@intutic/sync-daemon 1.9.0 → 1.10.1

package/dist/configWriter.js

@@ -53,9 +53,11 @@ import { writeN8nHooks } from './harness/n8nHooks.js';
 import { writeHermesHooks } from './harness/hermesHooks.js';
 import { writeOpenclawHooks } from './harness/openclawHooks.js';
 import { writePiHooks } from './harness/piHooks.js';
-import { writeCursorHooksJson } from './harness/cursorHooksJson.js';
-import { writeGooseHooks as writeGooseHooksNative } from './harness/gooseHooksWriter.js';
-import { writeOpenHandsHooks as writeOpenHandsHooksNative } from './harness/openhandsHooksWriter.js';
+import { writeCodexHooks } from './harness/codexHooks.js';
+import { writeGithubCopilotHooks } from './harness/githubCopilotHooks.js';
+import { writeMuseHooks } from './harness/museHooks.js';
+import { writeOpenCodeHooks } from './harness/openCodeHooks.js';
+import { writeGrokHooks } from './harness/grokHooks.js';
 // ─── Harness config file mapping ─────────────────────────────────────
 /**
  * Maps each harness type to its expected config filename relative to
@@ -81,34 +83,100 @@ export const HARNESS_FILES = {
     'claude-desktop': 'claude_desktop_config.json',
     goose: '.agents/plugins/intutic-governance/hooks/hooks.json',
     'open-webui': '.open-webui/intutic-governance-filter.py',
+    langgraph: '.env.intutic',
+    // Muse Code reads AGENTS.md (falling back to CLAUDE.md) — see muse.ts (CLI)
+    // and museHooks.ts (the hook writer invoked below, same split codex uses).
+    'muse-code': 'AGENTS.md',
+    // Grok Build's native rules file — same cross-tool convention Codex/Amp
+    // read. Formatted by `formatMarkdown`, the same `---`-separated formatter
+    // Cursor/Claude Code/Windsurf/GitHub Copilot already share below.
+    grok: 'AGENTS.md',
+    // OpenCode reads AGENTS.md (CLAUDE.md fallback) — the same markdown rules
+    // file Muse/Grok get. The gate is the plugin `writeOpenCodeHooks` writes
+    // below, not this file.
+    opencode: 'AGENTS.md',
+    // dsh has no workspace-relative rules file (governance lives entirely
+    // under $DSH_HOME) — empty, same as goose/openhands below: this writer's
+    // per-harness chain deliberately does not call writeDshHooks either (see
+    // the "goose and openhands are deliberately absent here" comment above);
+    // dshHooks.ts is invoked by tools/cli/src/harness/dsh.ts's own
+    // writeConfig() and re-run on tamper by settingsGuard.ts, the same
+    // two-path coverage goose/openhands rely on instead of this loop.
+    dsh: '',
+    // Xirp writes no config of its own (orchestrates other already-gated
+    // harnesses — see gateRegistry.ts's NO_GATE row and tools/cli/src/harness/
+    // xirp.ts). Empty filename => the loop below reports it `(deferred)`,
+    // same as n8n before it gained a writer.
+    xirp: '',
+    // Agentic Orchestrator writes no config of its own either — same
+    // "delegated" shape as Xirp (orchestrates already-gated Claude Code, Codex
+    // and OpenCode — see gateRegistry.ts's NO_GATE row and
+    // tools/cli/src/harness/agenticOrchestrator.ts).
+    'agentic-orchestrator': '',
+    // Wave 1 SDK-gated frameworks — same rationale as langgraph: no on-disk
+    // hook/config file exists to gate tool calls, so each writes .env.intutic
+    // (proxy base-URL vars + an SDK-gate pointer comment). See formatContent's
+    // switch below and SDK_GATED_FRAMEWORKS.
+    langchain: '.env.intutic',
+    crewai: '.env.intutic',
+    autogen: '.env.intutic',
+    ag2: '.env.intutic',
+    'google-adk': '.env.intutic',
+    'openai-agents': '.env.intutic',
+    'pydantic-ai': '.env.intutic',
+    smolagents: '.env.intutic',
+    // A4: AWS Strands Agents — same Python SDK-gated rationale as the Wave 1
+    // family above (gate ships in intutic_clawde.gate.adapters.strands).
+    strands: '.env.intutic',
+    // T2: JS/TS SDK-gated frameworks — same rationale as the Wave 1 Python
+    // family above, but the blocking gate ships in @intutic/gate
+    // (packages/gate-js) rather than intutic-clawde. See formatContent's
+    // switch below and JS_SDK_GATED_FRAMEWORKS.
+    mastra: '.env.intutic',
+    'vercel-ai-sdk': '.env.intutic',
+    // eve (Vercel, PREVIEW) — same JS/TS SDK-gated family: the gate is
+    // @intutic/gate/eve's per-tool/per-connection approval policies, attached
+    // in the developer's own agent/ directory; this file only carries the
+    // proxy vars + pointer comment. See JS_SDK_GATED_FRAMEWORKS below.
+    eve: '.env.intutic',
+    // TrueForge (embedded-library mode only — see its HarnessType doc) — same
+    // JS/TS SDK-gated family, gate ships in @intutic/gate/trueforge. See
+    // formatContent's switch below and JS_SDK_GATED_FRAMEWORKS.
+    trueforge: '.env.intutic',
+    // A3: Vercel platform-agent runtimes — same @intutic/gate family as the T2
+    // rows above. For ai-sdk-harness the env vars are weaker still: tool
+    // execution is server-side in Vercel Sandbox microVMs the local proxy
+    // never sees (the generated comment says so — see JS_SDK_GATED_FRAMEWORKS'
+    // preamble override below and @intutic/gate/harness's module doc).
+    'ai-sdk-harness': '.env.intutic',
+    'ai-sdk-workflow': '.env.intutic',
+    // B2: AWS Bedrock AgentCore Runtime — hosts the customer's own framework
+    // code unchanged, so it writes no config of its own; the real tool-call
+    // gate belongs to whichever already-supported framework adapter that code
+    // uses (Strands, LangGraph, ...). Same 'delegated'/empty-filename shape as
+    // xirp/agentic-orchestrator above — see tools/cli/src/harness/agentcore.ts
+    // and gateKind.ts's DELEGATED_GATE_HARNESSES.
+    'agentcore-runtime': '',
+    // B3: TrueForge, standalone/hosted server (see its HarnessType doc) —
+    // writes no config of its own: it is not detected by intutic init at all
+    // (an operator-configured deployment, not a repo dependency this daemon's
+    // scanner can find), and its gate is entirely out-of-process in
+    // services/trueforge-bridge, not a file this daemon writes. Empty filename
+    // => the loop below reports it `(deferred)`, same shape as
+    // xirp/agentic-orchestrator/agentcore-runtime above, though for a
+    // genuinely different reason — those are 'delegated' (governed by a
+    // wrapped harness's own gate); this is 'bridge' (governed by a service
+    // this repo ships and operates). See gateKind.ts's BRIDGE_GATED_HARNESSES.
+    'trueforge-server': '',
 };
 /**
- * Write SOP content to all targeted harness config files.
- *
- * For each harness type, resolves the config file path, formats the
- * content according to the harness-specific format, and performs an
- * atomic write (tmp file → rename).
- *
- * @param workspaceRoot - Absolute path to the workspace root.
- * @param sops - SOPs to write, each specifying which harnesses to target.
- * @param proxyUrl - Intutic proxy URL for LLM API redirect.
- * @param harnesses - Harness types detected in the workspace.
- * @returns WriteResult with written and skipped file paths.
+ * The workspace's local SOPs (`.intutic/sops/<dir>/*.md`, narrowed by
+ * `session-context.json`'s `activeLocalSops` when present). Shared by the
+ * config writer and by the gate-cache refresh, which compiles their
+ * `review_before:` tokens into hold rules (TD-474 item 4). A missing
+ * directory is an empty list.
  */
-export async function writeConfigFiles(workspaceRoot, sops, proxyUrl, harnesses, workspaceId = '', 
-/** WS-5 Q3: 'rewrite' (default) | 'immutable' | 'alert-only' */
-bypassEnforcementTier) {
-    const filesWritten = [];
-    const filesSkipped = [];
-    // Bundled agent skills — write-if-missing, not drift-enforced
-    try {
-        const { writeBundledSkills } = await import('./skillWriter.js');
-        await writeBundledSkills(workspaceRoot);
-    }
-    catch (e) {
-        console.warn('[sync-daemon] writeBundledSkills failed (non-fatal):', e);
-    }
-    // Load and compile local SOP entries
+export async function loadLocalSopEntries(workspaceRoot, harnesses) {
     const localSopEntries = [];
     try {
         const sessionContextPath = node_path.join(workspaceRoot, '.intutic', 'session-context.json');
@@ -144,9 +212,38 @@ bypassEnforcementTier) {
             }
         }
     }
-    catch (err) {
+    catch {
         // ignore directory read errors (e.g. if sops folder doesn't exist)
     }
+    return localSopEntries;
+}
+/**
+ * Write SOP content to all targeted harness config files.
+ *
+ * For each harness type, resolves the config file path, formats the
+ * content according to the harness-specific format, and performs an
+ * atomic write (tmp file → rename).
+ *
+ * @param workspaceRoot - Absolute path to the workspace root.
+ * @param sops - SOPs to write, each specifying which harnesses to target.
+ * @param proxyUrl - Intutic proxy URL for LLM API redirect.
+ * @param harnesses - Harness types detected in the workspace.
+ * @returns WriteResult with written and skipped file paths.
+ */
+export async function writeConfigFiles(workspaceRoot, sops, proxyUrl, harnesses, workspaceId = '', 
+/** WS-5 Q3: 'rewrite' (default) | 'immutable' | 'alert-only' */
+bypassEnforcementTier) {
+    const filesWritten = [];
+    const filesSkipped = [];
+    // Bundled agent skills — write-if-missing, not drift-enforced
+    try {
+        const { writeBundledSkills } = await import('./skillWriter.js');
+        await writeBundledSkills(workspaceRoot);
+    }
+    catch (e) {
+        console.warn('[sync-daemon] writeBundledSkills failed (non-fatal):', e);
+    }
+    const localSopEntries = await loadLocalSopEntries(workspaceRoot, harnesses);
     const combinedSops = [...sops, ...localSopEntries];
     for (const harness of harnesses) {
         const filename = HARNESS_FILES[harness];
@@ -178,31 +275,29 @@ bypassEnforcementTier) {
             }
             continue;
         }
-        // Phase 4 WS-4C — native hook script writers
-        if (harness === 'cursor') {
-            try {
-                await writeCursorHooksJson(workspaceRoot);
-            }
-            catch (e) {
-                console.warn('[sync-daemon] writeCursorHooksJson failed (non-fatal):', e);
-            }
-        }
-        if (harness === 'goose') {
-            try {
-                await writeGooseHooksNative(workspaceRoot);
-            }
-            catch (e) {
-                console.warn('[sync-daemon] writeGooseHooksNative failed (non-fatal):', e);
-            }
-        }
-        if (harness === 'openhands') {
-            try {
-                await writeOpenHandsHooksNative(workspaceRoot);
-            }
-            catch (e) {
-                console.warn('[sync-daemon] writeOpenHandsHooksNative failed (non-fatal):', e);
-            }
-        }
+        // cursor is deliberately absent here, for the same reason goose and
+        // openhands are below.
+        //
+        // `cursorHooksJson` was a second writer of `.cursor/hooks.json`, and the two
+        // disagreed about the file's schema: `cursorHooks` writes an object per
+        // event carrying `failClosed: true`, while `cursorHooksJson.mergeHooks`
+        // tested `Array.isArray(existing[event])`, found false, and REPLACED it with
+        // a bare `{command}` array. So it silently dropped fail-closed and repointed
+        // the user-level shell and MCP gates at `~/.intutic/hooks/cursor-check.js`,
+        // a path no writer produces. `cursorHooks` already registers a superset of
+        // its events at both levels, so it is deleted rather than repaired.
+        // goose and openhands are deliberately absent here.
+        //
+        // They each used to get a *second* gate from this call site —
+        // gooseHooksWriter.ts and openhandsHooksWriter.ts — installed alongside the
+        // one their own writer produces. The two had contradictory models: the
+        // survivors enforce locally and fail closed, these POSTed every tool call to
+        // the control plane and failed open on any error or timeout. For openhands
+        // both wrote `.openhands/hooks.json`, so whichever ran last silently won.
+        //
+        // Deleted rather than deprecated: two modules exporting the same symbol for
+        // one harness *is* the defect. And they are not replaced by calls to the
+        // survivors here — a second call site is how this started.
         // Phase 2 deferred or unknown harness
         if (!filename) {
             filesSkipped.push(`[${harness}] (deferred)`);
@@ -270,6 +365,58 @@ bypassEnforcementTier) {
                     console.warn('[sync-daemon] writeN8nHooks failed (non-fatal):', e);
                 }
             }
+            // The .env.intutic proxy routing above governs LLM egress only; the gate
+            // is what refuses tool calls. Written alongside, same as claude-desktop.
+            if (harness === 'codex') {
+                try {
+                    await writeCodexHooks(workspaceRoot, proxyUrl, workspaceId);
+                }
+                catch (e) {
+                    console.warn('[sync-daemon] writeCodexHooks failed (non-fatal):', e);
+                }
+            }
+            // Preview mechanism (VS Code agent hooks) — the writer's header says so,
+            // and the gate fails closed if the stdin shape shifts.
+            if (harness === 'github-copilot') {
+                try {
+                    await writeGithubCopilotHooks(workspaceRoot, proxyUrl, workspaceId);
+                }
+                catch (e) {
+                    console.warn('[sync-daemon] writeGithubCopilotHooks failed (non-fatal):', e);
+                }
+            }
+            // Same split as codex/claude-desktop: AGENTS.md above carries the rules
+            // text, this installs the PreToolUse/PermissionRequest gate (project +
+            // managed tiers) and the managed_hooks_path merge into settings.json.
+            if (harness === 'muse-code') {
+                try {
+                    await writeMuseHooks(workspaceRoot, proxyUrl, workspaceId);
+                }
+                catch (e) {
+                    console.warn('[sync-daemon] writeMuseHooks failed (non-fatal):', e);
+                }
+            }
+            // AGENTS.md above carries the rules text; this writes the plugin
+            // OpenCode loads into its own process, which is the gate (TD-397).
+            if (harness === 'opencode') {
+                try {
+                    await writeOpenCodeHooks(workspaceRoot, proxyUrl, workspaceId);
+                }
+                catch (e) {
+                    console.warn('[sync-daemon] writeOpenCodeHooks failed (non-fatal):', e);
+                }
+            }
+            // AGENTS.md above governs prompt-level rules only; the gate is what
+            // refuses tool calls, and the config.toml model base_url merge is what
+            // routes LLM egress. Written alongside, same as codex/claude-desktop.
+            if (harness === 'grok') {
+                try {
+                    await writeGrokHooks(workspaceRoot, proxyUrl, workspaceId);
+                }
+                catch (e) {
+                    console.warn('[sync-daemon] writeGrokHooks failed (non-fatal):', e);
+                }
+            }
         }
         catch (err) {
             console.warn(`[sync-daemon] writeConfigFiles failed for ${filename}:`, err);
@@ -312,12 +459,37 @@ function findFuzzyMatch(content, target) {
 }
 /**
  * Apply a list of custom config edits (ADD, DELETE, REPLACE) to a workspace rule file.
+ *
+ * Returns one `ConfigEditApplyOutcome` per input suggestion (TD-349) instead
+ * of `void` — every operation's real fate (fuzzy-match miss on DELETE/
+ * REPLACE, an unresolvable target file, or the final `atomicWrite` itself
+ * failing) is recorded here rather than only `console.warn`'d, so the caller
+ * (syncLoop.ts) can ack the daemon's actual outcome back to control-plane
+ * instead of the daemon-side write being invisible to it.
  */
 export async function applyConfigEdits(workspaceRoot, appliedEdits, bypassEnforcementTier) {
+    const outcomes = [];
     for (const applied of appliedEdits) {
         const filename = HARNESS_FILES[applied.harnessType] || applied.filePath;
-        if (!filename)
+        const editsList = typeof applied.edits === 'string'
+            ? JSON.parse(applied.edits)
+            : applied.edits;
+        if (!filename) {
+            // No writable target for this harness — every operation fails to land.
+            outcomes.push({
+                suggestionId: applied.suggestionId,
+                // Vacuously ok only when there was nothing to apply in the first
+                // place — matches the `perOperation.every(...)` rule used below.
+                ok: editsList.length === 0,
+                perOperation: editsList.map((edit, index) => ({
+                    index,
+                    operation: edit.operation,
+                    applied: false,
+                    reason: `No config file resolved for harness "${applied.harnessType}"`,
+                })),
+            });
             continue;
+        }
         const filePath = node_path.join(workspaceRoot, filename);
         let currentContent = '';
         try {
@@ -327,14 +499,14 @@ export async function applyConfigEdits(workspaceRoot, appliedEdits, bypassEnforc
             // file doesn't exist
         }
         let updatedContent = currentContent;
-        const editsList = typeof applied.edits === 'string'
-            ? JSON.parse(applied.edits)
-            : applied.edits;
-        for (const edit of editsList) {
+        const perOperation = [];
+        editsList.forEach((edit, index) => {
             if (edit.operation === 'ADD') {
-                // Idempotency: skip if edit content already exists in file
+                // Idempotency: skip if edit content already exists in file — already
+                // landed, so this counts as applied, not a no-op failure.
                 if (edit.content && updatedContent.includes(edit.content)) {
-                    continue;
+                    perOperation.push({ index, operation: edit.operation, applied: true });
+                    return;
                 }
                 const header = `## ${edit.section}`;
                 if (updatedContent.includes(header)) {
@@ -343,38 +515,76 @@ export async function applyConfigEdits(workspaceRoot, appliedEdits, bypassEnforc
                 else {
                     updatedContent += `\n\n${header}\n${edit.content ?? ''}`;
                 }
+                perOperation.push({ index, operation: edit.operation, applied: true });
             }
             else if (edit.operation === 'DELETE') {
                 if (edit.content) {
                     const match = findFuzzyMatch(updatedContent, edit.content);
                     if (match) {
                         updatedContent = updatedContent.replace(match, '');
+                        perOperation.push({ index, operation: edit.operation, applied: true });
                     }
                     else {
                         console.warn(`[sync-daemon] [DELETE] Pattern not found in ${filename}:`, edit.content.slice(0, 100));
+                        perOperation.push({
+                            index,
+                            operation: edit.operation,
+                            applied: false,
+                            reason: `DELETE target pattern not found in ${filename}`,
+                        });
                     }
                 }
+                else {
+                    perOperation.push({ index, operation: edit.operation, applied: false, reason: 'DELETE edit had no content to match' });
+                }
             }
             else if (edit.operation === 'REPLACE') {
                 if (edit.target) {
                     const match = findFuzzyMatch(updatedContent, edit.target);
                     if (match) {
                         updatedContent = updatedContent.replace(match, edit.content ?? '');
+                        perOperation.push({ index, operation: edit.operation, applied: true });
                     }
                     else {
                         console.warn(`[sync-daemon] [REPLACE] Target pattern not found in ${filename}:`, edit.target.slice(0, 100));
+                        perOperation.push({
+                            index,
+                            operation: edit.operation,
+                            applied: false,
+                            reason: `REPLACE target pattern not found in ${filename}`,
+                        });
                     }
                 }
+                else {
+                    perOperation.push({ index, operation: edit.operation, applied: false, reason: 'REPLACE edit had no target to match' });
+                }
             }
-        }
+            else {
+                perOperation.push({ index, operation: edit.operation, applied: false, reason: `Unknown operation "${edit.operation}"` });
+            }
+        });
         try {
             await atomicWrite(filePath, updatedContent, bypassEnforcementTier);
             console.log(`[sync-daemon] Applied SkillOpt config edits to ${filename} (suggestion: ${applied.suggestionId})`);
         }
         catch (err) {
+            // The write itself failed (e.g. protected-path/tamper guard) — nothing
+            // that "landed" in memory above actually reached disk. Every operation
+            // that had been recorded as applied must be walked back to failed.
+            const reason = `atomicWrite failed for ${filename}: ${err instanceof Error ? err.message : String(err)}`;
             console.warn(`[sync-daemon] Failed to apply config edits to ${filename}:`, err);
+            for (const op of perOperation) {
+                op.applied = false;
+                op.reason = op.reason ?? reason;
+            }
         }
+        outcomes.push({
+            suggestionId: applied.suggestionId,
+            ok: perOperation.every((op) => op.applied),
+            perOperation,
+        });
     }
+    return outcomes;
 }
 // ─── Formatters ──────────────────────────────────────────────────────
 /** Standard file header injected at the top of every auto-generated file. */
@@ -403,6 +613,7 @@ function formatContent(harness, sops, proxyUrl) {
         case 'claude-code':
         case 'windsurf':
         case 'github-copilot':
+        case 'grok':
             return formatMarkdown(sops);
         case 'antigravity':
             return formatAntigravity(sops);
@@ -412,6 +623,29 @@ function formatContent(harness, sops, proxyUrl) {
             return formatOpenHands(sops);
         case 'codex':
             return formatCodex(sops, proxyUrl);
+        case 'langgraph':
+            return formatLanggraph(sops, proxyUrl);
+        case 'muse-code':
+        case 'opencode':
+            // AGENTS.md — same markdown shape as CLAUDE.md/.cursorrules/.windsurfrules.
+            return formatMarkdown(sops);
+        case 'langchain':
+        case 'crewai':
+        case 'autogen':
+        case 'ag2':
+        case 'google-adk':
+        case 'openai-agents':
+        case 'pydantic-ai':
+        case 'smolagents':
+        case 'strands':
+            return formatSdkGatedEnv(sops, proxyUrl, SDK_GATED_FRAMEWORKS[harness]);
+        case 'mastra':
+        case 'vercel-ai-sdk':
+        case 'eve':
+        case 'trueforge':
+        case 'ai-sdk-harness':
+        case 'ai-sdk-workflow':
+            return formatJsSdkGatedEnv(sops, proxyUrl, JS_SDK_GATED_FRAMEWORKS[harness]);
         default:
             return formatMarkdown(sops);
     }
@@ -475,6 +709,195 @@ function formatCodex(sops, proxyUrl) {
         `INTUTIC_SOP_IDS=${sopIds}\n` +
         `INTUTIC_LAST_SYNC=${newIso()}\n`);
 }
+/**
+ * LangGraph: `.env.intutic` with proxy URL vars, plus a pointer at the
+ * SDK-side tool gate. LangGraph tools are plain Python callables in the
+ * agent's own process — there is no config or hook file this daemon could
+ * write a tool-call gate into, so the env vars govern LLM egress only and
+ * the blocking gate ships in `intutic-clawde` (`intutic_clawde.gate`).
+ */
+function formatLanggraph(sops, proxyUrl) {
+    return (formatCodex(sops, proxyUrl) +
+        '\n' +
+        '# These env vars govern LLM egress only. LangGraph tools run in your own\n' +
+        '# Python process, where no config or hook file can gate them — the\n' +
+        '# blocking tool gate ships SDK-side:\n' +
+        '#   pip install intutic-clawde\n' +
+        '#   from intutic_clawde.gate import guard_tools\n');
+}
+/**
+ * Wave 1: seven more frameworks in LangGraph's family — tools are plain
+ * Python callables/objects in the agent's own process, so the daemon has no
+ * on-disk hook/config file to gate a call with, and every one of these
+ * writes the same `.env.intutic` shape `formatLanggraph` does (proxy URL
+ * vars + a comment pointing at the SDK-side gate). Declared as data here,
+ * rather than as seven more hand-copied `formatXxx` functions, so the shape
+ * cannot drift per-framework the way `gateBody.ts`'s module doc warns
+ * hand-copied gate logic does.
+ *
+ * `pipExtra` is omitted for the three frameworks with no dedicated
+ * `intutic_clawde.gate.adapters.*` module yet (autogen, ag2, pydantic-ai,
+ * smolagents ship in a later wave — see `gateRegistry.ts`'s NO_GATE rows) —
+ * their tools are governed today through the framework-agnostic
+ * `@guard`/`guard_tools` helpers, which need no optional import.
+ */
+const SDK_GATED_FRAMEWORKS = {
+    langchain: {
+        label: 'LangChain',
+        pipExtra: 'langchain',
+        importLine: 'from intutic_clawde.gate.adapters.langchain import IntuticMiddleware',
+        docsSlug: 'langchain',
+    },
+    crewai: {
+        label: 'CrewAI',
+        pipExtra: 'crewai',
+        importLine: 'from intutic_clawde.gate.adapters.crewai import install',
+        docsSlug: 'crewai',
+    },
+    autogen: {
+        label: 'AutoGen',
+        importLine: 'from intutic_clawde.gate import guard, guard_tools',
+        docsSlug: 'autogen',
+    },
+    ag2: {
+        label: 'AG2',
+        importLine: 'from intutic_clawde.gate import guard, guard_tools',
+        docsSlug: 'ag2',
+    },
+    'google-adk': {
+        label: 'Google ADK',
+        pipExtra: 'google-adk',
+        importLine: 'from intutic_clawde.gate.adapters.google_adk import IntuticPlugin',
+        docsSlug: 'google-adk',
+    },
+    'openai-agents': {
+        label: 'OpenAI Agents SDK',
+        pipExtra: 'openai-agents',
+        importLine: 'from intutic_clawde.gate.adapters.openai_agents import intutic_tool_guardrail',
+        docsSlug: 'openai-agents',
+    },
+    'pydantic-ai': {
+        label: 'Pydantic AI',
+        importLine: 'from intutic_clawde.gate import guard, guard_tools',
+        docsSlug: 'pydantic-ai',
+    },
+    smolagents: {
+        label: 'smolagents',
+        importLine: 'from intutic_clawde.gate import guard, guard_tools',
+        docsSlug: 'smolagents',
+    },
+    // A4: AWS Strands Agents — dedicated adapter module from day one
+    // (intutic_clawde.gate.adapters.strands), unlike the four `pipExtra`-less
+    // rows above that started on the framework-agnostic helpers.
+    strands: {
+        label: 'Strands Agents',
+        pipExtra: 'strands',
+        importLine: 'from intutic_clawde.gate.adapters.strands import IntuticHookProvider',
+        docsSlug: 'strands',
+    },
+};
+/** Shared formatter for every Wave 1 SDK-gated framework — see SDK_GATED_FRAMEWORKS. */
+function formatSdkGatedEnv(sops, proxyUrl, info) {
+    const pipInstall = info.pipExtra ? `intutic-clawde[${info.pipExtra}]` : 'intutic-clawde';
+    return (formatCodex(sops, proxyUrl) +
+        '\n' +
+        `# These env vars govern LLM egress only. ${info.label} tools run in your own\n` +
+        '# Python process, where no config or hook file can gate them — the\n' +
+        '# blocking tool gate ships SDK-side:\n' +
+        `#   pip install ${pipInstall}\n` +
+        `#   ${info.importLine}\n` +
+        `# See https://docs.intutic.ai/integrations/${info.docsSlug}\n`);
+}
+/**
+ * T2: two more frameworks in LangGraph's family — tools are plain
+ * objects/callables in the agent's own Node.js process, so the daemon has no
+ * on-disk hook/config file to gate a call with, and both write the same
+ * `.env.intutic` shape the Python family does. JS/TS-native, so the pointer
+ * comment reads `npm install`/`import { ... } from '@intutic/gate/<subpath>'`
+ * rather than `pip install`/`from intutic_clawde...` — see
+ * `formatJsSdkGatedEnv`.
+ */
+const JS_SDK_GATED_FRAMEWORKS = {
+    mastra: {
+        label: 'Mastra',
+        importLine: "import { intuticHooks } from '@intutic/gate/mastra'",
+        usageSummary: "new Agent({ ..., hooks: intuticHooks() }) — Mastra's beforeToolCall veto point. NOTE: " +
+            'per-call `hooks` on .generate()/.stream() OVERRIDE this, not merge with it.',
+        docsSlug: 'mastra',
+    },
+    'vercel-ai-sdk': {
+        label: 'Vercel AI SDK',
+        importLine: "import { intuticToolApproval, withIntuticProxy } from '@intutic/gate/vercel'",
+        usageSummary: 'generateText({ ..., toolApproval: intuticToolApproval() }) — the toolApproval veto ' +
+            'point. NOTE: this framework has NO env-var LLM-egress routing; the vars above do not ' +
+            'route it — use withIntuticProxy(createOpenAI)(...) or equivalent in code.',
+        docsSlug: 'vercel-ai-sdk',
+    },
+    eve: {
+        label: 'eve',
+        importLine: "import { intuticApproval, intuticAuditHooks } from '@intutic/gate/eve'",
+        usageSummary: 'defineTool({ ..., approval: intuticApproval() }) per tool (and intuticConnectionApproval() ' +
+            "per MCP/OpenAPI connection) — eve has no agent-level default approval field. NOTE: eve's " +
+            'default AI Gateway model routing is NOT proxy-governable; the vars above only reach a ' +
+            'direct-provider model built in code via withIntuticProxy(...). PREVIEW product.',
+        docsSlug: 'eve',
+    },
+    trueforge: {
+        label: 'TrueForge (embedded)',
+        importLine: "import { intuticApprovalResponder } from '@intutic/gate/trueforge'",
+        usageSummary: 'intuticApprovalResponder() answers tool.approval_required pauses with a real ' +
+            'Gate.guard() verdict, producing user.tool_approval items for your next ' +
+            'session.createTurn() call — TrueForge has no synchronous approval callback to hang a ' +
+            "function off (confirmed against a real install); see that module's doc. Covers ONLY " +
+            'the embedded-library deployment mode — TrueForge run as its own standalone/hosted ' +
+            'server is not yet supported.',
+        docsSlug: 'trueforge',
+    },
+    'ai-sdk-harness': {
+        label: 'AI SDK Harness',
+        importLine: "import { intuticApprovalResponder, intuticStaticApprovals, recommendedHarnessSettings } from '@intutic/gate/harness'",
+        usageSummary: 'toolApproval: intuticStaticApprovals(tools) routes every custom tool through the approval ' +
+            'flow; answer pauses with intuticApprovalResponder(). NOTE: built-in sandbox tools ignore ' +
+            "toolApproval entirely — set permissionMode (defaults to 'allow-all') via " +
+            'recommendedHarnessSettings(); sandbox egress never crosses this proxy — set a sandbox ' +
+            'networkPolicy.',
+        docsSlug: 'ai-sdk-harness',
+        envPreamble: [
+            'These env vars govern LLM egress from THIS process only. AI SDK Harness',
+            'agents execute their tools server-side in Vercel Sandbox microVMs — that',
+            'traffic never crosses this proxy, and no config or hook file can gate the',
+            'sandbox from here. The blocking tool gate (custom host-executed tools',
+            'only) ships SDK-side:',
+        ],
+    },
+    'ai-sdk-workflow': {
+        label: 'AI SDK Workflow',
+        importLine: "import { intuticNeedsApproval, withIntuticApproval } from '@intutic/gate/workflow'",
+        usageSummary: 'new WorkflowAgent({ ..., tools: withIntuticApproval(tools) }) — attaches an async ' +
+            'needsApproval per tool (WorkflowAgent itself has no approval option). BLOCK throws a ' +
+            'FatalError-compatible refusal so the durable runtime aborts instead of retry-looping ' +
+            "the denial; ALLOW resolves false (or true with { onAllow: 'human' }).",
+        docsSlug: 'ai-sdk-workflow',
+    },
+};
+/** Shared formatter for every T2 JS/TS SDK-gated framework — see
+ *  JS_SDK_GATED_FRAMEWORKS. Same env-var block `formatSdkGatedEnv` writes,
+ *  but "npm install"/an ESM import line/"Node.js process" in the pointer
+ *  comment, not "pip install"/"Python process". */
+function formatJsSdkGatedEnv(sops, proxyUrl, info) {
+    const preamble = info.envPreamble ?? [
+        `These env vars govern LLM egress only. ${info.label} tools run in your own`,
+        'Node.js process, where no config or hook file can gate them — the',
+        'blocking tool gate ships SDK-side:',
+    ];
+    return (formatCodex(sops, proxyUrl) +
+        '\n' +
+        preamble.map((line) => `# ${line}\n`).join('') +
+        `#   npm install @intutic/gate\n` +
+        `#   ${info.importLine}\n` +
+        `# ${info.usageSummary}\n` +
+        `# See https://docs.intutic.ai/integrations/${info.docsSlug}\n`);
+}
 // ─── Atomic file write ───────────────────────────────────────────────
 /**
  * Write content to a file atomically.
@@ -484,8 +907,12 @@ function formatCodex(sops, proxyUrl) {
  *
  * If bypassEnforcementTier === 'immutable', clears the macOS user-immutable
  * flag before writing and re-sets it after (WS-5 Q3).
+ *
+ * Exported for reuse by other full-regenerate writers in this daemon (e.g.
+ * `lib/decisionsDigest.ts`) that want the same write-tmp-then-rename
+ * atomicity without duplicating it.
  */
-async function atomicWrite(filePath, content, bypassEnforcementTier) {
+export async function atomicWrite(filePath, content, bypassEnforcementTier) {
     const dir = node_path.dirname(filePath);
     await node_fs.mkdir(dir, { recursive: true });
     // Clear immutable flag before writing (macOS only, opt-in)