@intutic/sync-daemon 2.0.0 → 2.2.0

package/dist/harness/claudeProjectApproval.js

@@ -0,0 +1,159 @@
+/**
+ * claudeProjectApproval.ts — which of a repo's `.mcp.json` servers Claude Code
+ * would start, decided the way Claude Code decides it.
+ *
+ * The sync daemon governs project-scope servers through wrapped local-scope
+ * copies (mcpAutoWrite.ts's `shadowProjectServers`), and a local-scope server
+ * starts without Claude Code's project-server approval. So a copy may exist
+ * only for a server Claude Code would itself start; anything looser would let
+ * a cloned repository approve its own server and have us wrap and start it.
+ *
+ * Claude Code's rules (https://code.claude.com/docs/en/mcp, "Project server
+ * approvals and workspace trust"):
+ *
+ * - Approvals (`enableAllProjectMcpServers`, `enabledMcpjsonServers`) from
+ *   the user's `~/.claude/settings.json`, managed settings and the user's own
+ *   record in `~/.claude.json` always apply.
+ * - Approvals from the project's `.claude/settings.json` and
+ *   `.claude/settings.local.json` apply only once the folder is trusted.
+ *   Trust is `projects[<repository root>].hasTrustDialogAccepted` in
+ *   `~/.claude.json` — keyed on the git root, or the main checkout's root for
+ *   a worktree, or the folder itself outside a repository. Anything we cannot
+ *   confirm counts as untrusted.
+ * - `disabledMcpjsonServers` in any of those files rejects the server,
+ *   trusted folder or not.
+ *
+ * Managed policy can also arrive through MDM (a macOS configuration profile)
+ * or the Windows registry, neither of which this module reads. Where one may
+ * be present, no project server is approved here: missing an organization's
+ * disable is the one mistake this check must not make.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import * as node_os from 'node:os';
+import { existsSync, realpathSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+function defaultManagedDir(platform) {
+    if (platform === 'darwin')
+        return '/Library/Application Support/ClaudeCode';
+    if (platform === 'win32')
+        return 'C:\\Program Files\\ClaudeCode';
+    return '/etc/claude-code';
+}
+function defaultMdmProfiles(platform) {
+    if (platform !== 'darwin')
+        return [];
+    const user = (() => {
+        try {
+            return node_os.userInfo().username;
+        }
+        catch {
+            return '';
+        }
+    })();
+    return [
+        '/Library/Managed Preferences/com.anthropic.claudecode.plist',
+        ...(user ? [`/Library/Managed Preferences/${user}/com.anthropic.claudecode.plist`] : []),
+    ];
+}
+async function readObject(file) {
+    try {
+        const parsed = JSON.parse(await node_fs.readFile(file, 'utf-8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The managed-settings documents: `managed-settings.json` and the `managed-settings.d/` drop-ins. */
+async function readManaged(dir) {
+    const out = [];
+    const main = await readObject(node_path.join(dir, 'managed-settings.json'));
+    if (main)
+        out.push(main);
+    try {
+        const dropIns = (await node_fs.readdir(node_path.join(dir, 'managed-settings.d'))).filter((f) => f.endsWith('.json')).sort();
+        for (const f of dropIns) {
+            const doc = await readObject(node_path.join(dir, 'managed-settings.d', f));
+            if (doc)
+                out.push(doc);
+        }
+    }
+    catch {
+        // No drop-in directory.
+    }
+    return out;
+}
+/**
+ * The path(s) Claude Code may key this folder's trust on: the repository root
+ * (the main checkout's root for a worktree), or the folder itself outside a
+ * repository — each as given and as its real path, since `projects` keys are
+ * whatever path Claude Code was started with.
+ */
+function trustKeys(workspaceRoot) {
+    const keys = new Set([workspaceRoot]);
+    try {
+        const common = execFileSync('git', ['-C', workspaceRoot, 'rev-parse', '--path-format=absolute', '--git-common-dir'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+        }).trim();
+        if (common)
+            keys.add(node_path.dirname(common));
+    }
+    catch {
+        // Not a repository, or no git: the folder itself is the key.
+    }
+    for (const k of [...keys]) {
+        try {
+            keys.add(realpathSync(k));
+        }
+        catch {
+            // A key that does not resolve stays as given.
+        }
+    }
+    return [...keys];
+}
+/**
+ * Decides which project servers Claude Code would start for `workspaceRoot`,
+ * given the parsed `~/.claude.json` (`claudeState`).
+ */
+export async function projectServerApproval(workspaceRoot, claudeState, env = {}) {
+    const platform = env.platform ?? process.platform;
+    const mdmProfiles = env.mdmProfiles ?? defaultMdmProfiles(platform);
+    if (platform === 'win32' || mdmProfiles.some((p) => existsSync(p))) {
+        return {
+            approved: () => false,
+            blockedReason: 'Claude Code managed policy may be deployed through MDM or the registry, which Intutic cannot read, so no project server is copied',
+        };
+    }
+    const projectEntry = (key) => {
+        const entry = claudeState.projects?.[key];
+        return entry !== null && typeof entry === 'object' && !Array.isArray(entry) ? entry : {};
+    };
+    const keys = trustKeys(workspaceRoot);
+    const trusted = keys.some((k) => projectEntry(k).hasTrustDialogAccepted === true);
+    const userSources = [
+        projectEntry(workspaceRoot),
+        ...(await readManaged(env.managedDir ?? defaultManagedDir(platform))),
+    ];
+    const userSettings = await readObject(node_path.join(node_os.homedir(), '.claude', 'settings.json'));
+    if (userSettings)
+        userSources.push(userSettings);
+    const projectSources = [];
+    for (const file of ['settings.json', 'settings.local.json']) {
+        const doc = await readObject(node_path.join(workspaceRoot, '.claude', file));
+        if (doc)
+            projectSources.push(doc);
+    }
+    const names = (v) => (Array.isArray(v) ? v.filter((n) => typeof n === 'string') : []);
+    const approving = trusted ? [...userSources, ...projectSources] : userSources;
+    const all = approving.some((src) => src.enableAllProjectMcpServers === true);
+    const enabled = new Set(approving.flatMap((src) => names(src.enabledMcpjsonServers)));
+    // A disable counts from every file, the committed ones included.
+    const disabled = new Set([...userSources, ...projectSources].flatMap((src) => names(src.disabledMcpjsonServers)));
+    return { approved: (name) => !disabled.has(name) && (all || enabled.has(name)) };
+}
+//# sourceMappingURL=claudeProjectApproval.js.map

package/dist/harness/claudeProjectApproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeProjectApproval.js","sourceRoot":"","sources":["../../src/harness/claudeProjectApproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAuBjD,SAAS,iBAAiB,CAAC,QAAyB;IAClD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,yCAAyC,CAAA;IAC3E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,+BAA+B,CAAA;IAChE,OAAO,kBAAkB,CAAA;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAyB;IACnD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO;QACL,6DAA6D;QAC7D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gCAAgC,IAAI,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACzE,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAyB,CAAC,CAAC,CAAC,IAAI,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAA;IAC3E,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5H,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1E,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,aAAqB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,EAAE;YACnH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,WAAmD,EACnD,MAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACjD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACnE,IAAI,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;YACrB,aAAa,EACX,mIAAmI;SACtI,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAW,EAAyD,EAAE;QAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACzC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAwB,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9G,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAA;IAEjF,MAAM,WAAW,GAAqB;QACpC,YAAY,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;KACtE,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IACpG,IAAI,YAAY;QAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAEhD,MAAM,cAAc,GAAqB,EAAE,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;QAC5E,IAAI,GAAG;YAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3G,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC7E,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IACrF,iEAAiE;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;IACjH,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC"}

package/dist/harness/clineHooks.d.ts

@@ -1,12 +1,31 @@
 /**
- * clineHooks.ts — Cline PreToolUse governance hook injection.
+ * clineHooks.ts — Cline PreToolUse governance hook.
  *
- * Writes .cline/hooks/hooks.json and the Intutic pre-tool-check
- * script into the workspace. Cline's hook system accepts JSON on stdin
- * and blocks execution when the script returns {"cancel": true}.
+ * Cline runs file hooks: an executable named exactly `PreToolUse` (no
+ * extension on macOS/Linux) in a hooks directory, fed the pending tool call as
+ * JSON on stdin. It refuses the call when the hook prints `{"cancel": true}`
+ * on stdout; the exit code does not decide anything. Confirmed against
+ * Cline's source (apps/vscode/src/core/hooks, sdk/packages/core/src/hooks):
  *
- * NOTE: Hooks are placed in .cline/hooks/ (NOT .clinerules/hooks/) to avoid
- * ENOTDIR conflict — .clinerules is written as a flat file by the CLI adapter.
+ * - The VS Code extension reads `<workspace>/.clinerules/hooks/PreToolUse` and
+ *   runs it only when "Enable Hooks" is on in Cline's feature settings and the
+ *   file is executable. Its payload is
+ *   `{hookName, preToolUse: {toolName, parameters}}`, each parameter value
+ *   JSON-encoded as a string.
+ * - The Cline CLI/SDK searches the same `.clinerules/hooks` directory (plus
+ *   `.cline/hooks` and two user-level directories). Its payload is
+ *   `{hookName, tool_call: {id, name, input}}`.
+ *
+ * So one file, `.clinerules/hooks/PreToolUse`, covers both, and the gate
+ * accepts both payload shapes. There is no `hooks.json` and no matcher: the
+ * hook runs for every tool call, MCP calls (`use_mcp_tool`) included, and the
+ * gate decides from the arguments.
+ *
+ * `.clinerules` must therefore be a directory. Earlier versions wrote it as a
+ * flat rules file (and registered the gate in a `.cline/hooks/hooks.json`
+ * Cline never reads); `ensureClinerulesDirectory` converts the flat file this
+ * product wrote, and leaves a flat `.clinerules` the user wrote alone — in
+ * that case no gate can be installed and a warning says why.
  *
  * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
@@ -14,10 +33,21 @@
  * @module
  */
 /**
- * Write the Intutic governance hook into .cline/hooks/.
+ * Make `<workspace>/.clinerules` a directory, converting the flat rules file
+ * earlier versions of this product wrote there.
+ *
+ * @returns `true` when `.clinerules` is (now) a directory; `false` when it is a
+ *          file the user wrote, which is left alone (a warning is logged).
+ */
+export declare function ensureClinerulesDirectory(workspaceRoot: string): Promise<boolean>;
+/**
+ * Write the Intutic gate to `<workspace>/.clinerules/hooks/PreToolUse`.
  *
  * @param workspaceRoot - Absolute workspace root path.
- * @param proxyUrl - Intutic proxy URL for inclusion in block messages.
+ * @param proxyUrl - Intutic proxy URL for inclusion in the gate header.
+ * @param workspaceId - Workspace ID embedded in every hook event payload.
+ * @returns the gate path, or `null` when it could not be installed without
+ *          overwriting a file the user owns (a warning is logged).
  */
-export declare function writeClineHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
+export declare function writeClineHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<string | null>;
 //# sourceMappingURL=clineHooks.d.ts.map

package/dist/harness/clineHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clineHooks.d.ts","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsBH;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAkJf"}
+{"version":3,"file":"clineHooks.d.ts","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAiBH;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBvF;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoKxB"}

package/dist/harness/clineHooks.js

@@ -1,12 +1,31 @@
 /**
- * clineHooks.ts — Cline PreToolUse governance hook injection.
+ * clineHooks.ts — Cline PreToolUse governance hook.
  *
- * Writes .cline/hooks/hooks.json and the Intutic pre-tool-check
- * script into the workspace. Cline's hook system accepts JSON on stdin
- * and blocks execution when the script returns {"cancel": true}.
+ * Cline runs file hooks: an executable named exactly `PreToolUse` (no
+ * extension on macOS/Linux) in a hooks directory, fed the pending tool call as
+ * JSON on stdin. It refuses the call when the hook prints `{"cancel": true}`
+ * on stdout; the exit code does not decide anything. Confirmed against
+ * Cline's source (apps/vscode/src/core/hooks, sdk/packages/core/src/hooks):
  *
- * NOTE: Hooks are placed in .cline/hooks/ (NOT .clinerules/hooks/) to avoid
- * ENOTDIR conflict — .clinerules is written as a flat file by the CLI adapter.
+ * - The VS Code extension reads `<workspace>/.clinerules/hooks/PreToolUse` and
+ *   runs it only when "Enable Hooks" is on in Cline's feature settings and the
+ *   file is executable. Its payload is
+ *   `{hookName, preToolUse: {toolName, parameters}}`, each parameter value
+ *   JSON-encoded as a string.
+ * - The Cline CLI/SDK searches the same `.clinerules/hooks` directory (plus
+ *   `.cline/hooks` and two user-level directories). Its payload is
+ *   `{hookName, tool_call: {id, name, input}}`.
+ *
+ * So one file, `.clinerules/hooks/PreToolUse`, covers both, and the gate
+ * accepts both payload shapes. There is no `hooks.json` and no matcher: the
+ * hook runs for every tool call, MCP calls (`use_mcp_tool`) included, and the
+ * gate decides from the arguments.
+ *
+ * `.clinerules` must therefore be a directory. Earlier versions wrote it as a
+ * flat rules file (and registered the gate in a `.cline/hooks/hooks.json`
+ * Cline never reads); `ensureClinerulesDirectory` converts the flat file this
+ * product wrote, and leaves a flat `.clinerules` the user wrote alone — in
+ * that case no gate can be installed and a warning says why.
  *
  * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
@@ -16,52 +35,91 @@
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { createLogger } from '@intutic/logger';
+import { keepOriginal, noteWritten } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
 import { emitJsGate, emitJsFailClosedPrelude, REVIEW_REQUESTS_BASENAME } from './gateBody.js';
 const log = createLogger('sync-cline-hooks');
-/** Tools Cline can invoke that require governance interception. */
-const GOVERNED_TOOLS = [
-    'execute_command',
-    'write_to_file',
-    'str_replace_based_edit_tool',
-    'replace_in_file',
-    'create_file',
-    'delete_file',
-    'rename_file',
-    'read_file', // watch for exfiltration patterns
-];
+/** First line of every rules file this product writes. */
+const RULES_HEADER = '# Intutic Governance Rules (auto-generated)';
+/** Marker line in the generated hook, used to recognise our own file. */
+const GATE_MARKER = 'Intutic Cline PreToolUse governance gate.';
 /**
- * Write the Intutic governance hook into .cline/hooks/.
+ * Make `<workspace>/.clinerules` a directory, converting the flat rules file
+ * earlier versions of this product wrote there.
+ *
+ * @returns `true` when `.clinerules` is (now) a directory; `false` when it is a
+ *          file the user wrote, which is left alone (a warning is logged).
+ */
+export async function ensureClinerulesDirectory(workspaceRoot) {
+    const rulesPath = path.join(workspaceRoot, '.clinerules');
+    let stat;
+    try {
+        stat = await fs.stat(rulesPath);
+    }
+    catch {
+        await fs.mkdir(rulesPath, { recursive: true });
+        return true;
+    }
+    if (stat.isDirectory())
+        return true;
+    const content = await fs.readFile(rulesPath, 'utf-8');
+    if (!content.startsWith(RULES_HEADER)) {
+        log.warn({ action: 'cline_rules_file_kept', path: rulesPath }, '.clinerules is a rules file you wrote, so Intutic cannot create .clinerules/hooks/ — move its content into ' +
+            '.clinerules/<name>.md to enable the Intutic gate');
+        return false;
+    }
+    await fs.unlink(rulesPath);
+    await fs.mkdir(rulesPath, { recursive: true });
+    return true;
+}
+/** Remove the `.cline/hooks` registration earlier versions wrote — Cline never
+ *  read it. Only files carrying this product's names or marker are removed. */
+async function removeLegacyRegistration(workspaceRoot) {
+    const legacyDir = path.join(workspaceRoot, '.cline', 'hooks');
+    await fs.rm(path.join(legacyDir, 'intutic-check.js'), { force: true });
+    const legacyJson = path.join(legacyDir, 'hooks.json');
+    try {
+        const parsed = JSON.parse(await fs.readFile(legacyJson, 'utf-8'));
+        if (typeof parsed._comment === 'string' && parsed._comment.startsWith('Intutic governance hooks')) {
+            await fs.unlink(legacyJson);
+        }
+    }
+    catch {
+        // Absent, or not ours to judge — left alone.
+    }
+}
+/**
+ * Write the Intutic gate to `<workspace>/.clinerules/hooks/PreToolUse`.
  *
  * @param workspaceRoot - Absolute workspace root path.
- * @param proxyUrl - Intutic proxy URL for inclusion in block messages.
+ * @param proxyUrl - Intutic proxy URL for inclusion in the gate header.
+ * @param workspaceId - Workspace ID embedded in every hook event payload.
+ * @returns the gate path, or `null` when it could not be installed without
+ *          overwriting a file the user owns (a warning is logged).
  */
 export async function writeClineHooks(workspaceRoot, proxyUrl, workspaceId = '') {
-    const hooksDir = path.join(workspaceRoot, '.cline', 'hooks');
-    const hooksJsonPath = path.join(hooksDir, 'hooks.json');
-    const checkScriptPath = path.join(hooksDir, 'intutic-check.js');
+    await removeLegacyRegistration(workspaceRoot);
+    if (!(await ensureClinerulesDirectory(workspaceRoot)))
+        return null;
+    const hooksDir = path.join(workspaceRoot, '.clinerules', 'hooks');
+    const checkScriptPath = path.join(hooksDir, 'PreToolUse');
+    await keepOriginal(checkScriptPath, workspaceRoot);
     await fs.mkdir(hooksDir, { recursive: true });
-    // ── hooks.json ──────────────────────────────────────────────────────
-    // Cline reads this file and runs matched hook scripts before tool execution.
-    // The matcher regex is matched against the tool name.
-    const hooksConfig = {
-        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
-        _lastSync: newIso(),
-        hooks: GOVERNED_TOOLS.map((tool) => ({
-            type: 'PreToolUse',
-            matcher: `^${tool}$`,
-            command: `node ${checkScriptPath}`,
-        })),
-    };
-    const tmpJson = hooksJsonPath + '.intutic-tmp';
-    await fs.writeFile(tmpJson, JSON.stringify(hooksConfig, null, 2) + '\n', 'utf-8');
-    await fs.rename(tmpJson, hooksJsonPath);
+    try {
+        const existing = await fs.readFile(checkScriptPath, 'utf-8');
+        if (!existing.includes(GATE_MARKER)) {
+            log.warn({ action: 'cline_hook_kept', path: checkScriptPath }, 'A PreToolUse hook you wrote already exists — left untouched, so the Intutic gate is not installed for Cline');
+            return null;
+        }
+    }
+    catch {
+        // No hook yet.
+    }
     // ── pre-tool-check script ────────────────────────────────────────────
-    // Cline passes tool_name + tool_input as JSON on stdin.
     // Return {"cancel": false} to allow, {"cancel": true, "errorMessage": "..."} to block.
     const checkScript = `#!/usr/bin/env node
 /**
- * Intutic Cline PreToolUse governance gate.
+ * ${GATE_MARKER}
  * Auto-generated by intutic sync-daemon. DO NOT EDIT.
  * Proxy: ${proxyUrl}
  * Generated: ${newIso()}
@@ -100,7 +158,7 @@ function logEvent(verdict, toolName, reason) {
     // on any machine where nothing else had created ~/.intutic/events the append
     // threw ENOENT and was discarded — every Cline audit line, including blocks,
     // silently dropped. The other writers create this directory from the
-    // TypeScript side; Cline's writer only creates .cline/hooks, so its log
+    // TypeScript side; Cline's writer only creates its hooks directory, so its log
     // existed only by luck.
     try {
       const _dir = path.dirname(HOOK_EVENTS_LOG);
@@ -127,30 +185,50 @@ process.stdin.on('data', (c) => { raw += c; });
 process.stdin.on('end', () => {
   try {
     const ctx = JSON.parse(raw);
-    _intuticSessionId = ctx.session_id || ctx.sessionId || ctx.conversation_id || ctx.conversationId || ctx.task_id || ctx.taskId || '';
+    _intuticSessionId = ctx.taskId || ctx.task_id || ctx.session_id || ctx.sessionId || ctx.conversation_id || ctx.conversationId || '';
     // An envelope carrying none of the tool fields extracts to empty strings,
     // which match no rule — an allow. Refused instead, and the refusal CANCELS
     // (this harness ignores exit codes); see intuticGuardEnvelope.
-    intuticGuardEnvelope(ctx, ['tool_name', 'toolName', 'tool_input', 'toolInput'], logEvent);
-    const tool = (ctx.tool_name || '').toLowerCase()
-    // Case preserved for the gate. A BLOCK: SOP compiles to a tool-name
-    // pattern the operator wrote as they see it (Bash, Write) and this
-    // harness lowercases the tool for its own matching. Handing the gate the
-    // lowercased form means every SOP tool rule silently matches nothing here
-    // while appearing active everywhere else.
-    const rawToolName = ctx.tool_name || '';
-    const input = ctx.tool_input || {};
-    const inputStr = JSON.stringify(input);
+    intuticGuardEnvelope(ctx, ['tool_call', 'preToolUse', 'tool_name', 'toolName', 'tool_input', 'toolInput'], logEvent);
+
+    // Cline sends one of two shapes (see clineHooks.ts): the CLI/SDK's
+    // tool_call {name, input}, or the VS Code extension's preToolUse
+    // {toolName, parameters} with every parameter value JSON-encoded as a
+    // string. tool_name/tool_input is the generic shape the shared gate tests
+    // drive. Case is preserved for the gate: a BLOCK: SOP compiles to a
+    // tool-name pattern the operator wrote as they see it.
+    const dejson = (v) => {
+      if (typeof v !== 'string') return v;
+      try { const p = JSON.parse(v); return (p !== null && typeof p === 'object') ? p : v; } catch { return v; }
+    };
+    let rawToolName = '';
+    let input = {};
+    if (ctx.tool_call && typeof ctx.tool_call === 'object') {
+      rawToolName = ctx.tool_call.name || '';
+      input = ctx.tool_call.input;
+    } else if (ctx.preToolUse && typeof ctx.preToolUse === 'object') {
+      rawToolName = ctx.preToolUse.toolName || '';
+      const params = ctx.preToolUse.parameters || {};
+      input = {};
+      for (const k of Object.keys(params)) input[k] = dejson(params[k]);
+    } else {
+      rawToolName = ctx.tool_name || ctx.toolName || '';
+      input = ctx.tool_input || ctx.toolInput || {};
+    }
+    if (input === null || typeof input !== 'object') input = { input: input };
+    const tool = rawToolName.toLowerCase();
 
-    // This gate had two defects that hid each other. Its path list was
-    // hand-rolled as PROTECTED_PATH_FRAGMENTS with four of the twelve universal
-    // entries missing, and harnessProtectedPaths.test.ts keyed its coverage on
-    // finding a constant named PROTECTED_PATHS — so not having one read as "not
-    // a harness" rather than "unguarded". It also had no command guard at all,
-    // and ran only for six named file tools.
+    // The CLI's file and shell tools take lists (read_files {files}, run_commands
+    // {commands}); the extension's take single values. Both are read.
+    const firstFile = Array.isArray(input.files) && input.files.length > 0
+      ? (typeof input.files[0] === 'string' ? input.files[0] : (input.files[0] && input.files[0].path) || '')
+      : '';
+    const commands = Array.isArray(input.commands)
+      ? input.commands.map((c) => (typeof c === 'string' ? c : (c && c.command) || '')).join('\\n')
+      : '';
     const targetPath = input.path || input.file_path || input.filePath ||
-      input.target || input.source || input.notebook_path || '';
-    const command = input.command || input.cmd || input.script || '';
+      input.target || input.source || input.notebook_path || firstFile || '';
+    const command = input.command || input.cmd || input.script || commands || '';
     intuticGate(rawToolName, targetPath, command, logEvent, _intuticWsId, input);
 
     // Allow all other tool calls
@@ -171,7 +249,11 @@ process.stdin.on('end', () => {
     const tmpScript = checkScriptPath + '.intutic-tmp';
     await fs.writeFile(tmpScript, checkScript, 'utf-8');
     await fs.rename(tmpScript, checkScriptPath);
+    // Executable is what enables the hook: Cline creates new hook files 0644,
+    // i.e. toggled off.
     await fs.chmod(checkScriptPath, 0o755);
-    log.info({ action: 'cline_hooks_written', hooksDir, toolCount: GOVERNED_TOOLS.length }, 'Cline governance hooks written');
+    await noteWritten(checkScriptPath, workspaceRoot, checkScript);
+    log.info({ action: 'cline_hooks_written', path: checkScriptPath }, 'Cline PreToolUse governance hook written');
+    return checkScriptPath;
 }
 //# sourceMappingURL=clineHooks.js.map

package/dist/harness/clineHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"clineHooks.js","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAE7F,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,iBAAiB;IACjB,eAAe;IACf,6BAA6B;IAC7B,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW,EAAG,kCAAkC;CACjD,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IAE/D,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,uEAAuE;IACvE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,IAAI,GAAG;YACpB,OAAO,EAAE,QAAQ,eAAe,EAAE;SACnC,CAAC,CAAC;KACJ,CAAA;IAED,MAAM,OAAO,GAAG,aAAa,GAAG,cAAc,CAAA;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACjF,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAEvC,wEAAwE;IACxE,wDAAwD;IACxD,uFAAuF;IACvF,MAAM,WAAW,GAAG;;;;YAIV,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;;;;;;;;;gFASM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6CzG,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CzJ,CAAA;IAEC,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAA;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAEtC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,EAC7E,gCAAgC,CACjC,CAAA;AACH,CAAC"}
+{"version":3,"file":"clineHooks.js","sourceRoot":"","sources":["../../src/harness/clineHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAE7F,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,0DAA0D;AAC1D,MAAM,YAAY,GAAG,6CAA6C,CAAA;AAElE,yEAAyE;AACzE,MAAM,WAAW,GAAG,2CAA2C,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,aAAqB;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IACzD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,EACpD,6GAA6G;YAC3G,kDAAkD,CACrD,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;+EAC+E;AAC/E,KAAK,UAAU,wBAAwB,CAAC,aAAqB;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAA2B,CAAA;QAC3F,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAA;IAC7C,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAElE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IACzD,MAAM,YAAY,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,EACpD,6GAA6G,CAC9G,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,wEAAwE;IACxE,uFAAuF;IACvF,MAAM,WAAW,GAAG;;KAEjB,WAAW;;YAEJ,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;;;;;;;;;gFASM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6CzG,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEzJ,CAAA;IAEC,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAA;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3C,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACtC,MAAM,WAAW,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;IAE9D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,0CAA0C,CAAC,CAAA;IAC9G,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/harness/codexConfigMerger.d.ts

@@ -0,0 +1,38 @@
+/**
+ * codexConfigMerger.ts — point Codex's built-in OpenAI provider at the proxy.
+ *
+ * Codex reads its user config from `$CODEX_HOME/config.toml` (`~/.codex` by
+ * default). The one key this writer owns is the top-level `openai_base_url`,
+ * Codex's documented override for the built-in `openai` provider's base URL.
+ * It is user-level only, which is why this writes the user file and not a
+ * project `.codex/config.toml`. A `[model_providers.openai]` table cannot do
+ * this job: Codex reserves the built-in provider ids (`openai`, `ollama`,
+ * `lmstudio`) and does not let `model_providers` override them.
+ *
+ * Everything else in the file belongs to the user — MCP servers, profiles,
+ * model choice, comments — and is kept byte for byte: the key is replaced or
+ * inserted as a single line rather than by re-serialising the document, which
+ * would drop every comment. The result is parsed before it is written, and an
+ * existing file that does not parse is left alone.
+ *
+ * A file whose first line is the old adapter's header was written whole by
+ * that adapter (it replaced the user's config with two provider tables), so it
+ * holds nothing of the user's and is regenerated.
+ *
+ * @module
+ */
+/**
+ * Set the top-level `openai_base_url` in a Codex config.toml's text.
+ *
+ * @returns the new file content, or `null` when `raw` is not valid TOML (the
+ *          caller must leave the file alone).
+ */
+export declare function setCodexOpenaiBaseUrl(raw: string, baseUrl: string): string | null;
+/**
+ * Merge `openai_base_url` into the Codex user config at `configPath`.
+ *
+ * @returns `true` when the file now carries the URL, `false` when it was left
+ *          untouched because it is not valid TOML (a warning is logged).
+ */
+export declare function mergeCodexConfig(configPath: string, baseUrl: string): Promise<boolean>;
+//# sourceMappingURL=codexConfigMerger.d.ts.map

package/dist/harness/codexConfigMerger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexConfigMerger.d.ts","sourceRoot":"","sources":["../../src/harness/codexConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA2BH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuBjF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B5F"}