin = intuticServer;
+plugin.id = 'intutic-governance';
+plugin.server = intuticServer;
+plugin.setup = intuticSetup;
+export default plugin;
+`;
+}
+/**
+ * Write the OpenCode plugin under `<workspaceRoot>/.opencode/plugins/`, in
+ * both layouts (see the module doc): `intutic-governance.js` for 1.x and
+ * `intutic-governance/index.js` for 2.x — identical bytes.
+ *
+ * Safe to call repeatedly — atomic rename (`.intutic-tmp` → final path) and
+ * fixed file names, so repeated syncs replace rather than stack. Nothing
+ * else is touched: OpenCode discovers the files by scanning the directory.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the plugin header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writeOpenCodeHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    const pluginDir = path.join(workspaceRoot, OPENCODE_PLUGIN_DIR);
+    await fs.mkdir(pluginDir, { recursive: true });
+    const script = buildPluginScript(proxyUrl, workspaceRoot, workspaceId);
+    for (const rel of [OPENCODE_PLUGIN_FILE, OPENCODE_PLUGIN_V2_FILE]) {
+        const pluginPath = path.join(pluginDir, rel);
+        await fs.mkdir(path.dirname(pluginPath), { recursive: true });
+        const tmp = pluginPath + '.intutic-tmp';
+        await fs.writeFile(tmp, script, 'utf-8');
+        await fs.rename(tmp, pluginPath);
+        log.info({ action: 'opencode_plugin_written', path: pluginPath }, 'OpenCode governance plugin written');
+    }
+}
+//# sourceMappingURL=openCodeHooks.js.map

package/dist/harness/openCodeHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openCodeHooks.js","sourceRoot":"","sources":["../../src/harness/openCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;AACpE,qCAAqC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAA;AAC3D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAA;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IAC5F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;YAGG,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;;;;;;;;;;gFAiBwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;sBAgB/H,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqFlD,CAAA;AACD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAC/D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;IACtE,KAAK,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACxC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACzG,CAAC;AACH,CAAC"}

package/dist/harness/openWebuiHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openWebuiHooks.d.ts","sourceRoot":"","sources":["../../src/harness/openWebuiHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmHH;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
+{"version":3,"file":"openWebuiHooks.d.ts","sourceRoot":"","sources":["../../src/harness/openWebuiHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgKH;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf"}