@intutic/sync-daemon 2.0.0 → 2.1.0

package/dist/harness/aiderConfigMerger.js

@@ -2,8 +2,26 @@
  * aiderConfigMerger.ts — Safe YAML merge for .aider.conf.yml.
  *
  * Reads any existing .aider.conf.yml, STRIPS dangerous auto-exec keys
- * (test-cmd, lint-cmd, auto-test, auto-lint), merges in Intutic governance
- * keys (openai-api-base, anthropic-api-base), and writes back atomically.
+ * (test-cmd, lint-cmd, auto-test, auto-lint), merges in the Intutic proxy
+ * routing, and writes back atomically. Everything else in the file — lists,
+ * nested values, comments — is kept: the file is edited through the `yaml`
+ * library's document model, never re-serialised from a flattened copy.
+ *
+ * Aider rejects any config key that is not one of its command-line options
+ * ("unrecognized arguments"), so only real options are written:
+ *
+ * - `openai-api-base` — the proxy's OpenAI-style base URL (host + `/v1`).
+ * - `set-env: ANTHROPIC_BASE_URL=<host>` — Aider has no Anthropic base-URL
+ *   option; its model layer (LiteLLM) reads this variable, and wants the bare
+ *   host because it appends `/v1/messages` itself. Entries the user set for
+ *   other variables are kept.
+ * - `read: .intutic/aider-sops.md` — the SOP text, as a read-only context
+ *   file (Aider's own mechanism for conventions), written next to the config.
+ *
+ * Earlier versions wrote `anthropic-api-base` and `extra-instructions`, which
+ * are not Aider options and stopped Aider from starting; both are removed.
+ *
+ * A file that does not parse as YAML, or is not a mapping, is left untouched.
  *
  * Each strip emits a governance_config_sanitized log entry visible in
  * the control plane audit feed.
@@ -15,125 +33,131 @@
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
+import { parseDocument, isMap, isSeq, isScalar, YAMLSeq } from 'yaml';
 import { createLogger } from '@intutic/logger';
-import { newIso } from '@intutic/id';
+import { anthropicBaseUrl, openaiBaseUrl } from '@intutic/shared-types';
 const log = createLogger('sync-aider-merger');
 /**
  * Keys that Aider auto-executes on startup without user confirmation.
  * Stripping these prevents supply-chain persistence attacks.
  */
 const SUPPRESSED_KEYS = ['test-cmd', 'lint-cmd', 'auto-test', 'auto-lint', 'test_cmd', 'lint_cmd'];
-/**
- * Minimal YAML parser for .aider.conf.yml — handles simple key: value lines
- * and multi-line strings. Does not handle complex YAML. Good enough for the
- * flat structure of .aider.conf.yml.
- */
-function parseAiderYaml(raw) {
-    const result = {};
+/** Keys earlier versions wrote that Aider rejects as unrecognized arguments. */
+const INVALID_LEGACY_KEYS = ['anthropic-api-base', 'extra-instructions'];
+/** SOP file, relative to the workspace root (where Aider runs). */
+export const AIDER_SOPS_FILE = '.intutic/aider-sops.md';
+/** Header written at the top of the file. Kept short: it sits above the
+ *  user's own content, and is replaced, not stacked, on every sync. */
+const HEADER = [
+    '# Intutic: openai-api-base, the ANTHROPIC_BASE_URL set-env entry and the',
+    `# ${AIDER_SOPS_FILE} read entry are managed by intutic connect. test-cmd,`,
+    '# lint-cmd, auto-test and auto-lint are removed on every sync.',
+];
+/** Leading lines this product wrote (the header above, or the one earlier
+ *  versions wrote), removed before the file is parsed. */
+const OWN_HEADER_LINE = /^# (Intutic: |Intutic Governance Rules \(auto-generated|Last sync: |WARNING: test-cmd and lint-cmd keys are suppressed|\.intutic\/aider-sops\.md read entry|lint-cmd, auto-test and auto-lint are removed)/;
+function stripOwnHeader(raw) {
     const lines = raw.split('\n');
     let i = 0;
-    while (i < lines.length) {
-        const line = lines[i];
-        // Skip comments and blank lines
-        if (!line || line.trim().startsWith('#')) {
-            i++;
-            continue;
-        }
-        const colonIdx = line.indexOf(':');
-        if (colonIdx === -1) {
-            i++;
-            continue;
-        }
-        const key = line.slice(0, colonIdx).trim();
-        const rest = line.slice(colonIdx + 1).trim();
-        if (rest === '|' || rest === '>') {
-            // Multi-line block scalar — collect until next key or EOF
-            const blockLines = [];
-            i++;
-            while (i < lines.length && (lines[i].startsWith('  ') || lines[i] === '')) {
-                blockLines.push(lines[i].startsWith('  ') ? lines[i].slice(2) : '');
-                i++;
-            }
-            result[key] = blockLines.join('\n').trimEnd();
-        }
-        else {
-            // Strip inline quotes
-            result[key] = rest.replace(/^["']|["']$/g, '');
-            i++;
-        }
-    }
-    return result;
+    while (i < lines.length && OWN_HEADER_LINE.test(lines[i]))
+        i++;
+    if (i === 0)
+        return raw;
+    while (i < lines.length && lines[i].trim() === '')
+        i++;
+    return lines.slice(i).join('\n');
+}
+/** Turn `key`'s value into a sequence (a scalar becomes a one-item list). */
+function ensureSeq(doc, key) {
+    const current = doc.get(key, true);
+    if (isSeq(current))
+        return current;
+    const seq = new YAMLSeq();
+    if (isScalar(current) && current.value !== null && current.value !== '')
+        seq.add(current.value);
+    doc.set(key, seq);
+    return seq;
 }
 /**
- * Minimal YAML serializer — writes flat key: value pairs.
- * Multi-line values use the | block scalar style.
+ * Merge the Intutic keys into the text of an `.aider.conf.yml`.
+ *
+ * @param raw      - Current file content ('' when the file does not exist).
+ * @param proxyUrl - The proxy host (a trailing `/v1` is tolerated).
+ * @param hasSops  - Whether the SOP file is to be listed under `read`.
  */
-function serializeAiderYaml(obj) {
-    const lines = [];
-    for (const [key, value] of Object.entries(obj)) {
-        if (typeof value === 'string' && value.includes('\n')) {
-            lines.push(`${key}: |`);
-            for (const ln of value.split('\n')) {
-                lines.push(`  ${ln}`);
-            }
-        }
-        else if (typeof value === 'boolean') {
-            lines.push(`${key}: ${value}`);
-        }
-        else {
-            lines.push(`${key}: ${String(value)}`);
-        }
-    }
-    return lines.join('\n');
+export function mergeAiderYaml(raw, proxyUrl, hasSops) {
+    const doc = parseDocument(stripOwnHeader(raw));
+    if (doc.errors.length > 0)
+        return { content: null, stripped: [] };
+    // A missing, empty or comment-only file starts as an empty mapping (its
+    // comments stay on the document); anything else that is not a mapping (a
+    // list, a bare scalar) is not an Aider config to merge into.
+    if (doc.contents === null)
+        doc.contents = doc.createNode({});
+    if (!isMap(doc.contents))
+        return { content: null, stripped: [] };
+    const stripped = SUPPRESSED_KEYS.filter((key) => doc.has(key));
+    for (const key of [...stripped, ...INVALID_LEGACY_KEYS])
+        doc.delete(key);
+    doc.set('openai-api-base', openaiBaseUrl(proxyUrl));
+    const setEnv = ensureSeq(doc, 'set-env');
+    setEnv.items = setEnv.items.filter((item) => {
+        const value = isScalar(item) ? item.value : item;
+        return !(typeof value === 'string' && value.startsWith('ANTHROPIC_BASE_URL='));
+    });
+    setEnv.add(`ANTHROPIC_BASE_URL=${anthropicBaseUrl(proxyUrl)}`);
+    const read = ensureSeq(doc, 'read');
+    read.items = read.items.filter((item) => (isScalar(item) ? item.value : item) !== AIDER_SOPS_FILE);
+    if (hasSops)
+        read.add(AIDER_SOPS_FILE);
+    if (read.items.length === 0)
+        doc.delete('read');
+    return { content: `${HEADER.join('\n')}\n\n${doc.toString()}`, stripped };
 }
 /**
  * Merge Intutic governance settings into .aider.conf.yml.
  *
  * Preserves all user keys EXCEPT the suppressed auto-exec keys.
- * Adds/updates openai-api-base and anthropic-api-base.
  *
  * @param configPath - Absolute path to .aider.conf.yml
  * @param proxyUrl   - Intutic proxy URL
- * @param sopsText   - Optional SOP instructions for extra-instructions field
+ * @param sopsText   - Optional SOP instructions, written to the `read` file
+ * @returns `true` when the config was written, `false` when it was left
+ *          untouched because it is not a YAML mapping (a warning is logged).
  */
 export async function mergeAiderConfig(configPath, proxyUrl, sopsText) {
-    // Read existing config if present
-    let existing = {};
+    let raw = '';
     try {
-        const raw = await fs.readFile(configPath, 'utf-8');
-        existing = parseAiderYaml(raw);
+        raw = await fs.readFile(configPath, 'utf-8');
     }
-    catch {
-        // No existing file — start fresh
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
     }
-    // Strip dangerous auto-exec keys
-    const stripped = [];
-    for (const key of SUPPRESSED_KEYS) {
-        if (key in existing) {
-            stripped.push(key);
-            delete existing[key];
-        }
+    const { content, stripped } = mergeAiderYaml(raw, proxyUrl, Boolean(sopsText));
+    if (content === null) {
+        log.warn({ action: 'aider_config_merge_skipped', path: configPath }, `${configPath} is not a YAML mapping — left untouched; fix it and the next sync will add the Intutic keys`);
+        return false;
     }
     if (stripped.length > 0) {
         log.warn({ action: 'aider_keys_stripped', keys: stripped, path: configPath }, `Stripped dangerous auto-exec keys from .aider.conf.yml: ${stripped.join(', ')}`);
     }
-    // Merge governance keys
-    existing['openai-api-base'] = proxyUrl;
-    existing['anthropic-api-base'] = proxyUrl;
+    // The SOP file lives next to the config, under the workspace's .intutic/.
+    const sopsPath = path.join(path.dirname(configPath), AIDER_SOPS_FILE);
     if (sopsText) {
-        existing['extra-instructions'] = sopsText;
+        await fs.mkdir(path.dirname(sopsPath), { recursive: true });
+        const tmpSops = sopsPath + '.intutic-tmp';
+        await fs.writeFile(tmpSops, sopsText + '\n', 'utf-8');
+        await fs.rename(tmpSops, sopsPath);
+    }
+    else {
+        await fs.rm(sopsPath, { force: true });
     }
-    const header = [
-        '# Intutic Governance Rules (auto-generated — do not edit proxy keys)',
-        `# Last sync: ${newIso()}`,
-        `# WARNING: test-cmd and lint-cmd keys are suppressed by Intutic governance`,
-        '',
-    ].join('\n');
-    const content = header + serializeAiderYaml(existing) + '\n';
     const tmpPath = configPath + '.intutic-tmp';
     await fs.mkdir(path.dirname(configPath), { recursive: true });
     await fs.writeFile(tmpPath, content, 'utf-8');
     await fs.rename(tmpPath, configPath);
     log.info({ action: 'aider_config_written', path: configPath, stripped }, 'Aider config merged with proxy URL and dangerous keys stripped');
+    return true;
 }
 //# sourceMappingURL=aiderConfigMerger.js.map

package/dist/harness/aiderConfigMerger.js.map

@@ -1 +1 @@
-{"version":3,"file":"aiderConfigMerger.js","sourceRoot":"","sources":["../../src/harness/aiderConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAElG;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,gCAAgC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAQ;QAAC,CAAC;QAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,0DAA0D;YAC1D,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC1E,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACnE,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAC/C,CAAC;aAAM,CAAC;YACN,sBAAsB;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YAC9C,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAA4B;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;YACvB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,QAAgB,EAChB,QAAiB;IAEjB,kCAAkC;IAClC,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAClD,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,iCAAiC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EACnE,2DAA2D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAA;IAEzC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAA;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,gBAAgB,MAAM,EAAE,EAAE;QAC1B,4EAA4E;QAC5E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;IAE5D,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAC9D,gEAAgE,CACjE,CAAA;AACH,CAAC"}
+{"version":3,"file":"aiderConfigMerger.js","sourceRoot":"","sources":["../../src/harness/aiderConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAiB,MAAM,MAAM,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAElG,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAA;AAExE,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAA;AAEvD;uEACuE;AACvE,MAAM,MAAM,GAAG;IACb,0EAA0E;IAC1E,KAAK,eAAe,uDAAuD;IAC3E,gEAAgE;CACjE,CAAA;AAED;0DAC0D;AAC1D,MAAM,eAAe,GAAG,4MAA4M,CAAA;AAEpO,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAA;IAC9D,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,CAAC,EAAE,CAAA;IACtD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClC,CAAC;AAUD,6EAA6E;AAC7E,SAAS,SAAS,CAAC,GAAa,EAAE,GAAW;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IAClC,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAA;IACzB,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,QAAgB,EAAE,OAAgB;IAC5E,MAAM,GAAG,GAAa,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,6DAA6D;IAC7D,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAEhE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,mBAAmB,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAExE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAChD,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,CAAC,sBAAsB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAE9D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,CAAA;IAClG,IAAI,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAE/C,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,QAAgB,EAChB,QAAiB;IAEjB,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,UAAU,EAAE,EAC1D,GAAG,UAAU,6FAA6F,CAC3G,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EACnE,2DAA2D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAA;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;QACzC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QACrD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAC9D,gEAAgE,CACjE,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/harness/antigravityHooks.d.ts

@@ -1,16 +1,21 @@
 /**
  * antigravityHooks.ts — Gemini CLI (Antigravity) governance hook injection.
  *
- * Antigravity (Google DeepMind's Gemini CLI) supports a tool-level governance
- * hook via the `ANTIGRAVITY_PRE_TOOL_HOOK` environment variable and an optional
- * hook configuration file at `~/.gemini/settings.json`. This module:
+ * Gemini CLI runs command hooks registered under `hooks.BeforeTool` in
+ * `~/.gemini/settings.json`. Each entry carries a `matcher` regex over tool
+ * names and a list of `{type: "command", command}` hooks; the command receives
+ * `{tool_name, tool_input, ...}` on stdin and blocks the call with exit code 2
+ * (stderr is the reason). This module:
  *
- * 1. Writes a pre-tool-check.sh script to `.intutic/hooks/antigravity-check.sh`
+ * 1. Writes the gate script to `.intutic/hooks/antigravity-check.sh`
  *    (same pattern as Goose / OpenHands bash hooks).
- * 2. Merges the hook path into `~/.gemini/settings.json` under the
- *    `hooks.preTool` key.
- * 3. Optionally writes an `ANTIGRAVITY_PROXY_URL` env snippet to
- *    `.intutic/env/antigravity.env` for IDE/shell integration.
+ * 2. Merges a catch-all `BeforeTool` entry for it into
+ *    `~/.gemini/settings.json`, keeping every other setting and hook. A
+ *    settings file that is not a plain JSON object is left alone.
+ *
+ * Earlier versions registered the script under `hooks.preTool` and wrote an
+ * `ANTIGRAVITY_PRE_TOOL_HOOK` env snippet. Neither is a Gemini CLI setting, so
+ * that gate never ran; the stale `preTool` key is removed on the next write.
  *
  * Why bash and not Node.js?
  *   The Gemini CLI (antigravity) is a standalone binary; when it invokes

package/dist/harness/antigravityHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"antigravityHooks.d.ts","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAyFH;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAsEf"}
+{"version":3,"file":"antigravityHooks.d.ts","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAwFH;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA0Ef"}

package/dist/harness/antigravityHooks.js

@@ -1,16 +1,21 @@
 /**
  * antigravityHooks.ts — Gemini CLI (Antigravity) governance hook injection.
  *
- * Antigravity (Google DeepMind's Gemini CLI) supports a tool-level governance
- * hook via the `ANTIGRAVITY_PRE_TOOL_HOOK` environment variable and an optional
- * hook configuration file at `~/.gemini/settings.json`. This module:
+ * Gemini CLI runs command hooks registered under `hooks.BeforeTool` in
+ * `~/.gemini/settings.json`. Each entry carries a `matcher` regex over tool
+ * names and a list of `{type: "command", command}` hooks; the command receives
+ * `{tool_name, tool_input, ...}` on stdin and blocks the call with exit code 2
+ * (stderr is the reason). This module:
  *
- * 1. Writes a pre-tool-check.sh script to `.intutic/hooks/antigravity-check.sh`
+ * 1. Writes the gate script to `.intutic/hooks/antigravity-check.sh`
  *    (same pattern as Goose / OpenHands bash hooks).
- * 2. Merges the hook path into `~/.gemini/settings.json` under the
- *    `hooks.preTool` key.
- * 3. Optionally writes an `ANTIGRAVITY_PROXY_URL` env snippet to
- *    `.intutic/env/antigravity.env` for IDE/shell integration.
+ * 2. Merges a catch-all `BeforeTool` entry for it into
+ *    `~/.gemini/settings.json`, keeping every other setting and hook. A
+ *    settings file that is not a plain JSON object is left alone.
+ *
+ * Earlier versions registered the script under `hooks.preTool` and wrote an
+ * `ANTIGRAVITY_PRE_TOOL_HOOK` env snippet. Neither is a Gemini CLI setting, so
+ * that gate never ran; the stale `preTool` key is removed on the next write.
  *
  * Why bash and not Node.js?
  *   The Gemini CLI (antigravity) is a standalone binary; when it invokes
@@ -34,9 +39,8 @@ import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { newIso } from '@intutic/id';
 import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 const log = createLogger('sync-antigravity-hooks');
-/** Default path to the Gemini CLI global settings file. */
-const GEMINI_SETTINGS = path.join(os.homedir(), '.gemini', 'settings.json');
 /** Governance-sensitive paths that the hook gate protects. */
 // ─── Bash hook script template ────────────────────────────────────────────────
 function buildAntigravityCheckScript(proxyUrl, workspaceRoot, workspaceId) {
@@ -120,12 +124,12 @@ export async function writeAntigravityHooks(workspaceRoot, proxyUrl, workspaceId
     // ── 1. Ensure directories ──────────────────────────────────────────────────
     const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
     const hookEventsDir = path.join(workspaceRoot, '.intutic', 'events');
-    const envDir = path.join(workspaceRoot, '.intutic', 'env');
+    // homedir() read at call time so tests that move HOME are honoured.
+    const geminiSettings = path.join(os.homedir(), '.gemini', 'settings.json');
     await Promise.all([
         fs.mkdir(hookScriptDir, { recursive: true }),
         fs.mkdir(hookEventsDir, { recursive: true }),
-        fs.mkdir(envDir, { recursive: true }),
-        fs.mkdir(path.join(os.homedir(), '.gemini'), { recursive: true }),
+        fs.mkdir(path.dirname(geminiSettings), { recursive: true }),
     ]);
     // ── 2. Write hook script ───────────────────────────────────────────────────
     const hookScriptPath = path.join(hookScriptDir, 'antigravity-check.sh');
@@ -135,37 +139,45 @@ export async function writeAntigravityHooks(workspaceRoot, proxyUrl, workspaceId
     await fs.chmod(hookScriptPath, 0o755);
     log.info({ action: 'antigravity_hook_script_written', path: hookScriptPath }, 'Antigravity hook script written');
     // ── 3. Merge into ~/.gemini/settings.json ─────────────────────────────────
-    let existingSettings = {};
-    try {
-        const raw = await fs.readFile(GEMINI_SETTINGS, 'utf-8');
-        existingSettings = JSON.parse(raw);
-    }
-    catch {
-        // File doesn't exist yet — start fresh
-    }
+    const existingSettings = await readJsonObjectForMerge(geminiSettings);
+    if (existingSettings === null)
+        return;
+    const existingHooks = (typeof existingSettings.hooks === 'object' && existingSettings.hooks !== null
+        ? existingSettings.hooks
+        : {});
+    // `preTool` is where earlier versions registered the gate; it is not a
+    // Gemini CLI hook event, so it is dropped rather than carried forward.
+    const keptHooks = { ...existingHooks };
+    delete keptHooks.preTool;
+    const existingBeforeTool = Array.isArray(keptHooks.BeforeTool) ? keptHooks.BeforeTool : [];
+    // De-duplicated by command, so repeated syncs replace this entry rather than
+    // stacking copies, and every hook the user registered is kept.
+    const intuticCmd = `bash ${JSON.stringify(hookScriptPath)}`;
+    const filtered = existingBeforeTool.filter((entry) => {
+        if (typeof entry !== 'object' || entry === null)
+            return true;
+        const inner = entry.hooks ?? [];
+        return !(inner.length > 0 &&
+            inner.every((h) => typeof h === 'object' && h !== null && h.command === intuticCmd));
+    });
     const mergedSettings = {
         ...existingSettings,
         hooks: {
-            ...existingSettings.hooks,
-            // Register the pre-tool hook command
-            preTool: hookScriptPath,
+            ...keptHooks,
+            BeforeTool: [
+                ...filtered,
+                {
+                    // Catch-all: the gate decides from the arguments, so a tool name
+                    // nobody anticipated is still evaluated.
+                    matcher: '.*',
+                    hooks: [{ name: 'intutic-governance', type: 'command', command: intuticCmd }],
+                },
+            ],
         },
     };
-    const tmpSettings = GEMINI_SETTINGS + '.intutic-tmp';
+    const tmpSettings = geminiSettings + '.intutic-tmp';
     await fs.writeFile(tmpSettings, JSON.stringify(mergedSettings, null, 2) + '\n', 'utf-8');
-    await fs.rename(tmpSettings, GEMINI_SETTINGS);
-    log.info({ action: 'antigravity_settings_written', path: GEMINI_SETTINGS }, 'Merged Intutic hook into ~/.gemini/settings.json');
-    // ── 4. Write env snippet (optional — for shell profiles / IDE env) ─────────
-    const envSnippet = [
-        `# Intutic Antigravity governance hook — auto-generated ${newIso()}`,
-        `# Source this file in ~/.bashrc or ~/.zshrc to apply governance to Gemini CLI.`,
-        `export ANTIGRAVITY_PRE_TOOL_HOOK=${JSON.stringify(hookScriptPath)}`,
-        proxyUrl ? `export ANTIGRAVITY_PROXY_URL=${JSON.stringify(proxyUrl)}` : '',
-    ].filter(Boolean).join('\n') + '\n';
-    const envFilePath = path.join(envDir, 'antigravity.env');
-    const tmpEnv = envFilePath + '.intutic-tmp';
-    await fs.writeFile(tmpEnv, envSnippet, 'utf-8');
-    await fs.rename(tmpEnv, envFilePath);
-    log.info({ action: 'antigravity_env_written', path: envFilePath }, 'Antigravity env snippet written');
+    await fs.rename(tmpSettings, geminiSettings);
+    log.info({ action: 'antigravity_settings_written', path: geminiSettings }, 'Merged Intutic BeforeTool hook into ~/.gemini/settings.json');
 }
 //# sourceMappingURL=antigravityHooks.js.map

package/dist/harness/antigravityHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravityHooks.js","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAE/E,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAElD,2DAA2D;AAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AAE3E,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,2BAA2B,CAClC,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;EAEjB,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqChD,aAAa,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;;;CAG1C,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAE1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAClE,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACvE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACzG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEhH,6EAA6E;IAE7E,IAAI,gBAAgB,GAA4B,EAAE,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QACvD,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,GAAG,gBAAgB;QACnB,KAAK,EAAE;YACL,GAAI,gBAAgB,CAAC,KAAiC;YACtD,qCAAqC;YACrC,OAAO,EAAE,cAAc;SACxB;KACF,CAAA;IAED,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,CAAA;IACpD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;IAE7C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,eAAe,EAAE,EACjE,kDAAkD,CACnD,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,0DAA0D,MAAM,EAAE,EAAE;QACpE,gFAAgF;QAChF,oCAAoC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE;QACpE,QAAQ,CAAC,CAAC,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KAC3E,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,EACxD,iCAAiC,CAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"antigravityHooks.js","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAGlD,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,2BAA2B,CAClC,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;EAEjB,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqChD,aAAa,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;;;CAG1C,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IAE1E,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACvE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACzG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEhH,6EAA6E;IAE7E,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACrE,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAM;IAErC,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,KAAK,IAAI;QAClG,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,EAAE,CAA4B,CAAA;IAClC,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,SAAS,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAA;IAC/D,OAAO,SAAS,CAAC,OAAO,CAAA;IACxB,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,SAAS,CAAC,UAAwB,CAAC,CAAC,CAAC,EAAE,CAAA;IAEzG,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,QAAQ,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAAC,CAC1H,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG;QACrB,GAAG,gBAAgB;QACnB,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,UAAU,EAAE;gBACV,GAAG,QAAQ;gBACX;oBACE,iEAAiE;oBACjE,yCAAyC;oBACzC,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;iBAC9E;aACF;SACF;KACF,CAAA;IAED,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,EAChE,6DAA6D,CAC9D,CAAA;AACH,CAAC"}

package/dist/harness/claudeCodeHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/claudeCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAwBzD,gFAAgF;AAChF,eAAO,MAAM,eAAe,sCAAsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,0BAAgC,CAAA;AACrE,eAAO,MAAM,mBAAmB,0CAA2B,CAAA;AAC3D,eAAO,MAAM,sBAAsB,IAA8B,CAAA;AAmBjE,eAAO,MAAM,wBAAwB;;;IAGnC;;;;;;;;;;OAUG;;;;;;;;;;EAEH,CAAA;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAsCzE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,uBAAuB,EAAE,iBAAiB,GACrF,kBAAkB,CAgHpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,uBAAuB,EAAE,iBAAiB,EACtF,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,SAAgB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgUf;AA4ID;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB"}
+{"version":3,"file":"claudeCodeHooks.d.ts","sourceRoot":"","sources":["../../src/harness/claudeCodeHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAyBzD,gFAAgF;AAChF,eAAO,MAAM,eAAe,sCAAsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,0BAAgC,CAAA;AACrE,eAAO,MAAM,mBAAmB,0CAA2B,CAAA;AAC3D,eAAO,MAAM,sBAAsB,IAA8B,CAAA;AAmBjE,eAAO,MAAM,wBAAwB;;;IAGnC;;;;;;;;;;OAUG;;;;;;;;;;EAEH,CAAA;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAsCzE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,uBAAuB,EAAE,iBAAiB,GACrF,kBAAkB,CAgHpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,uBAAuB,EAAE,iBAAiB,EACtF,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,SAAgB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAuTf;AAiKD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/harness/claudeCodeHooks.js

@@ -17,6 +17,7 @@ import { z } from 'zod';
 import { createLogger } from '@intutic/logger';
 import { emitJsGate, emitJsFailClosedPrelude, emitPreImageCapture, REVIEW_REQUESTS_BASENAME as GATE_REVIEW_REQUESTS_BASENAME, REVIEW_REQUESTS_LOG as GATE_REVIEW_REQUESTS_LOG, REVIEW_REQUEST_VERSION as GATE_REVIEW_REQUEST_VERSION, } from './gateBody.js';
 import { emitRedactor } from './holdRedaction.js';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 const log = createLogger('sync-claude-hooks');
 /**
  * Coerces an unvalidated settings value to a string array, dropping anything else.
@@ -454,26 +455,23 @@ process.stdin.on('end', () => {
     const localClaudeDir = node_path.join(workspaceRoot, '.claude');
     await node_fs.mkdir(localClaudeDir, { recursive: true });
     const localSettingsPath = node_path.join(localClaudeDir, 'settings.json');
-    let existingLocal = {};
-    try {
-        const raw = await node_fs.readFile(localSettingsPath, 'utf-8');
-        existingLocal = JSON.parse(raw);
-    }
-    catch {
-        // Ignore
+    // A settings file that is not a plain JSON object is left untouched (and
+    // reported) rather than replaced with only the Intutic keys.
+    const existingLocal = await readJsonObjectForMerge(localSettingsPath);
+    if (existingLocal !== null) {
+        const mergedLocal = {
+            ...existingLocal,
+            permissions: {
+                ...existingLocal.permissions,
+                deny: denyRules,
+            },
+            hooks: {
+                ...existingLocal.hooks,
+                PreToolUse: mergePreToolUse(existingLocal.hooks?.['PreToolUse'], newSettings.hooks.PreToolUse),
+            },
+        };
+        await node_fs.writeFile(localSettingsPath, JSON.stringify(mergedLocal, null, 2) + '\n', 'utf-8');
     }
-    const mergedLocal = {
-        ...existingLocal,
-        permissions: {
-            ...existingLocal.permissions,
-            deny: denyRules,
-        },
-        hooks: {
-            ...existingLocal.hooks,
-            PreToolUse: newSettings.hooks.PreToolUse,
-        },
-    };
-    await node_fs.writeFile(localSettingsPath, JSON.stringify(mergedLocal, null, 2) + '\n', 'utf-8');
     // Write global settings config ~/.claude/settings.json
     //
     // GUARD (bugfix): never touch the user's real global settings from a test
@@ -490,14 +488,9 @@ process.stdin.on('end', () => {
     const globalClaudeDir = node_path.join(node_os.homedir(), '.claude');
     await node_fs.mkdir(globalClaudeDir, { recursive: true });
     const globalSettingsPath = node_path.join(globalClaudeDir, 'settings.json');
-    let existingGlobal = {};
-    try {
-        const raw = await node_fs.readFile(globalSettingsPath, 'utf-8');
-        existingGlobal = JSON.parse(raw);
-    }
-    catch {
-        // Ignore
-    }
+    const existingGlobal = await readJsonObjectForMerge(globalSettingsPath);
+    if (existingGlobal === null)
+        return;
     // Merge, prioritizing global user settings but updating permissions/hooks
     const mergedGlobal = {
         ...existingGlobal,
@@ -511,12 +504,33 @@ process.stdin.on('end', () => {
         },
         hooks: {
             ...existingGlobal.hooks,
-            PreToolUse: newSettings.hooks.PreToolUse,
+            PreToolUse: mergePreToolUse(existingGlobal.hooks?.['PreToolUse'], newSettings.hooks.PreToolUse),
         },
     };
     await node_fs.writeFile(globalSettingsPath, JSON.stringify(mergedGlobal, null, 2) + '\n', 'utf-8');
     log.info({ action: 'hooks_written' }, 'Successfully updated settings.json hooks globally and locally');
 }
+/**
+ * The PreToolUse list to write: the user's own entries, then the Intutic
+ * ones. An entry is Intutic's when every hook in it runs a gate this module
+ * wrote (`claude-code-check.js`, or `pre-tool-check.js` from earlier
+ * versions), so re-running replaces those instead of stacking copies, and a
+ * hook the user registered survives every sync.
+ */
+function mergePreToolUse(existing, intutic) {
+    const isOurs = (entry) => {
+        if (typeof entry !== 'object' || entry === null)
+            return false;
+        const inner = entry['hooks'];
+        return Array.isArray(inner) && inner.length > 0 && inner.every((h) => {
+            const command = typeof h === 'object' && h !== null ? h['command'] : undefined;
+            return typeof command === 'string' &&
+                (command.includes('.intutic/hooks/claude-code-check.js') || command.includes('.intutic/hooks/pre-tool-check.js'));
+        });
+    };
+    const kept = Array.isArray(existing) ? existing.filter((e) => !isOurs(e)) : [];
+    return [...kept, ...intutic];
+}
 // ─── Event Drain Helper ──────────────────────────────────────────────────────
 /**
  * Drains the local hook-events log file and POSTs all accumulated governance