@intutic/sync-daemon 2.0.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agentReporter.d.ts +5 -12
- package/dist/agentReporter.d.ts.map +1 -1
- package/dist/agentReporter.js +25 -4
- package/dist/agentReporter.js.map +1 -1
- package/dist/configReader.d.ts +44 -22
- package/dist/configReader.d.ts.map +1 -1
- package/dist/configReader.js +70 -44
- package/dist/configReader.js.map +1 -1
- package/dist/configWriter.d.ts +29 -41
- package/dist/configWriter.d.ts.map +1 -1
- package/dist/configWriter.js +28 -625
- package/dist/configWriter.js.map +1 -1
- package/dist/disconnect/harnesses.d.ts +31 -0
- package/dist/disconnect/harnesses.d.ts.map +1 -0
- package/dist/disconnect/harnesses.js +728 -0
- package/dist/disconnect/harnesses.js.map +1 -0
- package/dist/disconnect/index.d.ts +25 -0
- package/dist/disconnect/index.d.ts.map +1 -0
- package/dist/disconnect/index.js +82 -0
- package/dist/disconnect/index.js.map +1 -0
- package/dist/disconnect/mcp.d.ts +60 -0
- package/dist/disconnect/mcp.d.ts.map +1 -0
- package/dist/disconnect/mcp.js +283 -0
- package/dist/disconnect/mcp.js.map +1 -0
- package/dist/disconnect/originals.d.ts +88 -0
- package/dist/disconnect/originals.d.ts.map +1 -0
- package/dist/disconnect/originals.js +257 -0
- package/dist/disconnect/originals.js.map +1 -0
- package/dist/disconnect/plan.d.ts +175 -0
- package/dist/disconnect/plan.d.ts.map +1 -0
- package/dist/disconnect/plan.js +580 -0
- package/dist/disconnect/plan.js.map +1 -0
- package/dist/disconnect/recognise.d.ts +43 -0
- package/dist/disconnect/recognise.d.ts.map +1 -0
- package/dist/disconnect/recognise.js +98 -0
- package/dist/disconnect/recognise.js.map +1 -0
- package/dist/disconnect/tomlLines.d.ts +39 -0
- package/dist/disconnect/tomlLines.d.ts.map +1 -0
- package/dist/disconnect/tomlLines.js +105 -0
- package/dist/disconnect/tomlLines.js.map +1 -0
- package/dist/harness/aiderConfigMerger.d.ts +42 -5
- package/dist/harness/aiderConfigMerger.d.ts.map +1 -1
- package/dist/harness/aiderConfigMerger.js +113 -86
- package/dist/harness/aiderConfigMerger.js.map +1 -1
- package/dist/harness/antigravityHooks.d.ts +13 -8
- package/dist/harness/antigravityHooks.d.ts.map +1 -1
- package/dist/harness/antigravityHooks.js +53 -39
- package/dist/harness/antigravityHooks.js.map +1 -1
- package/dist/harness/claudeCodeHooks.d.ts +1 -2
- package/dist/harness/claudeCodeHooks.d.ts.map +1 -1
- package/dist/harness/claudeCodeHooks.js +61 -34
- package/dist/harness/claudeCodeHooks.js.map +1 -1
- package/dist/harness/claudeDesktopHooks.d.ts +3 -0
- package/dist/harness/claudeDesktopHooks.d.ts.map +1 -1
- package/dist/harness/claudeDesktopHooks.js +3 -1
- package/dist/harness/claudeDesktopHooks.js.map +1 -1
- package/dist/harness/claudeProjectApproval.d.ts +53 -0
- package/dist/harness/claudeProjectApproval.d.ts.map +1 -0
- package/dist/harness/claudeProjectApproval.js +159 -0
- package/dist/harness/claudeProjectApproval.js.map +1 -0
- package/dist/harness/clineHooks.d.ts +39 -9
- package/dist/harness/clineHooks.d.ts.map +1 -1
- package/dist/harness/clineHooks.js +142 -60
- package/dist/harness/clineHooks.js.map +1 -1
- package/dist/harness/codexConfigMerger.d.ts +38 -0
- package/dist/harness/codexConfigMerger.d.ts.map +1 -0
- package/dist/harness/codexConfigMerger.js +105 -0
- package/dist/harness/codexConfigMerger.js.map +1 -0
- package/dist/harness/codexHooks.d.ts +4 -2
- package/dist/harness/codexHooks.d.ts.map +1 -1
- package/dist/harness/codexHooks.js +14 -11
- package/dist/harness/codexHooks.js.map +1 -1
- package/dist/harness/continueConfigMerger.d.ts +46 -0
- package/dist/harness/continueConfigMerger.d.ts.map +1 -0
- package/dist/harness/continueConfigMerger.js +94 -0
- package/dist/harness/continueConfigMerger.js.map +1 -0
- package/dist/harness/continueHooks.d.ts +15 -25
- package/dist/harness/continueHooks.d.ts.map +1 -1
- package/dist/harness/continueHooks.js +25 -119
- package/dist/harness/continueHooks.js.map +1 -1
- package/dist/harness/cursorHooks.d.ts +33 -16
- package/dist/harness/cursorHooks.d.ts.map +1 -1
- package/dist/harness/cursorHooks.js +69 -25
- package/dist/harness/cursorHooks.js.map +1 -1
- package/dist/harness/dshHooks.d.ts +59 -52
- package/dist/harness/dshHooks.d.ts.map +1 -1
- package/dist/harness/dshHooks.js +152 -147
- package/dist/harness/dshHooks.js.map +1 -1
- package/dist/harness/gateBody.d.ts +11 -2
- package/dist/harness/gateBody.d.ts.map +1 -1
- package/dist/harness/gateBody.js +33 -6
- package/dist/harness/gateBody.js.map +1 -1
- package/dist/harness/gateKind.d.ts.map +1 -1
- package/dist/harness/gateKind.js +1 -0
- package/dist/harness/gateKind.js.map +1 -1
- package/dist/harness/githubCopilotHooks.d.ts.map +1 -1
- package/dist/harness/githubCopilotHooks.js +5 -10
- package/dist/harness/githubCopilotHooks.js.map +1 -1
- package/dist/harness/gooseHooks.d.ts +15 -0
- package/dist/harness/gooseHooks.d.ts.map +1 -1
- package/dist/harness/gooseHooks.js +55 -43
- package/dist/harness/gooseHooks.js.map +1 -1
- package/dist/harness/grokHooks.d.ts.map +1 -1
- package/dist/harness/grokHooks.js +14 -12
- package/dist/harness/grokHooks.js.map +1 -1
- package/dist/harness/hermesHooks.d.ts +9 -0
- package/dist/harness/hermesHooks.d.ts.map +1 -1
- package/dist/harness/hermesHooks.js +39 -33
- package/dist/harness/hermesHooks.js.map +1 -1
- package/dist/harness/holdRedaction.d.ts +4 -1
- package/dist/harness/holdRedaction.d.ts.map +1 -1
- package/dist/harness/holdRedaction.js +32 -8
- package/dist/harness/holdRedaction.js.map +1 -1
- package/dist/harness/jetbrainsXmlConfig.d.ts +20 -0
- package/dist/harness/jetbrainsXmlConfig.d.ts.map +1 -1
- package/dist/harness/jetbrainsXmlConfig.js +39 -18
- package/dist/harness/jetbrainsXmlConfig.js.map +1 -1
- package/dist/harness/jsonMergeTarget.d.ts +23 -0
- package/dist/harness/jsonMergeTarget.d.ts.map +1 -0
- package/dist/harness/jsonMergeTarget.js +50 -0
- package/dist/harness/jsonMergeTarget.js.map +1 -0
- package/dist/harness/mcpAutoWrite.d.ts +64 -20
- package/dist/harness/mcpAutoWrite.d.ts.map +1 -1
- package/dist/harness/mcpAutoWrite.js +429 -85
- package/dist/harness/mcpAutoWrite.js.map +1 -1
- package/dist/harness/museHooks.d.ts.map +1 -1
- package/dist/harness/museHooks.js +6 -2
- package/dist/harness/museHooks.js.map +1 -1
- package/dist/harness/n8nHooks.d.ts.map +1 -1
- package/dist/harness/n8nHooks.js +6 -7
- package/dist/harness/n8nHooks.js.map +1 -1
- package/dist/harness/openCodeHooks.d.ts +37 -6
- package/dist/harness/openCodeHooks.d.ts.map +1 -1
- package/dist/harness/openCodeHooks.js +103 -13
- package/dist/harness/openCodeHooks.js.map +1 -1
- package/dist/harness/openWebuiHooks.d.ts.map +1 -1
- package/dist/harness/openWebuiHooks.js +10 -5
- package/dist/harness/openWebuiHooks.js.map +1 -1
- package/dist/harness/openclawHooks.d.ts +5 -0
- package/dist/harness/openclawHooks.d.ts.map +1 -1
- package/dist/harness/openclawHooks.js +3 -1
- package/dist/harness/openclawHooks.js.map +1 -1
- package/dist/harness/openhandsHooks.d.ts +26 -1
- package/dist/harness/openhandsHooks.d.ts.map +1 -1
- package/dist/harness/openhandsHooks.js +160 -40
- package/dist/harness/openhandsHooks.js.map +1 -1
- package/dist/harness/piHooks.d.ts +17 -0
- package/dist/harness/piHooks.d.ts.map +1 -1
- package/dist/harness/piHooks.js +31 -29
- package/dist/harness/piHooks.js.map +1 -1
- package/dist/harness/protectedPaths.d.ts +64 -6
- package/dist/harness/protectedPaths.d.ts.map +1 -1
- package/dist/harness/protectedPaths.js +161 -11
- package/dist/harness/protectedPaths.js.map +1 -1
- package/dist/harness/rooCodeHooks.d.ts.map +1 -1
- package/dist/harness/rooCodeHooks.js +5 -10
- package/dist/harness/rooCodeHooks.js.map +1 -1
- package/dist/harness/windsurfHooks.d.ts +21 -3
- package/dist/harness/windsurfHooks.d.ts.map +1 -1
- package/dist/harness/windsurfHooks.js +96 -44
- package/dist/harness/windsurfHooks.js.map +1 -1
- package/dist/harness/windsurfJetBrainsProxy.d.ts +10 -7
- package/dist/harness/windsurfJetBrainsProxy.d.ts.map +1 -1
- package/dist/harness/windsurfJetBrainsProxy.js +22 -7
- package/dist/harness/windsurfJetBrainsProxy.js.map +1 -1
- package/dist/index.d.ts +12 -12
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +11 -10
- package/dist/index.js.map +1 -1
- package/dist/lib/decisionsDigest.d.ts +1 -1
- package/dist/lib/decisionsDigest.js +1 -1
- package/dist/lib/policySnapshot.d.ts +37 -0
- package/dist/lib/policySnapshot.d.ts.map +1 -1
- package/dist/lib/policySnapshot.js +170 -8
- package/dist/lib/policySnapshot.js.map +1 -1
- package/dist/sessionReporter.d.ts +2 -2
- package/dist/sessionReporter.js +2 -2
- package/dist/syncCycle.d.ts +142 -0
- package/dist/syncCycle.d.ts.map +1 -0
- package/dist/syncCycle.js +315 -0
- package/dist/syncCycle.js.map +1 -0
- package/dist/trajectoryMonitor.d.ts +1 -1
- package/dist/trajectoryMonitor.d.ts.map +1 -1
- package/dist/trajectoryMonitor.js +1 -1
- package/dist/trajectoryMonitor.js.map +1 -1
- package/dist/watcher/settingsGuard.d.ts +4 -1
- package/dist/watcher/settingsGuard.d.ts.map +1 -1
- package/dist/watcher/settingsGuard.js +42 -18
- package/dist/watcher/settingsGuard.js.map +1 -1
- package/package.json +6 -6
- package/dist/hashReporter.d.ts +0 -33
- package/dist/hashReporter.d.ts.map +0 -1
- package/dist/hashReporter.js +0 -69
- package/dist/hashReporter.js.map +0 -1
- package/dist/integrityStore.d.ts +0 -35
- package/dist/integrityStore.d.ts.map +0 -1
- package/dist/integrityStore.js +0 -71
- package/dist/integrityStore.js.map +0 -1
- package/dist/lib/gitWorktrees.d.ts +0 -140
- package/dist/lib/gitWorktrees.d.ts.map +0 -1
- package/dist/lib/gitWorktrees.js +0 -191
- package/dist/lib/gitWorktrees.js.map +0 -1
- package/dist/syncLoop.d.ts +0 -172
- package/dist/syncLoop.d.ts.map +0 -1
- package/dist/syncLoop.js +0 -878
- package/dist/syncLoop.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continueHooks.js","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"continueHooks.js","sourceRoot":"","sources":["../../src/harness/continueHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAE/C,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;;;;;;YASG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;gFASW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkBhC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDpD,CAAA;AACD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB,CAAC,YAAoB,EAAE,cAAsB;IAC/E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAA;IAC3D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAM;IAE7B,MAAM,aAAa,GAAI,QAAQ,CAAC,KAAiC,IAAI,EAAE,CAAA;IACvE,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;QAChE,CAAC,CAAE,aAAa,CAAC,UAAwB;QACzC,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,UAAU,GAAG,SAAS,cAAc,GAAG,CAAA;IAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CACT,CAAC,CAAU,EAAE,EAAE,CACb,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAC/F,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,QAAQ;QACX,gBAAgB,EAAE,8GAA8G;QAChI,kBAAkB,EAAE,MAAM,EAAE;QAC5B,KAAK,EAAE;YACL,GAAG,aAAa;YAChB,UAAU,EAAE;gBACV,GAAG,QAAQ;gBACX;oBACE,iEAAiE;oBACjE,mEAAmE;oBACnE,kDAAkD;oBAClD,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;iBAClD;aACF;SACF;KACF,CAAA;IAED,MAAM,GAAG,GAAG,YAAY,GAAG,cAAc,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;AACpC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,gDAAgD;IAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAChE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAAE,aAAa,CAAC,CAAA;IACjF,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAAE,cAAc,CAAC,CAAA;IAE3F,wEAAwE;IACxE,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAA;IAC5D,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE,aAAa,CAAC,CAAA;IAC9E,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE,cAAc,CAAC,CAAA;IAExF,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,EACzD,oFAAoF,CACrF,CAAA;AACH,CAAC"}
|
|
@@ -1,13 +1,23 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* cursorHooks.ts — Cursor
|
|
2
|
+
* cursorHooks.ts — Cursor hook injection.
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* Registers the gate in Cursor's hooks.json (schema per cursor.com/docs/agent/
|
|
5
|
+
* hooks: `{version: 1, hooks: {<event>: [{command, matcher?, failClosed?}]}}`)
|
|
6
|
+
* for three events:
|
|
7
|
+
* - `beforeShellExecution` — every shell command;
|
|
8
|
+
* - `beforeMCPExecution` — every MCP tool call;
|
|
9
|
+
* - `preToolUse` matching `Write|Delete` — file writes and deletions, which
|
|
10
|
+
* have no dedicated before-hook (`afterFileEdit` runs too late to refuse).
|
|
8
11
|
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
12
|
+
* The gate refuses with exit code 2 and allows by printing
|
|
13
|
+
* `{"permission":"allow"}`: with `failClosed: true` Cursor blocks on a hook
|
|
14
|
+
* that crashes, times out or prints nothing, so an allow must be explicit.
|
|
15
|
+
*
|
|
16
|
+
* Levels: project (`<workspaceRoot>/.cursor/hooks.json`) and user
|
|
17
|
+
* (`~/.cursor/hooks.json`) on every sync; system level
|
|
18
|
+
* (`/Library/Application Support/Cursor` on macOS, `/etc/cursor` elsewhere)
|
|
19
|
+
* only through `intutic enterprise install`, which needs root. The project and
|
|
20
|
+
* user files are merged — hooks the user registered are kept.
|
|
11
21
|
*
|
|
12
22
|
* LLD #14 — Phase 3 cross-harness defence
|
|
13
23
|
* HLD §3.14 — Three-Tier Defense Cascade
|
|
@@ -35,16 +45,23 @@ export declare function systemHooksDirFor(platform: NodeJS.Platform): string;
|
|
|
35
45
|
* @param hookScriptPath - Absolute path to the pre-tool-check script.
|
|
36
46
|
*/
|
|
37
47
|
export declare function buildHooksConfig(hookScriptPath: string): {
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
failClosed: boolean;
|
|
41
|
-
hooks: {
|
|
42
|
-
[k: string]: {
|
|
43
|
-
command: string;
|
|
44
|
-
failClosed: boolean;
|
|
45
|
-
};
|
|
46
|
-
};
|
|
48
|
+
version: number;
|
|
49
|
+
hooks: Record<string, CursorHookEntry[]>;
|
|
47
50
|
};
|
|
51
|
+
/** One entry in a Cursor hooks.json event list. */
|
|
52
|
+
export interface CursorHookEntry {
|
|
53
|
+
command: string;
|
|
54
|
+
matcher?: string;
|
|
55
|
+
failClosed?: boolean;
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Merge the Intutic entries into an existing hooks.json object: the user's
|
|
59
|
+
* entries for every event are kept, entries running this gate are replaced,
|
|
60
|
+
* and the shape earlier versions wrote (an object per event, top-level
|
|
61
|
+
* `failClosed`/`_comment`/`_lastSync`, the nonexistent `beforeFileEdit`
|
|
62
|
+
* event) is dropped.
|
|
63
|
+
*/
|
|
64
|
+
export declare function mergeHooksConfig(existing: Record<string, unknown>, hookScriptPath: string): Record<string, unknown>;
|
|
48
65
|
/**
|
|
49
66
|
* Write Cursor hooks at user-level and project-level.
|
|
50
67
|
* System-level (/etc/cursor) is handled by the corporate policy installer.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cursorHooks.d.ts","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"cursorHooks.d.ts","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAoBH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAEnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;CAAE,CAUtH;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBnH;AAsID;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,EAChB,gBAAgB,UAAQ,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Cf"}
|
|
@@ -1,13 +1,23 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* cursorHooks.ts — Cursor
|
|
2
|
+
* cursorHooks.ts — Cursor hook injection.
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* Registers the gate in Cursor's hooks.json (schema per cursor.com/docs/agent/
|
|
5
|
+
* hooks: `{version: 1, hooks: {<event>: [{command, matcher?, failClosed?}]}}`)
|
|
6
|
+
* for three events:
|
|
7
|
+
* - `beforeShellExecution` — every shell command;
|
|
8
|
+
* - `beforeMCPExecution` — every MCP tool call;
|
|
9
|
+
* - `preToolUse` matching `Write|Delete` — file writes and deletions, which
|
|
10
|
+
* have no dedicated before-hook (`afterFileEdit` runs too late to refuse).
|
|
8
11
|
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
12
|
+
* The gate refuses with exit code 2 and allows by printing
|
|
13
|
+
* `{"permission":"allow"}`: with `failClosed: true` Cursor blocks on a hook
|
|
14
|
+
* that crashes, times out or prints nothing, so an allow must be explicit.
|
|
15
|
+
*
|
|
16
|
+
* Levels: project (`<workspaceRoot>/.cursor/hooks.json`) and user
|
|
17
|
+
* (`~/.cursor/hooks.json`) on every sync; system level
|
|
18
|
+
* (`/Library/Application Support/Cursor` on macOS, `/etc/cursor` elsewhere)
|
|
19
|
+
* only through `intutic enterprise install`, which needs root. The project and
|
|
20
|
+
* user files are merged — hooks the user registered are kept.
|
|
11
21
|
*
|
|
12
22
|
* LLD #14 — Phase 3 cross-harness defence
|
|
13
23
|
* HLD §3.14 — Three-Tier Defense Cascade
|
|
@@ -18,14 +28,16 @@ import * as fs from 'node:fs/promises';
|
|
|
18
28
|
import * as path from 'node:path';
|
|
19
29
|
import * as os from 'node:os';
|
|
20
30
|
import { createLogger } from '@intutic/logger';
|
|
31
|
+
import { keepOriginal } from '../disconnect/originals.js';
|
|
21
32
|
import { newIso } from '@intutic/id';
|
|
22
33
|
import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
|
|
34
|
+
import { readJsonObjectForMerge } from './jsonMergeTarget.js';
|
|
23
35
|
const log = createLogger('sync-cursor-hooks');
|
|
24
|
-
/**
|
|
36
|
+
/** The Cursor events the gate is registered for, with each one's matcher. */
|
|
25
37
|
const HOOK_EVENTS = [
|
|
26
|
-
'beforeShellExecution',
|
|
27
|
-
'beforeMCPExecution',
|
|
28
|
-
'
|
|
38
|
+
{ event: 'beforeShellExecution' },
|
|
39
|
+
{ event: 'beforeMCPExecution' },
|
|
40
|
+
{ event: 'preToolUse', matcher: 'Write|Delete' },
|
|
29
41
|
];
|
|
30
42
|
/**
|
|
31
43
|
* Where system-level hooks.json lives for a given platform. Exported (not
|
|
@@ -51,18 +63,39 @@ export function systemHooksDirFor(platform) {
|
|
|
51
63
|
*/
|
|
52
64
|
export function buildHooksConfig(hookScriptPath) {
|
|
53
65
|
return {
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
failClosed: true,
|
|
57
|
-
hooks: Object.fromEntries(HOOK_EVENTS.map((event) => [
|
|
66
|
+
version: 1,
|
|
67
|
+
hooks: Object.fromEntries(HOOK_EVENTS.map(({ event, matcher }) => [
|
|
58
68
|
event,
|
|
59
|
-
{
|
|
60
|
-
command: `node "${hookScriptPath}"`,
|
|
61
|
-
failClosed: true,
|
|
62
|
-
},
|
|
69
|
+
[{ command: `node "${hookScriptPath}"`, ...(matcher ? { matcher } : {}), failClosed: true }],
|
|
63
70
|
])),
|
|
64
71
|
};
|
|
65
72
|
}
|
|
73
|
+
/**
|
|
74
|
+
* Merge the Intutic entries into an existing hooks.json object: the user's
|
|
75
|
+
* entries for every event are kept, entries running this gate are replaced,
|
|
76
|
+
* and the shape earlier versions wrote (an object per event, top-level
|
|
77
|
+
* `failClosed`/`_comment`/`_lastSync`, the nonexistent `beforeFileEdit`
|
|
78
|
+
* event) is dropped.
|
|
79
|
+
*/
|
|
80
|
+
export function mergeHooksConfig(existing, hookScriptPath) {
|
|
81
|
+
const ours = buildHooksConfig(hookScriptPath);
|
|
82
|
+
const command = `node "${hookScriptPath}"`;
|
|
83
|
+
const current = typeof existing.hooks === 'object' && existing.hooks !== null && !Array.isArray(existing.hooks)
|
|
84
|
+
? { ...existing.hooks }
|
|
85
|
+
: {};
|
|
86
|
+
delete current.beforeFileEdit;
|
|
87
|
+
for (const [event, entries] of Object.entries(ours.hooks)) {
|
|
88
|
+
const kept = Array.isArray(current[event])
|
|
89
|
+
? current[event].filter((e) => !(typeof e === 'object' && e !== null && e.command === command))
|
|
90
|
+
: [];
|
|
91
|
+
current[event] = [...kept, ...entries];
|
|
92
|
+
}
|
|
93
|
+
const rest = { ...existing };
|
|
94
|
+
delete rest.failClosed;
|
|
95
|
+
delete rest._comment;
|
|
96
|
+
delete rest._lastSync;
|
|
97
|
+
return { ...rest, version: typeof existing.version === 'number' ? existing.version : 1, hooks: current };
|
|
98
|
+
}
|
|
66
99
|
/**
|
|
67
100
|
* The pre-tool-check.js script content — receives JSON context from Cursor
|
|
68
101
|
* on stdin, exits 0 to allow or exits 2 to block.
|
|
@@ -169,7 +202,7 @@ process.stdin.on('end', () => {
|
|
|
169
202
|
// hook_event_name: "beforeMCPExecution", ...}\`) — composed in here, once,
|
|
170
203
|
// before anything reads \`toolName\`.
|
|
171
204
|
if (event === 'beforemcpexecution' && ctx.tool_name) {
|
|
172
|
-
const mcpServer = ctx.command || ctx.url || ctx.server_name || ctx.serverName;
|
|
205
|
+
const mcpServer = ctx.mcp_server_name || ctx.command || ctx.url || ctx.server_name || ctx.serverName;
|
|
173
206
|
if (mcpServer) toolName = 'mcp__' + mcpServer + '__' + ctx.tool_name;
|
|
174
207
|
}
|
|
175
208
|
|
|
@@ -179,8 +212,10 @@ process.stdin.on('end', () => {
|
|
|
179
212
|
// command and the target independently.
|
|
180
213
|
intuticGate(toolName, targetPath, command, logEvent, _intuticWsId, input);
|
|
181
214
|
|
|
182
|
-
// Allow
|
|
215
|
+
// Allow — explicitly: with failClosed set, Cursor treats a hook that
|
|
216
|
+
// prints nothing as a failure and blocks the call.
|
|
183
217
|
logEvent('tool_allowed', toolName, '');
|
|
218
|
+
process.stdout.write(JSON.stringify({ permission: 'allow' }));
|
|
184
219
|
process.exit(0);
|
|
185
220
|
} catch (err) {
|
|
186
221
|
// Fail CLOSED
|
|
@@ -214,16 +249,17 @@ export async function writeCursorHooks(workspaceRoot, proxyUrl, workspaceId = ''
|
|
|
214
249
|
await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
|
|
215
250
|
await fs.rename(tmpScript, hookScriptPath);
|
|
216
251
|
await fs.chmod(hookScriptPath, 0o755);
|
|
217
|
-
const config = buildHooksConfig(hookScriptPath);
|
|
218
252
|
// 1. Project-level: .cursor/hooks.json
|
|
219
253
|
const projectCursorDir = path.join(workspaceRoot, '.cursor');
|
|
254
|
+
await keepOriginal(path.join(projectCursorDir, 'hooks.json'), workspaceRoot);
|
|
220
255
|
await fs.mkdir(projectCursorDir, { recursive: true });
|
|
221
|
-
await
|
|
256
|
+
await mergeHooksJsonFile(path.join(projectCursorDir, 'hooks.json'), hookScriptPath);
|
|
222
257
|
log.info({ action: 'cursor_hooks_written', level: 'project', path: projectCursorDir }, 'Cursor project-level hooks written');
|
|
223
258
|
// 2. User-level: ~/.cursor/hooks.json
|
|
224
259
|
const userCursorDir = path.join(os.homedir(), '.cursor');
|
|
260
|
+
await keepOriginal(path.join(userCursorDir, 'hooks.json'), workspaceRoot);
|
|
225
261
|
await fs.mkdir(userCursorDir, { recursive: true });
|
|
226
|
-
await
|
|
262
|
+
await mergeHooksJsonFile(path.join(userCursorDir, 'hooks.json'), hookScriptPath);
|
|
227
263
|
log.info({ action: 'cursor_hooks_written', level: 'user', path: userCursorDir }, 'Cursor user-level hooks written');
|
|
228
264
|
// 3. System-level (system administrator installation only). macOS has no
|
|
229
265
|
// /etc/cursor convention Cursor itself reads — its own app-support
|
|
@@ -234,7 +270,7 @@ export async function writeCursorHooks(workspaceRoot, proxyUrl, workspaceId = ''
|
|
|
234
270
|
const systemCursorDir = systemHooksDirFor(process.platform);
|
|
235
271
|
try {
|
|
236
272
|
await fs.mkdir(systemCursorDir, { recursive: true });
|
|
237
|
-
await
|
|
273
|
+
await mergeHooksJsonFile(path.join(systemCursorDir, 'hooks.json'), hookScriptPath);
|
|
238
274
|
log.info({ action: 'cursor_hooks_written', level: 'system', path: systemCursorDir }, 'Cursor system-level hooks written');
|
|
239
275
|
}
|
|
240
276
|
catch (err) {
|
|
@@ -242,6 +278,14 @@ export async function writeCursorHooks(workspaceRoot, proxyUrl, workspaceId = ''
|
|
|
242
278
|
}
|
|
243
279
|
}
|
|
244
280
|
}
|
|
281
|
+
/** Merge the gate into one hooks.json; a file that does not parse is left
|
|
282
|
+
* untouched (see jsonMergeTarget.ts). */
|
|
283
|
+
async function mergeHooksJsonFile(filePath, hookScriptPath) {
|
|
284
|
+
const existing = await readJsonObjectForMerge(filePath);
|
|
285
|
+
if (existing === null)
|
|
286
|
+
return;
|
|
287
|
+
await atomicWriteJson(filePath, mergeHooksConfig(existing, hookScriptPath));
|
|
288
|
+
}
|
|
245
289
|
async function atomicWriteJson(filePath, data) {
|
|
246
290
|
const tmp = filePath + '.intutic-tmp';
|
|
247
291
|
await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cursorHooks.js","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"cursorHooks.js","sourceRoot":"","sources":["../../src/harness/cursorHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAE7C,6EAA6E;AAC7E,MAAM,WAAW,GAAuD;IACtE,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACjC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC/B,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE;CACjD,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,aAAa,CAAA;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACtC,KAAK;YACL,CAAC,EAAE,OAAO,EAAE,SAAS,cAAc,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC7F,CAAC,CACH;KACF,CAAA;AACH,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiC,EAAE,cAAsB;IACxF,MAAM,IAAI,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,SAAS,cAAc,GAAG,CAAA;IAC1C,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7G,CAAC,CAAC,EAAE,GAAI,QAAQ,CAAC,KAAiC,EAAE;QACpD,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,OAAO,CAAC,cAAc,CAAA;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC,CAAE,OAAO,CAAC,KAAK,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA2B,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACzI,CAAC,CAAC,EAAE,CAAA;QACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAA;IACrD,OAAO,IAAI,CAAC,UAAU,CAAA;IACtB,OAAO,IAAI,CAAC,QAAQ,CAAA;IACpB,OAAO,IAAI,CAAC,SAAS,CAAA;IACrB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC1G,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;gFASa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkB9B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8EpD,CAAA;AACD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE,EAChB,gBAAgB,GAAG,KAAK;IAExB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAElD,0CAA0C;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;IAElE,wBAAwB;IACxB,MAAM,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;IAChD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAC5D,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAA;IAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IACnF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAE5H,sCAAsC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IACxD,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAA;IACzE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;IAChF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEnH,yEAAyE;IACzE,mEAAmE;IACnE,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,eAAe,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACpD,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAA;YAClF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,mCAAmC,CAAC,CAAA;QAC3H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAA;QAC/G,CAAC;IACH,CAAC;AACH,CAAC;AAED;0CAC0C;AAC1C,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,cAAsB;IACxE,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAM;IAC7B,MAAM,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC"}
|
|
@@ -21,11 +21,11 @@
|
|
|
21
21
|
* Muse Code/Grok Build in Wave 1. This writer was authored against a real
|
|
22
22
|
* `npm pack` + read of those packages' shipped `.d.ts`/README files, not
|
|
23
23
|
* solely the phase brief's prior research (see the TD entry this phase filed
|
|
24
|
-
* for exactly what was checked
|
|
25
|
-
* dsh-
|
|
26
|
-
*
|
|
27
|
-
* dsh-
|
|
28
|
-
* `dsh-
|
|
24
|
+
* for exactly what was checked). In 0.1 three packages (dsh-permission,
|
|
25
|
+
* dsh-settings-local, dsh-fs-policy) 404'd as restricted; 0.2.0-rc.2 no
|
|
26
|
+
* longer depends on them — their roles moved to the public `dsh-settings`,
|
|
27
|
+
* `dsh-config-editor`, `dsh-sandbox-policy`, `dsh-permission-presets` and
|
|
28
|
+
* `dsh-user-approval`, all read directly for the 0.2 re-verification.
|
|
29
29
|
*
|
|
30
30
|
* Confirmed facts this writer relies on:
|
|
31
31
|
*
|
|
@@ -56,30 +56,31 @@
|
|
|
56
56
|
* for out-of-tree plugins) — which means `@intutic/gate` must actually be
|
|
57
57
|
* installed there; see {@link mergeProfileDependency} and the TD entry
|
|
58
58
|
* for why this writer cannot run `pnpm install` on the user's behalf.
|
|
59
|
-
* -
|
|
60
|
-
*
|
|
61
|
-
*
|
|
62
|
-
*
|
|
63
|
-
*
|
|
64
|
-
*
|
|
65
|
-
*
|
|
66
|
-
*
|
|
67
|
-
* mounts
|
|
68
|
-
*
|
|
69
|
-
*
|
|
70
|
-
*
|
|
71
|
-
*
|
|
72
|
-
*
|
|
73
|
-
*
|
|
74
|
-
*
|
|
75
|
-
*
|
|
76
|
-
*
|
|
77
|
-
*
|
|
78
|
-
*
|
|
79
|
-
*
|
|
80
|
-
* `llm-
|
|
81
|
-
*
|
|
82
|
-
*
|
|
59
|
+
* - **LLM egress, re-verified against dsh 0.2.0-rc.2 (TD-370, 2026-10-03).**
|
|
60
|
+
* 0.2 removed the harness-home `settings.yaml` document this writer used
|
|
61
|
+
* to merge into: `@deepseek-ai/dsh-settings` now imports a leftover
|
|
62
|
+
* `$DSH_HOME/settings.yaml` ONCE into whichever profile boots first
|
|
63
|
+
* (renaming it to `settings.yaml.imported`), and live configuration
|
|
64
|
+
* lives in each profile's `cordis.patch.yml` as an id-targeted override
|
|
65
|
+
* row (`dsh-config-editor` persists Models-page edits the same way). The
|
|
66
|
+
* default route is still the entry id `llm-deepseek` — in 0.2 that id
|
|
67
|
+
* mounts `@deepseek-ai/dsh-llm-deepseek-api-key`, which registers the
|
|
68
|
+
* `deepseek-official` provider `dsh-base`'s `agent-default-model` row
|
|
69
|
+
* selects (`provider: deepseek-official, model: deepseek-flash`) — and
|
|
70
|
+
* `dsh-llm-deepseek`'s README confirms its endpoint resolves "explicit
|
|
71
|
+
* value, then `$DEEPSEEK_BASE_URL`, then the official root"
|
|
72
|
+
* (`https://api.deepseek.com/anthropic`, Messages wire format; requests
|
|
73
|
+
* go to `<baseURL>/v1/messages`). {@link mergeProfileLlmRoute} therefore
|
|
74
|
+
* sets `config.baseURL` on that entry's override row in every profile
|
|
75
|
+
* patch. Observed live (uat/evidence/live-verify/dsh-0.2.md): a headless
|
|
76
|
+
* 0.2.0-rc.2 session sent every model request to the configured base URL.
|
|
77
|
+
* Two routes are deliberately NOT redirected: `llm-pi-ai` (0.2 refuses a
|
|
78
|
+
* hand-declared route without a non-empty `models` list, so the old
|
|
79
|
+
* `providers.intutic` route is now invalid config — dropped), and
|
|
80
|
+
* `llm-deepseek-account` (`deepseek-account` provider; its token is only
|
|
81
|
+
* released to `inferenceOrigin`, which accepts an alternate origin only
|
|
82
|
+
* with a grant from DeepSeek's platform — an opt-in, signed-in route this
|
|
83
|
+
* writer cannot point at a proxy). See the TD entry.
|
|
83
84
|
* - The `@intutic/gate/dsh` veto contract itself (`tools/pre-execute`,
|
|
84
85
|
* `PreToolDecision`'s real `'deny'`/`'allow'`/`'ask'` shape, Cordis's
|
|
85
86
|
* `waterfall` `next()` semantics) is confirmed from `dsh-tools`'s shipped
|
|
@@ -152,36 +153,42 @@ export declare function mergeProfilePatch(profileDir: string, workspaceRoot: str
|
|
|
152
153
|
* writer in this codebase only ever writes config, never invokes a package
|
|
153
154
|
* manager on the user's behalf. Until the user (or their own tooling) runs
|
|
154
155
|
* one, the `cordis.patch.yml` row this module also writes resolves to a
|
|
155
|
-
* MISSING module
|
|
156
|
-
*
|
|
157
|
-
*
|
|
158
|
-
*
|
|
156
|
+
* MISSING module. Observed live against dsh 0.2.0-rc.2: the loader prints
|
|
157
|
+
* `dsh: warning: 1 entry did not activate` / `intutic-governance
|
|
158
|
+
* (@intutic/gate/dsh): failed to import` on stderr and the session then runs
|
|
159
|
+
* UNGOVERNED — loud, but fail-OPEN (dsh's hard-fail list is global to the
|
|
160
|
+
* launcher; a profile row cannot mark itself required). See the TD entry and
|
|
161
|
+
* `apps/docs/integrations/dsh.md`.
|
|
162
|
+
*
|
|
163
|
+
* Adds the declaration only when the profile has none: an existing one was
|
|
164
|
+
* written by `dsh plugin --profile <name> add @intutic/gate` (pnpm records
|
|
165
|
+
* the installed range, e.g. `^2.0.0`) or by the user, and rewriting it to this
|
|
166
|
+
* writer's range on every sync would drift the manifest away from what is
|
|
167
|
+
* actually installed — observed live against dsh 0.2.0-rc.2, where the old
|
|
168
|
+
* `^0.1.0` overwrote pnpm's `^2.0.0`.
|
|
159
169
|
*/
|
|
160
170
|
export declare function mergeProfileDependency(profileDir: string): Promise<void>;
|
|
161
171
|
/**
|
|
162
|
-
*
|
|
172
|
+
* Points dsh's DEFAULT LLM route at the Intutic proxy by setting
|
|
173
|
+
* `config.baseURL` on the profile's `llm-deepseek` override row.
|
|
163
174
|
*
|
|
164
|
-
*
|
|
165
|
-
*
|
|
166
|
-
*
|
|
167
|
-
*
|
|
168
|
-
*
|
|
169
|
-
*
|
|
170
|
-
*
|
|
171
|
-
*
|
|
172
|
-
* - `llm-pi-ai.providers.intutic` — a SELECTABLE route (mounts dormant
|
|
173
|
-
* until this section exists at all — see module doc). Kept alongside the
|
|
174
|
-
* new default-route merge: a user, or a future sync, can still point a
|
|
175
|
-
* model at it explicitly.
|
|
175
|
+
* A Cordis id-targeted patch REPLACES the entry's whole `config`
|
|
176
|
+
* (`dsh-app-boot`'s README: "an id-targeted patch does not deep-merge"), so
|
|
177
|
+
* when the profile already overrides this entry (a Models-page save, a hand
|
|
178
|
+
* edit, or dsh 0.2's one-time import of a legacy `settings.yaml`), only
|
|
179
|
+
* `baseURL` is set on THAT row and every other field it restates
|
|
180
|
+
* (`apiKeyEnv`, `reasoningEffort`, `models`, ...) round-trips untouched.
|
|
181
|
+
* Otherwise a fresh `{ id, config: { baseURL } }` row is appended — the
|
|
182
|
+
* base bundle's row carries no config, so nothing is lost by replacing it.
|
|
176
183
|
*
|
|
177
|
-
*
|
|
178
|
-
*
|
|
184
|
+
* Same parse-structurally / write-if-changed / append-only-on-unparseable
|
|
185
|
+
* discipline as {@link mergeProfilePatch}, on the same file.
|
|
179
186
|
*/
|
|
180
|
-
export declare function
|
|
187
|
+
export declare function mergeProfileLlmRoute(profileDir: string, proxyUrl: string): Promise<void>;
|
|
181
188
|
/**
|
|
182
189
|
* Register the Intutic governance plugin against every existing dsh profile
|
|
183
|
-
* on this machine, and
|
|
184
|
-
*
|
|
190
|
+
* on this machine, and point each profile's `llm-deepseek` (default) LLM
|
|
191
|
+
* route at the Intutic proxy.
|
|
185
192
|
*
|
|
186
193
|
* A no-op (logged, not an error) when `$DSH_HOME/profiles` does not exist
|
|
187
194
|
* yet — dsh has not been run with any `--profile <name>` on this machine, so
|
|
@@ -191,7 +198,7 @@ export declare function mergeSettingsYaml(dshHome: string, proxyUrl: string): Pr
|
|
|
191
198
|
*
|
|
192
199
|
* @param workspaceRoot - Absolute workspace root (stored in the plugin row's
|
|
193
200
|
* `config.repoRoot`).
|
|
194
|
-
* @param proxyUrl - Intutic proxy URL,
|
|
201
|
+
* @param proxyUrl - Intutic proxy URL, set as the `llm-deepseek` row's `baseURL`.
|
|
195
202
|
* @param workspaceId - Workspace ID, stored in the plugin row's config.
|
|
196
203
|
*/
|
|
197
204
|
export declare function writeDshHooks(workspaceRoot: string, proxyUrl: string, workspaceId?: string): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dshHooks.d.ts","sourceRoot":"","sources":["../../src/harness/dshHooks.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"dshHooks.d.ts","sourceRoot":"","sources":["../../src/harness/dshHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAmCH;;;;0CAI0C;AAC1C,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgB3E;AAoBD,MAAM,WAAW,cAAc;IAC7B;mFAC+E;IAC/E,WAAW,EAAE,OAAO,CAAA;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAA;IACpB;8DAC0D;IAC1D,GAAG,EAAE,OAAO,CAAA;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ9F;AAkED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DrH;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9E;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD9F;AA4ED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5G"}
|