@intutic/sync-daemon 2.0.0 → 2.2.0

package/dist/harness/codexConfigMerger.js

@@ -0,0 +1,105 @@
+/**
+ * codexConfigMerger.ts — point Codex's built-in OpenAI provider at the proxy.
+ *
+ * Codex reads its user config from `$CODEX_HOME/config.toml` (`~/.codex` by
+ * default). The one key this writer owns is the top-level `openai_base_url`,
+ * Codex's documented override for the built-in `openai` provider's base URL.
+ * It is user-level only, which is why this writes the user file and not a
+ * project `.codex/config.toml`. A `[model_providers.openai]` table cannot do
+ * this job: Codex reserves the built-in provider ids (`openai`, `ollama`,
+ * `lmstudio`) and does not let `model_providers` override them.
+ *
+ * Everything else in the file belongs to the user — MCP servers, profiles,
+ * model choice, comments — and is kept byte for byte: the key is replaced or
+ * inserted as a single line rather than by re-serialising the document, which
+ * would drop every comment. The result is parsed before it is written, and an
+ * existing file that does not parse is left alone.
+ *
+ * A file whose first line is the old adapter's header was written whole by
+ * that adapter (it replaced the user's config with two provider tables), so it
+ * holds nothing of the user's and is regenerated.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { parse as parseToml } from 'smol-toml';
+import { createLogger } from '@intutic/logger';
+import { keepOriginal } from '../disconnect/originals.js';
+const log = createLogger('sync-codex-config');
+/** First line of the file the previous adapter wrote over the user's config. */
+const LEGACY_HEADER = '# Intutic proxy config (auto-generated)';
+const KEY = 'openai_base_url';
+/** Comment written above the key the first time it is inserted. */
+const KEY_COMMENT = "# Set by Intutic: routes Codex's built-in OpenAI provider through the Intutic proxy.";
+function parses(toml) {
+    try {
+        return parseToml(toml);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Set the top-level `openai_base_url` in a Codex config.toml's text.
+ *
+ * @returns the new file content, or `null` when `raw` is not valid TOML (the
+ *          caller must leave the file alone).
+ */
+export function setCodexOpenaiBaseUrl(raw, baseUrl) {
+    const source = raw.startsWith(LEGACY_HEADER) ? '' : raw;
+    if (parses(source) === null)
+        return null;
+    const line = `${KEY} = ${JSON.stringify(baseUrl)}`;
+    const lines = source.split('\n');
+    // Top-level keys must come before the first table header; a key of the same
+    // name inside a table is a different key and is not touched.
+    const firstTable = lines.findIndex((l) => /^\s*\[/.test(l));
+    const topLevelEnd = firstTable === -1 ? lines.length : firstTable;
+    const existing = lines.slice(0, topLevelEnd).findIndex((l) => new RegExp(`^\\s*${KEY}\\s*=`).test(l));
+    let next;
+    if (existing !== -1) {
+        lines[existing] = line;
+        next = lines.join('\n');
+    }
+    else {
+        next = `${KEY_COMMENT}\n${line}\n` + (source.trim() === '' ? '' : `\n${source}`);
+    }
+    const check = parses(next);
+    if (check === null || check[KEY] !== baseUrl)
+        return null;
+    return next;
+}
+/**
+ * Merge `openai_base_url` into the Codex user config at `configPath`.
+ *
+ * @returns `true` when the file now carries the URL, `false` when it was left
+ *          untouched because it is not valid TOML (a warning is logged).
+ */
+export async function mergeCodexConfig(configPath, baseUrl) {
+    let raw = '';
+    try {
+        raw = await fs.readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    const next = setCodexOpenaiBaseUrl(raw, baseUrl);
+    if (next === null) {
+        log.warn({ action: 'codex_config_merge_skipped', path: configPath }, `${configPath} is not valid TOML — left untouched; fix it and the next sync will set ${KEY}`);
+        return false;
+    }
+    if (next === raw)
+        return true;
+    // A user-level file: its record lives under the home directory.
+    await keepOriginal(configPath, os.homedir());
+    await fs.mkdir(path.dirname(configPath), { recursive: true });
+    const tmp = configPath + '.intutic-tmp';
+    await fs.writeFile(tmp, next, 'utf-8');
+    await fs.rename(tmp, configPath);
+    log.info({ action: 'codex_config_merged', path: configPath }, `Set ${KEY} in Codex config`);
+    return true;
+}
+//# sourceMappingURL=codexConfigMerger.js.map

package/dist/harness/codexConfigMerger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexConfigMerger.js","sourceRoot":"","sources":["../../src/harness/codexConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAEzD,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,gFAAgF;AAChF,MAAM,aAAa,GAAG,yCAAyC,CAAA;AAE/D,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAE7B,mEAAmE;AACnE,MAAM,WAAW,GAAG,sFAAsF,CAAA;AAE1G,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAA4B,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,OAAe;IAChE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAExC,MAAM,IAAI,GAAG,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAErG,IAAI,IAAY,CAAA;IAChB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;QACtB,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAe;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,UAAU,EAAE,EAC1D,GAAG,UAAU,0EAA0E,GAAG,EAAE,CAC7F,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAE7B,gEAAgE;IAChE,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAA;IAC3F,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/harness/codexHooks.d.ts

@@ -2,8 +2,10 @@
  * codexHooks.ts — Codex CLI PreToolUse hook injection.
  *
  * Codex CLI executes PreToolUse hooks registered in `hooks.json`:
- *   - User-level:    ~/.codex/hooks.json
- *   - Project-level: <workspaceRoot>/.codex/hooks.json
+ *   - User-level:    $CODEX_HOME/hooks.json (~/.codex/hooks.json by default)
+ *   - Project-level: <workspaceRoot>/.codex/hooks.json — Codex loads this one
+ *     only once the user has trusted the project's `.codex/` layer, so the
+ *     user-level registration is the one that always applies.
  *
  * Each PreToolUse entry carries a `matcher` regex over tool names; the hook
  * command receives JSON on stdin — {tool_name, tool_use_id, tool_input}, with

package/dist/harness/codexHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codexHooks.d.ts","sourceRoot":"","sources":["../../src/harness/codexHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAwLH;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"codexHooks.d.ts","sourceRoot":"","sources":["../../src/harness/codexHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAsLH;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/harness/codexHooks.js

@@ -2,8 +2,10 @@
  * codexHooks.ts — Codex CLI PreToolUse hook injection.
  *
  * Codex CLI executes PreToolUse hooks registered in `hooks.json`:
- *   - User-level:    ~/.codex/hooks.json
- *   - Project-level: <workspaceRoot>/.codex/hooks.json
+ *   - User-level:    $CODEX_HOME/hooks.json (~/.codex/hooks.json by default)
+ *   - Project-level: <workspaceRoot>/.codex/hooks.json — Codex loads this one
+ *     only once the user has trusted the project's `.codex/` layer, so the
+ *     user-level registration is the one that always applies.
  *
  * Each PreToolUse entry carries a `matcher` regex over tool names; the hook
  * command receives JSON on stdin — {tool_name, tool_use_id, tool_input}, with
@@ -26,8 +28,10 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
+import { keepOriginal } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
 import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 const log = createLogger('sync-codex-hooks');
 /**
  * The pre-tool gate script — receives Codex's PreToolUse JSON on stdin,
@@ -139,13 +143,9 @@ process.stdin.on('end', () => {
  * uses — so repeated syncs are idempotent and never stack duplicate entries.
  */
 async function mergeCodexHooksJson(configPath, hookScriptPath) {
-    let existing = {};
-    try {
-        existing = JSON.parse(await fs.readFile(configPath, 'utf-8'));
-    }
-    catch {
-        // File doesn't exist or is malformed — start fresh
-    }
+    const existing = await readJsonObjectForMerge(configPath);
+    if (existing === null)
+        return;
     const existingHooks = existing.hooks ?? {};
     const existingPreToolUse = Array.isArray(existingHooks.PreToolUse)
         ? existingHooks.PreToolUse
@@ -215,11 +215,14 @@ export async function writeCodexHooks(workspaceRoot, proxyUrl, workspaceId = '')
     await fs.chmod(hookScriptPath, 0o755);
     // 1. Project-level: <root>/.codex/hooks.json
     const projectCodexDir = path.join(workspaceRoot, '.codex');
+    await keepOriginal(path.join(projectCodexDir, 'hooks.json'), workspaceRoot);
     await fs.mkdir(projectCodexDir, { recursive: true });
     await mergeCodexHooksJson(path.join(projectCodexDir, 'hooks.json'), hookScriptPath);
     log.info({ action: 'codex_hooks_written', level: 'project', path: projectCodexDir }, 'Codex project-level hooks written');
-    // 2. User-level: ~/.codex/hooks.json
-    const userCodexDir = path.join(os.homedir(), '.codex');
+    // 2. User-level: $CODEX_HOME/hooks.json — Codex keeps its user config in
+    // CODEX_HOME when set, ~/.codex otherwise.
+    const userCodexDir = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    await keepOriginal(path.join(userCodexDir, 'hooks.json'), workspaceRoot);
     await fs.mkdir(userCodexDir, { recursive: true });
     await mergeCodexHooksJson(path.join(userCodexDir, 'hooks.json'), hookScriptPath);
     log.info({ action: 'codex_hooks_written', level: 'user', path: userCodexDir }, 'Codex user-level hooks written');

package/dist/harness/codexHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"codexHooks.js","sourceRoot":"","sources":["../../src/harness/codexHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;gFASc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkB7B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDpD,CAAA;AACD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,cAAsB;IAC3E,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,MAAM,aAAa,GAAI,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAA;IACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;QAChE,CAAC,CAAE,aAAa,CAAC,UAAwB;QACzC,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,UAAU,GAAG,SAAS,cAAc,GAAG,CAAA;IAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CACT,CAAC,CAAU,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAC/F,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,wDAAwD;IACxD,OAAQ,QAAoC,CAAC,kBAAkB,CAAC,CAAA;IAChE,OAAQ,QAAoC,CAAC,oBAAoB,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG;QACb,GAAG,QAAQ;QACX,WAAW,EACT,mFAAmF;YACnF,cAAc,MAAM,EAAE,EAAE;QAC1B,KAAK,EAAE;YACL,GAAG,aAAa;YAChB,UAAU,EAAE;gBACV,GAAG,QAAQ;gBACX;oBACE,iEAAiE;oBACjE,mEAAmE;oBACnE,kDAAkD;oBAClD,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;iBAClD;aACF;SACF;KACF,CAAA;IAED,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IACjE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IACnF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAEzH,qCAAqC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,gCAAgC,CAAC,CAAA;AAClH,CAAC"}
+{"version":3,"file":"codexHooks.js","sourceRoot":"","sources":["../../src/harness/codexHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;gFASc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkB7B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDpD,CAAA;AACD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,cAAsB;IAC3E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAM;IAE7B,MAAM,aAAa,GAAI,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAA;IACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;QAChE,CAAC,CAAE,aAAa,CAAC,UAAwB;QACzC,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,UAAU,GAAG,SAAS,cAAc,GAAG,CAAA;IAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CACT,CAAC,CAAU,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAC/F,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,wDAAwD;IACxD,OAAQ,QAAoC,CAAC,kBAAkB,CAAC,CAAA;IAChE,OAAQ,QAAoC,CAAC,oBAAoB,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG;QACb,GAAG,QAAQ;QACX,WAAW,EACT,mFAAmF;YACnF,cAAc,MAAM,EAAE,EAAE;QAC1B,KAAK,EAAE;YACL,GAAG,aAAa;YAChB,UAAU,EAAE;gBACV,GAAG,QAAQ;gBACX;oBACE,iEAAiE;oBACjE,mEAAmE;oBACnE,kDAAkD;oBAClD,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;iBAClD;aACF;SACF;KACF,CAAA;IAED,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IACjE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC1D,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAA;IAC3E,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IACnF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;IAEzH,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;IAChF,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,gCAAgC,CAAC,CAAA;AAClH,CAAC"}

package/dist/harness/continueConfigMerger.d.ts

@@ -0,0 +1,46 @@
+/**
+ * continueConfigMerger.ts — point Continue's OpenAI and Anthropic models at
+ * the proxy.
+ *
+ * Continue reads its models from `~/.continue/config.yaml`. This sets
+ * `apiBase` on each model whose `provider` is `openai` or `anthropic` — the two
+ * wire protocols the proxy serves — and leaves every other model, and every
+ * other key, alone. Pointing an Ollama or Gemini model at the proxy would break
+ * it, so those are not touched.
+ *
+ * Continue joins its request path onto `apiBase` with URL resolution
+ * (`chat/completions` for OpenAI, `messages` for Anthropic), so the value is
+ * the proxy's `/v1/` with the trailing slash: without it the last path segment
+ * would be replaced instead of extended.
+ *
+ * The file is edited through the `yaml` library's document model, so comments,
+ * ordering and formatting survive. A file that does not parse, or has no
+ * `models` list, is left alone: inventing a model entry would give Continue a
+ * model with no provider or name, which it rejects.
+ *
+ * @module
+ */
+/** Result of merging the proxy URL into Continue's config.yaml text. */
+export interface ContinueMergeResult {
+    /** New file content, or `null` when the file must be left untouched. */
+    content: string | null;
+    /** Number of models now pointing at the proxy. */
+    routed: number;
+    /** Why the file was left untouched, when `content` is `null`. */
+    skipped?: 'unparseable' | 'no-models';
+}
+/**
+ * Set `apiBase` on every OpenAI/Anthropic model in a Continue config.yaml.
+ *
+ * @param raw     - Current file content.
+ * @param apiBase - The proxy's OpenAI-style base URL (host + `/v1`).
+ */
+export declare function setContinueApiBase(raw: string, apiBase: string): ContinueMergeResult;
+/**
+ * Merge the proxy URL into Continue's config.yaml at `configPath`.
+ *
+ * @returns the number of models routed through the proxy; 0 when the file was
+ *          missing, unparseable or had no OpenAI/Anthropic model (logged).
+ */
+export declare function mergeContinueConfig(configPath: string, apiBase: string): Promise<number>;
+//# sourceMappingURL=continueConfigMerger.d.ts.map

package/dist/harness/continueConfigMerger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continueConfigMerger.d.ts","sourceRoot":"","sources":["../../src/harness/continueConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,aAAa,GAAG,WAAW,CAAA;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAkBpF;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B9F"}

package/dist/harness/continueConfigMerger.js

@@ -0,0 +1,94 @@
+/**
+ * continueConfigMerger.ts — point Continue's OpenAI and Anthropic models at
+ * the proxy.
+ *
+ * Continue reads its models from `~/.continue/config.yaml`. This sets
+ * `apiBase` on each model whose `provider` is `openai` or `anthropic` — the two
+ * wire protocols the proxy serves — and leaves every other model, and every
+ * other key, alone. Pointing an Ollama or Gemini model at the proxy would break
+ * it, so those are not touched.
+ *
+ * Continue joins its request path onto `apiBase` with URL resolution
+ * (`chat/completions` for OpenAI, `messages` for Anthropic), so the value is
+ * the proxy's `/v1/` with the trailing slash: without it the last path segment
+ * would be replaced instead of extended.
+ *
+ * The file is edited through the `yaml` library's document model, so comments,
+ * ordering and formatting survive. A file that does not parse, or has no
+ * `models` list, is left alone: inventing a model entry would give Continue a
+ * model with no provider or name, which it rejects.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { parseDocument, isMap, isSeq } from 'yaml';
+import { createLogger } from '@intutic/logger';
+import { keepOriginal } from '../disconnect/originals.js';
+const log = createLogger('sync-continue-config');
+/** Providers whose wire protocol the proxy serves. */
+const PROXIED_PROVIDERS = new Set(['openai', 'anthropic']);
+/**
+ * Set `apiBase` on every OpenAI/Anthropic model in a Continue config.yaml.
+ *
+ * @param raw     - Current file content.
+ * @param apiBase - The proxy's OpenAI-style base URL (host + `/v1`).
+ */
+export function setContinueApiBase(raw, apiBase) {
+    const value = apiBase.endsWith('/') ? apiBase : `${apiBase}/`;
+    const doc = parseDocument(raw);
+    if (doc.errors.length > 0)
+        return { content: null, routed: 0, skipped: 'unparseable' };
+    const models = isMap(doc.contents) ? doc.contents.get('models', true) : undefined;
+    if (!isSeq(models))
+        return { content: null, routed: 0, skipped: 'no-models' };
+    let routed = 0;
+    for (const model of models.items) {
+        if (!isMap(model))
+            continue;
+        const provider = model.get('provider');
+        if (typeof provider !== 'string' || !PROXIED_PROVIDERS.has(provider))
+            continue;
+        model.set('apiBase', value);
+        routed++;
+    }
+    if (routed === 0)
+        return { content: null, routed: 0, skipped: 'no-models' };
+    return { content: doc.toString(), routed };
+}
+/**
+ * Merge the proxy URL into Continue's config.yaml at `configPath`.
+ *
+ * @returns the number of models routed through the proxy; 0 when the file was
+ *          missing, unparseable or had no OpenAI/Anthropic model (logged).
+ */
+export async function mergeContinueConfig(configPath, apiBase) {
+    let raw;
+    try {
+        raw = await fs.readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return 0;
+        throw err;
+    }
+    const result = setContinueApiBase(raw, apiBase);
+    if (result.content === null) {
+        log.warn({ action: 'continue_config_merge_skipped', path: configPath, reason: result.skipped }, result.skipped === 'unparseable'
+            ? `${configPath} is not valid YAML — left untouched`
+            : `${configPath} has no openai or anthropic model to route — left untouched`);
+        return 0;
+    }
+    if (result.content !== raw) {
+        // A user-level file: its record lives under the home directory.
+        await keepOriginal(configPath, os.homedir());
+        await fs.mkdir(path.dirname(configPath), { recursive: true });
+        const tmp = configPath + '.intutic-tmp';
+        await fs.writeFile(tmp, result.content, 'utf-8');
+        await fs.rename(tmp, configPath);
+    }
+    log.info({ action: 'continue_config_merged', path: configPath, routed: result.routed }, 'Continue models routed through the Intutic proxy');
+    return result.routed;
+}
+//# sourceMappingURL=continueConfigMerger.js.map

package/dist/harness/continueConfigMerger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continueConfigMerger.js","sourceRoot":"","sources":["../../src/harness/continueConfigMerger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAEzD,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;AAY1D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAe;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAA;IAC7D,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IAEtF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAE7E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAC9E,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC3B,MAAM,EAAE,CAAA;IACV,CAAC;IACD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAC3E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAAe;IAC3E,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA;QAC9D,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EACrF,MAAM,CAAC,OAAO,KAAK,aAAa;YAC9B,CAAC,CAAC,GAAG,UAAU,qCAAqC;YACpD,CAAC,CAAC,GAAG,UAAU,6DAA6D,CAC/E,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QAC3B,gEAAgE;QAChE,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAClC,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,kDAAkD,CAAC,CAAA;IAC3I,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}

package/dist/harness/continueHooks.d.ts

@@ -1,13 +1,11 @@
 /**
- * continueHooks.ts — Continue governance: proxy routing + CLI PreToolUse gate.
+ * continueHooks.ts — Continue CLI PreToolUse gate.
  *
- * Two mechanisms, for two different Continue surfaces:
+ * Proxy routing for Continue (the `apiBase` of each OpenAI/Anthropic model in
+ * `~/.continue/config.yaml`) is written by the CLI's Continue adapter
+ * (tools/cli/src/harness/continue.ts). This module writes only the gate.
  *
- * 1. **Proxy routing** (both surfaces): each model's `apiBase` field in
- *    `~/.continue/config.json` is set to `proxyUrl`, so LLM egress traverses
- *    the Intutic proxy.
- *
- * 2. **PreToolUse gate** (Continue **CLI `cn` only** — the IDE extension has
+ * **PreToolUse gate** (Continue **CLI `cn` only** — the IDE extension has
  *    no hook system): the CLI executes PreToolUse hooks registered in
  *    `~/.continue/settings.json` (user) and `<repo>/.continue/settings.json`
  *    (project), with a Claude-Code-compatible stdin contract —
@@ -40,9 +38,8 @@
  *    get no gate at all. Double registration is harmless: both gates evaluate
  *    the same rules, and an allow/allow or block/block pair is idempotent.
  *
- * JSONC handling: ~/.continue/config.json allows `// comments`. We strip
- * single-line comments with a regex before parsing, then write back as
- * standard JSON with a managed-file header comment.
+ * The settings files are merged, never replaced: a file that is not a plain
+ * JSON object is left alone and reported (see jsonMergeTarget.ts).
  *
  * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
@@ -50,24 +47,17 @@
  * @module
  */
 /**
- * Configure Continue: proxy routing for both surfaces, and the CLI's
- * PreToolUse gate.
- *
- *  1. Reads `~/.continue/config.json` (JSONC — strips // comments before parsing).
- *  2. Sets `apiBase = proxyUrl` on each model that doesn't already use it.
- *  3. Adds a `customInstructions` governance notice.
- *  4. Writes the merged result back atomically.
- *  5. Writes `.intutic/env/continue.env` with the proxy URL.
- *  6. Writes the gate script `.intutic/hooks/continue-check.js` and registers
- *     it in `~/.continue/settings.json` and `<root>/.continue/settings.json`
- *     (Continue CLI PreToolUse — see the module header for the
- *     `.claude/settings.json` overlap).
+ * Write the Continue CLI gate script `.intutic/hooks/continue-check.js` and
+ * register it in `~/.continue/settings.json` and
+ * `<root>/.continue/settings.json` (see the module header for the
+ * `.claude/settings.json` overlap).
  *
- * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path)
+ * and command-keyed de-duplication in both settings files.
  *
  * @param workspaceRoot - Absolute workspace root path.
- * @param proxyUrl      - Intutic proxy URL to set as model apiBase.
- * @param workspaceId   - Workspace ID stored in the env snippet.
+ * @param proxyUrl      - Intutic proxy URL written into the gate header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
  */
 export declare function writeContinueHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
 //# sourceMappingURL=continueHooks.d.ts.map

package/dist/harness/continueHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continueHooks.d.ts","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AA2MH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAoHf"}
+{"version":3,"file":"continueHooks.d.ts","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAkLH;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA+Bf"}

package/dist/harness/continueHooks.js

@@ -1,13 +1,11 @@
 /**
- * continueHooks.ts — Continue governance: proxy routing + CLI PreToolUse gate.
+ * continueHooks.ts — Continue CLI PreToolUse gate.
  *
- * Two mechanisms, for two different Continue surfaces:
+ * Proxy routing for Continue (the `apiBase` of each OpenAI/Anthropic model in
+ * `~/.continue/config.yaml`) is written by the CLI's Continue adapter
+ * (tools/cli/src/harness/continue.ts). This module writes only the gate.
  *
- * 1. **Proxy routing** (both surfaces): each model's `apiBase` field in
- *    `~/.continue/config.json` is set to `proxyUrl`, so LLM egress traverses
- *    the Intutic proxy.
- *
- * 2. **PreToolUse gate** (Continue **CLI `cn` only** — the IDE extension has
+ * **PreToolUse gate** (Continue **CLI `cn` only** — the IDE extension has
  *    no hook system): the CLI executes PreToolUse hooks registered in
  *    `~/.continue/settings.json` (user) and `<repo>/.continue/settings.json`
  *    (project), with a Claude-Code-compatible stdin contract —
@@ -40,9 +38,8 @@
  *    get no gate at all. Double registration is harmless: both gates evaluate
  *    the same rules, and an allow/allow or block/block pair is idempotent.
  *
- * JSONC handling: ~/.continue/config.json allows `// comments`. We strip
- * single-line comments with a regex before parsing, then write back as
- * standard JSON with a managed-file header comment.
+ * The settings files are merged, never replaced: a file that is not a plain
+ * JSON object is left alone and reported (see jsonMergeTarget.ts).
  *
  * LLD #14 — Phase 3 cross-harness defence (Gap 3, WS-B)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
@@ -53,28 +50,11 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
+import { keepOriginal } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
 import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 const log = createLogger('sync-continue-hooks');
-/** Default path to the Continue.dev global config file. */
-const CONTINUE_CONFIG_PATH = path.join(os.homedir(), '.continue', 'config.json');
-/** Governance notice injected into customInstructions. */
-const GOVERNANCE_NOTICE = [
-    'This workspace is governed by Intutic SOP policies.',
-    'All LLM API requests are routed through the Intutic governance proxy.',
-    'Do not remove or override the apiBase field in this configuration.',
-].join(' ');
-// ─── JSONC comment stripper ───────────────────────────────────────────────────
-/**
- * Strip single-line `// ...` comments from a JSONC string so it can be
- * parsed by JSON.parse. Block comments (`/* ... *\/`) are not stripped
- * because they are uncommon in Continue config files.
- */
-function stripJsoncComments(raw) {
-    // Remove // comments that are not inside strings.
-    // Simple approach: replace // up to end-of-line (acceptable for Continue config).
-    return raw.replace(/\/\/[^\n]*/g, '');
-}
 // ─── PreToolUse gate (Continue CLI `cn`) ──────────────────────────────────────
 /**
  * The pre-tool gate script — receives the Continue CLI's Claude-Code-compatible
@@ -191,13 +171,9 @@ process.stdin.on('end', () => {
  * repeated syncs never stack duplicate entries.
  */
 async function mergeContinueSettings(settingsPath, hookScriptPath) {
-    let existing = {};
-    try {
-        existing = JSON.parse(stripJsoncComments(await fs.readFile(settingsPath, 'utf-8')));
-    }
-    catch {
-        // File doesn't exist or is malformed — start fresh
-    }
+    const existing = await readJsonObjectForMerge(settingsPath);
+    if (existing === null)
+        return;
     const existingHooks = existing.hooks ?? {};
     const existingPreToolUse = Array.isArray(existingHooks.PreToolUse)
         ? existingHooks.PreToolUse
@@ -234,91 +210,19 @@ async function mergeContinueSettings(settingsPath, hookScriptPath) {
 }
 // ─── Main export ──────────────────────────────────────────────────────────────
 /**
- * Configure Continue: proxy routing for both surfaces, and the CLI's
- * PreToolUse gate.
+ * Write the Continue CLI gate script `.intutic/hooks/continue-check.js` and
+ * register it in `~/.continue/settings.json` and
+ * `<root>/.continue/settings.json` (see the module header for the
+ * `.claude/settings.json` overlap).
  *
- *  1. Reads `~/.continue/config.json` (JSONC — strips // comments before parsing).
- *  2. Sets `apiBase = proxyUrl` on each model that doesn't already use it.
- *  3. Adds a `customInstructions` governance notice.
- *  4. Writes the merged result back atomically.
- *  5. Writes `.intutic/env/continue.env` with the proxy URL.
- *  6. Writes the gate script `.intutic/hooks/continue-check.js` and registers
- *     it in `~/.continue/settings.json` and `<root>/.continue/settings.json`
- *     (Continue CLI PreToolUse — see the module header for the
- *     `.claude/settings.json` overlap).
- *
- * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path).
+ * Safe to call repeatedly — uses atomic rename (`.intutic-tmp` → final path)
+ * and command-keyed de-duplication in both settings files.
  *
  * @param workspaceRoot - Absolute workspace root path.
- * @param proxyUrl      - Intutic proxy URL to set as model apiBase.
- * @param workspaceId   - Workspace ID stored in the env snippet.
+ * @param proxyUrl      - Intutic proxy URL written into the gate header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
  */
 export async function writeContinueHooks(workspaceRoot, proxyUrl, workspaceId = '') {
-    // ── 1. Ensure directories ──────────────────────────────────────────────────
-    const continueDir = path.join(os.homedir(), '.continue');
-    const envDir = path.join(workspaceRoot, '.intutic', 'env');
-    await Promise.all([
-        fs.mkdir(continueDir, { recursive: true }),
-        fs.mkdir(envDir, { recursive: true }),
-    ]);
-    // ── 2. Read and parse ~/.continue/config.json ─────────────────────────────
-    let configObj = {};
-    try {
-        const raw = await fs.readFile(CONTINUE_CONFIG_PATH, 'utf-8');
-        const stripped = stripJsoncComments(raw);
-        configObj = JSON.parse(stripped);
-    }
-    catch {
-        // File doesn't exist or is malformed — start with empty config
-        log.warn({ action: 'continue_config_read_failed', path: CONTINUE_CONFIG_PATH }, 'Could not read ~/.continue/config.json — creating fresh');
-    }
-    // ── 3. Update model apiBase fields ────────────────────────────────────────
-    const models = Array.isArray(configObj.models) ? configObj.models : [];
-    let modifiedCount = 0;
-    const updatedModels = models.map((model) => {
-        if (typeof model !== 'object' || model === null)
-            return model;
-        const m = model;
-        if (m.apiBase === proxyUrl)
-            return m; // Already set — no-op
-        modifiedCount++;
-        return { ...m, apiBase: proxyUrl };
-    });
-    // ── 4. Build merged config ────────────────────────────────────────────────
-    const mergedConfig = {
-        ...configObj,
-        // Re-attach updated models array (or keep original if empty)
-        ...(models.length > 0 ? { models: updatedModels } : {}),
-        // Add/overwrite customInstructions with governance notice
-        customInstructions: GOVERNANCE_NOTICE,
-        // Metadata fields
-        _intutic_managed: true,
-        _intutic_last_sync: newIso(),
-        _intutic_workspace_id: workspaceId,
-    };
-    // ── 5. Write back atomically ──────────────────────────────────────────────
-    // Prepend a managed-file warning as a comment (will be lost on next read —
-    // that's acceptable; we re-add it on each sync).
-    const managedHeader = `// AUTO-MANAGED by Intutic sync-daemon. Last sync: ${newIso()}\n// Do not edit apiBase fields — they are governance proxy routes.\n`;
-    const serialized = managedHeader + JSON.stringify(mergedConfig, null, 2) + '\n';
-    const tmpConfig = CONTINUE_CONFIG_PATH + '.intutic-tmp';
-    await fs.writeFile(tmpConfig, serialized, 'utf-8');
-    await fs.rename(tmpConfig, CONTINUE_CONFIG_PATH);
-    log.info({ action: 'continue_config_written', path: CONTINUE_CONFIG_PATH, modifiedModels: modifiedCount }, 'Continue.dev config patched with Intutic proxy apiBase');
-    // ── 6. Write .intutic/env/continue.env ────────────────────────────────────
-    const envContent = [
-        `# Intutic Continue.dev governance env — auto-generated ${newIso()}`,
-        `# This file is managed by the Intutic sync-daemon. DO NOT EDIT.`,
-        `CONTINUE_PROXY_URL=${proxyUrl}`,
-        workspaceId ? `INTUTIC_WORKSPACE_ID=${workspaceId}` : '',
-        `# All Continue.dev model requests are routed through CONTINUE_PROXY_URL.`,
-    ].filter((l) => l !== '').join('\n') + '\n';
-    const envFilePath = path.join(envDir, 'continue.env');
-    const tmpEnv = envFilePath + '.intutic-tmp';
-    await fs.writeFile(tmpEnv, envContent, 'utf-8');
-    await fs.rename(tmpEnv, envFilePath);
-    log.info({ action: 'continue_env_written', path: envFilePath }, 'Continue.dev env snippet written');
-    // ── 7. PreToolUse gate for the Continue CLI (cn) ──────────────────────────
     const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
     await fs.mkdir(hookScriptDir, { recursive: true });
     await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
@@ -331,12 +235,14 @@ export async function writeContinueHooks(workspaceRoot, proxyUrl, workspaceId =
     await fs.chmod(hookScriptPath, 0o755);
     // Project-level: <root>/.continue/settings.json
     const projectContinueDir = path.join(workspaceRoot, '.continue');
+    await keepOriginal(path.join(projectContinueDir, 'settings.json'), workspaceRoot);
     await fs.mkdir(projectContinueDir, { recursive: true });
     await mergeContinueSettings(path.join(projectContinueDir, 'settings.json'), hookScriptPath);
-    // User-level: ~/.continue/settings.json. homedir() read at call time (not the
-    // module-scope constant above) so tests that move HOME before invoking are
-    // honoured — see the gooseHooks note in generatedShellIntegrity.test.ts.
+    // User-level: ~/.continue/settings.json. homedir() read at call time so
+    // tests that move HOME before invoking are honoured — see the gooseHooks
+    // note in generatedShellIntegrity.test.ts.
     const userContinueDir = path.join(os.homedir(), '.continue');
+    await keepOriginal(path.join(userContinueDir, 'settings.json'), workspaceRoot);
     await fs.mkdir(userContinueDir, { recursive: true });
     await mergeContinueSettings(path.join(userContinueDir, 'settings.json'), hookScriptPath);
     log.info({ action: 'continue_gate_written', path: hookScriptPath }, 'Continue CLI PreToolUse gate written and registered (project + user settings.json)');