@intutic/sync-daemon 2.1.0 → 2.3.0

package/dist/harness/gooseHooks.js

@@ -2,13 +2,13 @@
  * gooseHooks.ts — Goose PreToolUse governance plugin injection.
  *
  * Writes the Intutic governance plugin to the Goose plugin directory:
+ *   ~/.agents/plugins/intutic-governance/plugin.json
  *   ~/.agents/plugins/intutic-governance/hooks/hooks.json
  *   ~/.agents/plugins/intutic-governance/scripts/intutic-check.sh
  *
  * Also merges the Intutic proxy URL into ~/.config/goose/config.yaml.
  * After writing, calls gooseHardener to apply chmod 444 + immutable flags.
  *
- * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
  *
  * @module
@@ -17,12 +17,48 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
+import { keepOriginal, noteWritten } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
 import { hardenGoosePlugin, unharden } from './gooseHardener.js';
-import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED, REVIEW_REQUESTS_BASENAME } from './gateBody.js';
+import { HOOK_TIMEOUT_SECONDS } from '@intutic/shared-types';
+import { emitShellGate, SHELL_EXTRACT, emitShellFailClosed, REVIEW_REQUESTS_BASENAME } from './gateBody.js';
+import { parseDocument, isMap, isScalar } from 'yaml';
 const log = createLogger('sync-goose-hooks');
 const PLUGIN_DIR = path.join(os.homedir(), '.agents', 'plugins', 'intutic-governance');
 const GOOSE_CONFIG = path.join(os.homedir(), '.config', 'goose', 'config.yaml');
+/** The plugin manifest Goose identifies the plugin by. */
+export function gooseManifest() {
+    return {
+        name: 'intutic-governance',
+        version: '1.0.0',
+        description: 'Intutic governance gate — auto-generated. DO NOT EDIT.',
+    };
+}
+/**
+ * The plugin's `hooks/hooks.json`, in Goose's schema: each event a list of
+ * rules, each rule a list of command actions. Every tool call goes to the
+ * gate (no matcher). \`on_failure: "block"\` makes Goose deny a call whose
+ * gate fails — times out, crashes, or answers nothing it reads — where the
+ * default would run it; \`timeout\` replaces Goose's 30 s default, and the gate
+ * refuses at its own deadline inside it. A PostToolUse action cannot block,
+ * so it carries neither. The shape used before (\`{PreToolUse: {command,
+ * failClosed}}\`) is not one Goose loads: it skipped the file with a warning.
+ */
+export function gooseHooksConfig(scriptPath) {
+    const command = shellQuote(scriptPath);
+    return {
+        _comment: 'Intutic governance plugin — auto-generated. DO NOT EDIT.',
+        _lastSync: newIso(),
+        hooks: {
+            PreToolUse: [{ hooks: [{ type: 'command', command, timeout: HOOK_TIMEOUT_SECONDS, on_failure: 'block' }] }],
+            PostToolUse: [{ hooks: [{ type: 'command', command: `${command} --event post`, timeout: HOOK_TIMEOUT_SECONDS }] }],
+        },
+    };
+}
+/** Single-quotes a path for the shell Goose runs a command through. */
+function shellQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
 /**
  * Write Goose governance plugin and harden it.
  *
@@ -33,31 +69,23 @@ const GOOSE_CONFIG = path.join(os.homedir(), '.config', 'goose', 'config.yaml');
 export async function writeGooseHooks(proxyUrl, workspaceRoot = os.homedir(), workspaceId = '') {
     const hooksDir = path.join(PLUGIN_DIR, 'hooks');
     const scriptsDir = path.join(PLUGIN_DIR, 'scripts');
+    await keepOriginal(path.join(PLUGIN_DIR, 'plugin.json'), workspaceRoot);
+    await keepOriginal(path.join(hooksDir, 'hooks.json'), workspaceRoot);
+    await keepOriginal(path.join(scriptsDir, 'intutic-check.sh'), workspaceRoot);
     await fs.mkdir(hooksDir, { recursive: true });
     await fs.mkdir(scriptsDir, { recursive: true });
-    // ── hooks.json ──────────────────────────────────────────────────────
-    const hooksConfig = {
-        _comment: 'Intutic governance plugin — auto-generated. DO NOT EDIT.',
-        _lastSync: newIso(),
-        name: 'intutic-governance',
-        version: '1.0.0',
-        hooks: {
-            PreToolUse: {
-                command: path.join(scriptsDir, 'intutic-check.sh'),
-                failClosed: true,
-            },
-            PostToolUse: {
-                command: path.join(scriptsDir, 'intutic-check.sh --event post'),
-                failClosed: false,
-            },
-        },
-    };
-    const hooksJsonPath = path.join(hooksDir, 'hooks.json');
-    // Unharden before writing (in case we're refreshing an existing install)
-    await unharden(hooksJsonPath);
-    const tmpHooks = hooksJsonPath + '.intutic-tmp';
-    await fs.writeFile(tmpHooks, JSON.stringify(hooksConfig, null, 2) + '\n', 'utf-8');
-    await fs.rename(tmpHooks, hooksJsonPath);
+    // ── plugin.json + hooks.json ────────────────────────────────────────
+    for (const [file, content] of [
+        [path.join(PLUGIN_DIR, 'plugin.json'), JSON.stringify(gooseManifest(), null, 2) + '\n'],
+        [path.join(hooksDir, 'hooks.json'), JSON.stringify(gooseHooksConfig(path.join(scriptsDir, 'intutic-check.sh')), null, 2) + '\n'],
+    ]) {
+        // Unharden before writing (in case we're refreshing an existing install)
+        await unharden(file);
+        const tmp = file + '.intutic-tmp';
+        await fs.writeFile(tmp, content, 'utf-8');
+        await fs.rename(tmp, file);
+        await noteWritten(file, workspaceRoot, content);
+    }
     // ── intutic-check.sh ─────────────────────────────────────────────────
     const checkScriptPath = path.join(scriptsDir, 'intutic-check.sh');
     await unharden(checkScriptPath);
@@ -70,7 +98,7 @@ export async function writeGooseHooks(proxyUrl, workspaceRoot = os.homedir(), wo
 # Proxy: ${proxyUrl}
 # Generated: ${newIso()}
 set -euo pipefail
-${SHELL_FAIL_CLOSED}
+${emitShellFailClosed('goose')}
 EVENT="\${1:-pre}"
 INPUT="\$(cat)"
 ${SHELL_EXTRACT}
@@ -111,7 +139,11 @@ log_event() {
   ws="\${ws//\\\\/\\\\\\\\}"; ws="\${ws//\\"/\\\\\\"}"; ws="\${ws//[\$'\\x01'-\$'\\x1f']/ }"
   local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   local incident_id; incident_id="\$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo \"\$(date +%s)\")"
-  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"goose\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\"}"
+  # The event's id: random, made once here, and resent with the line it is
+  # written into, so the control plane processes the event once.
+  local event_id; event_id="\$(od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \\n' || true)"
+  [ -n "\$event_id" ] || event_id="\$(date +%s)\$\$\${RANDOM}\${RANDOM}\${RANDOM}"
+  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"goose\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\",\\"eventId\\":\\"\${event_id}\\"}"
   # Path B: reliable file append
   printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
   # Path A: fire-and-forget HTTP (non-blocking, near-real-time)
@@ -133,12 +165,48 @@ exit 0
     await fs.writeFile(tmpScript, checkScript, 'utf-8');
     await fs.rename(tmpScript, checkScriptPath);
     await fs.chmod(checkScriptPath, 0o755);
+    await noteWritten(checkScriptPath, workspaceRoot, checkScript);
     // Apply immutable flags after writing
     await hardenGoosePlugin(PLUGIN_DIR);
     log.info({ action: 'goose_plugin_written', pluginDir: PLUGIN_DIR }, 'Goose governance plugin written and hardened');
     // ── Merge proxy URL into goose config.yaml ───────────────────────────
     await mergeGooseConfig(proxyUrl);
 }
+/**
+ * Set Intutic's two keys in goose's `config.yaml` text: `provider.host` (the
+ * proxy) and `hooks.pre_tool_use` (the gate script). Edited through the
+ * `yaml` document model, so every other key, comment and list is kept. A text
+ * replace of the first `host:` line used to rewrite whichever key of that name
+ * came first, such as an extension's or an MCP server's.
+ *
+ * An empty `proxyUrl` leaves `provider.host` alone: the settings guard
+ * re-runs this writer to restore the plugin without a URL to hand.
+ *
+ * Returns `null`, to leave the file untouched, when the text is not YAML, is
+ * not a mapping, or holds `provider` or `hooks` as something other than a
+ * mapping.
+ */
+export function mergeGooseConfigYaml(raw, proxyUrl, hookScript) {
+    const doc = parseDocument(raw);
+    if (doc.errors.length > 0)
+        return null;
+    if (doc.contents !== null && !isMap(doc.contents))
+        return null;
+    for (const key of ['provider', 'hooks']) {
+        const node = doc.get(key, true);
+        if (node === undefined || isMap(node))
+            continue;
+        // `provider:` with no value: replaced by the mapping below.
+        if (isScalar(node) && node.value === null)
+            doc.delete(key);
+        else
+            return null;
+    }
+    if (proxyUrl)
+        doc.setIn(['provider', 'host'], proxyUrl);
+    doc.setIn(['hooks', 'pre_tool_use'], hookScript);
+    return doc.toString();
+}
 /**
  * Merge the provider host **and** the `hooks.pre_tool_use` registration into
  * `~/.config/goose/config.yaml`.
@@ -147,56 +215,26 @@ exit 0
  * which wrote its own gate script and registered *that* one here — so goose had
  * two co-installed gates with contradictory models: this one, which enforces
  * locally and fails closed, and that one, which POSTed to the control plane and
- * failed open. Which of them actually ran depended on whether goose honours the
- * plugin `hooks.json` or this config key, and nothing in the tree established
- * which.
- *
- * Absorbing the registration here settles it without needing to know: both
- * mechanisms now name the same script. That is why the answer to "which one does
- * goose read" stopped mattering, rather than being looked up.
+ * failed open. Absorbing the registration here settles it: both mechanisms
+ * name the same script.
  */
 async function mergeGooseConfig(proxyUrl) {
-    let existing = '';
+    let raw = '';
     try {
-        existing = await fs.readFile(GOOSE_CONFIG, 'utf-8');
+        raw = await fs.readFile(GOOSE_CONFIG, 'utf-8');
     }
     catch {
-        // Deliberate fail-open: no config.yaml yet (first run) or it is unreadable.
-        // Fall through with `existing` at its '' initialiser so the block below
-        // writes a fresh provider stanza rather than aborting the whole sync.
-    }
-    // Inject or update provider.host
-    // Goose config.yaml format: provider.host or OPENAI_HOST env var
-    if (existing.includes('provider:')) {
-        if (existing.includes('  host:')) {
-            existing = existing.replace(/^\s*host:\s*.*/m, `  host: "${proxyUrl}"`);
-        }
-        else {
-            existing = existing.replace(/^provider:/m, `provider:\n  host: "${proxyUrl}"`);
-        }
-    }
-    else {
-        existing += `\nprovider:\n  host: "${proxyUrl}"\n`;
+        // No config.yaml yet (first run) or unreadable: written fresh below.
     }
-    // Register the gate under `hooks.pre_tool_use`, pointing at the script this
-    // module writes.
-    const hookScript = path.join(PLUGIN_DIR, 'scripts', 'intutic-check.sh');
-    const hookLine = `  pre_tool_use: ${hookScript}`;
-    if (!(existing.includes('pre_tool_use:') && existing.includes(hookScript))) {
-        // Replace any stale pre_tool_use line rather than adding a second one — an
-        // earlier install pointed this at gooseHooksWriter's script, and two
-        // registrations under one key is how the double gate started.
-        if (/^\s*pre_tool_use:.*$/m.test(existing)) {
-            existing = existing.replace(/^\s*pre_tool_use:.*$/m, hookLine);
-        }
-        else if (/^hooks:/m.test(existing)) {
-            existing = existing.replace(/^hooks:/m, `hooks:\n${hookLine}`);
-        }
-        else {
-            existing = existing.trimEnd() + `\nhooks:\n${hookLine}\n`;
-        }
+    const existing = mergeGooseConfigYaml(raw, proxyUrl, path.join(PLUGIN_DIR, 'scripts', 'intutic-check.sh'));
+    if (existing === null) {
+        log.warn({ action: 'goose_config_merge_skipped', path: GOOSE_CONFIG }, `${GOOSE_CONFIG} is not a YAML mapping Intutic can merge into — left untouched`);
+        return;
     }
+    if (existing === raw)
+        return;
     const tmpConfig = GOOSE_CONFIG + '.intutic-tmp';
+    await keepOriginal(GOOSE_CONFIG, os.homedir());
     await fs.mkdir(path.dirname(GOOSE_CONFIG), { recursive: true });
     await fs.writeFile(tmpConfig, existing, 'utf-8');
     await fs.rename(tmpConfig, GOOSE_CONFIG);

package/dist/harness/gooseHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"gooseHooks.js","sourceRoot":"","sources":["../../src/harness/gooseHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAEzG,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;AACtF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,aAAa,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,GAAG,EAAE;IACpG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE/C,uEAAuE;IACvE,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,0DAA0D;QACpE,SAAS,EAAE,MAAM,EAAE;QACnB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAClD,UAAU,EAAE,IAAI;aACjB;YACD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,+BAA+B,CAAC;gBAC/D,UAAU,EAAE,KAAK;aAClB;SACF;KACF,CAAA;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAEvD,yEAAyE;IACzE,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAA;IAE7B,MAAM,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAA;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAExC,wEAAwE;IACxE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;IACjE,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;IAE/B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,2BAA2B;IAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,WAAW,GAAG;;;WAGX,QAAQ;eACJ,MAAM,EAAE;;EAErB,iBAAiB;;;EAGjB,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuChD,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;CAIjI,CAAA;IAEC,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAA;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAEtC,sCAAsC;IACtC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAEnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,UAAU,EAAE,EACzD,8CAA8C,CAC/C,CAAA;IAED,wEAAwE;IACxE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;IAED,iCAAiC;IACjC,iEAAiE;IACjE,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,QAAQ,GAAG,CAAC,CAAA;QACzE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAuB,QAAQ,GAAG,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,IAAI,yBAAyB,QAAQ,KAAK,CAAA;IACpD,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,mBAAmB,UAAU,EAAE,CAAA;IAChD,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,QAAQ,EAAE,CAAC,CAAA;QAChE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,aAAa,QAAQ,IAAI,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAA;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAExC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,2CAA2C,CAAC,CAAA;AAC/G,CAAC"}
+{"version":3,"file":"gooseHooks.js","sourceRoot":"","sources":["../../src/harness/gooseHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAC3G,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAErD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAE5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;AACtF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE/E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,wDAAwD;KACtE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACtC,OAAO;QACL,QAAQ,EAAE,0DAA0D;QACpE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3G,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;SACnH;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,aAAa,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,GAAG,EAAE;IACpG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACnD,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAA;IACvE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAA;IACpE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,aAAa,CAAC,CAAA;IAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE/C,uEAAuE;IACvE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACvF,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;KACxH,EAAE,CAAC;QACX,yEAAyE;QACzE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACpB,MAAM,GAAG,GAAG,IAAI,GAAG,cAAc,CAAA;QACjC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1B,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAED,wEAAwE;IACxE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;IACjE,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;IAE/B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,2BAA2B;IAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,WAAW,GAAG;;;WAGX,QAAQ;eACJ,MAAM,EAAE;;EAErB,mBAAmB,CAAC,OAAO,CAAC;;;EAG5B,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2ChD,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;CAIjI,CAAA;IAEC,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAA;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACtC,MAAM,WAAW,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;IAE9D,sCAAsC;IACtC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAEnC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,UAAU,EAAE,EACzD,8CAA8C,CAC/C,CAAA;IAED,wEAAwE;IACxE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,QAAgB,EAAE,UAAkB;IACpF,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/C,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;;YACrD,OAAO,IAAI,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;IACvD,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC,CAAA;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC1G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,GAAG,YAAY,gEAAgE,CAAC,CAAA;QACvJ,OAAM;IACR,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAM;IAE5B,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAA;IAC/C,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAExC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,2CAA2C,CAAC,CAAA;AAC/G,CAAC"}

package/dist/harness/grokHooks.d.ts

@@ -20,8 +20,8 @@
  * policy-snapshot evaluation), and — this is the part that is independently
  * confirmed, unlike Muse Code's — signals a block by writing
  * `{"decision":"deny","reason":"..."}` as JSON on **stdout** and exiting 0.
- * That is a *different* stdout shape from Cline/Roo Code's `{"cancel":true}`
- * — Grok Build does not recognise `cancel`, and Cline/Roo Code do not
+ * That is a *different* stdout shape from Cline's `{"cancel":true}`
+ * — Grok Build does not recognise `cancel`, and Cline does not
  * recognise `decision` — so this writer uses its own `BlockContract` value,
  * `'stdout-decision-deny'` (see gateBody.ts's module doc for why the two
  * stdout shapes are not folded into one contract), rather than reusing

package/dist/harness/grokHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokHooks.d.ts","sourceRoot":"","sources":["../../src/harness/grokHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAgSH;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA8Bf"}
+{"version":3,"file":"grokHooks.d.ts","sourceRoot":"","sources":["../../src/harness/grokHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAiSH;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/harness/grokHooks.js

@@ -20,8 +20,8 @@
  * policy-snapshot evaluation), and — this is the part that is independently
  * confirmed, unlike Muse Code's — signals a block by writing
  * `{"decision":"deny","reason":"..."}` as JSON on **stdout** and exiting 0.
- * That is a *different* stdout shape from Cline/Roo Code's `{"cancel":true}`
- * — Grok Build does not recognise `cancel`, and Cline/Roo Code do not
+ * That is a *different* stdout shape from Cline's `{"cancel":true}`
+ * — Grok Build does not recognise `cancel`, and Cline does not
  * recognise `decision` — so this writer uses its own `BlockContract` value,
  * `'stdout-decision-deny'` (see gateBody.ts's module doc for why the two
  * stdout shapes are not folded into one contract), rather than reusing
@@ -70,7 +70,8 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml';
 import { createLogger } from '@intutic/logger';
-import { openaiBaseUrl } from '@intutic/shared-types';
+import { keepOriginal, writeOwnedFile } from '../disconnect/originals.js';
+import { HOOK_GATE_TIMEOUTS, openaiBaseUrl } from '@intutic/shared-types';
 import { newIso } from '@intutic/id';
 import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
 const log = createLogger('sync-grok-hooks');
@@ -118,8 +119,9 @@ function buildHookRegistration(hookScriptPath) {
                             // Grok Build's documented default; stated explicitly rather than
                             // left to fall back, since a local policy-snapshot evaluation is
                             // cheap but a future default change upstream should not silently
-                            // starve this hook.
-                            timeout: 5,
+                            // starve this hook. The gate's deadline is derived from it
+                            // (gateDeadlineMs), because Grok Build runs the call when it expires.
+                            timeout: HOOK_GATE_TIMEOUTS.grok.timeoutMs / 1000,
                         },
                     ],
                 },
@@ -161,6 +163,9 @@ function logEvent(verdict, toolName, reason) {
   try {
     const ts = new Date().toISOString();
     const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    // The event's id: random, made once here, and resent with the line it is
+    // written into, so the control plane processes the event once.
+    const eventId = crypto.randomBytes(16).toString('hex');
     const entry = JSON.stringify({
       // Passed through, not collapsed to two values: the advisory tier emits
       // 'tool_flagged', and a ternary here silently recorded it as an allow.
@@ -170,6 +175,7 @@ function logEvent(verdict, toolName, reason) {
       harnessType: 'grok',
       timestamp: ts,
       incidentId,
+      eventId,
       ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
     }) + '\\n';
     fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
@@ -211,18 +217,12 @@ process.stdin.on('end', () => {
     const errMsg = String(err);
     process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
     logEvent('tool_blocked', 'unknown', errMsg);
-    process.stdout.write(JSON.stringify({ decision: 'deny', reason: '[Intutic Governance] Hook error (fail-closed): ' + errMsg }) + '\\n');
+    process.stdout.write(JSON.stringify({ decision: 'deny', reason: '[Intutic Governance] Hook error (fail-closed): ' + errMsg, code: 'GATE_CRASHED', ruleId: null }) + '\\n');
     process.exit(0);
   }
 });
 `;
 }
-async function atomicWriteJson(filePath, data) {
-    const tmp = filePath + '.intutic-tmp';
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8');
-    await fs.rename(tmp, filePath);
-}
 /**
  * Grok Build's compiled-in default model id — CONFIRMED live (2026-08-20)
  * against `github.com/xai-org/grok-build`'s `crates/codegen/xai-grok-models/default_models.json`
@@ -267,7 +267,7 @@ async function mergeGrokConfigTomlAppendOnly(configPath, existingRaw, proxyUrl)
  * table (`GROK_DEFAULT_MODEL_ID` below) — see this module's doc comment for
  * why that id is CONFIRMED against the real open-sourced default, not a guess.
  */
-async function mergeGrokConfigToml(configPath, proxyUrl) {
+async function mergeGrokConfigToml(configPath, proxyUrl, workspaceRoot) {
     let existing = '';
     try {
         existing = await fs.readFile(configPath, 'utf-8');
@@ -282,6 +282,7 @@ async function mergeGrokConfigToml(configPath, proxyUrl) {
     }
     catch (err) {
         log.warn({ action: 'grok_toml_unparseable', path: configPath, err: err.message }, 'Grok config.toml did not parse as TOML — falling back to append-only text injection');
+        await keepOriginal(configPath, workspaceRoot);
         await mergeGrokConfigTomlAppendOnly(configPath, existing, proxyUrl);
         return;
     }
@@ -311,6 +312,7 @@ async function mergeGrokConfigToml(configPath, proxyUrl) {
         return;
     }
     doc.model = model;
+    await keepOriginal(configPath, workspaceRoot);
     await fs.mkdir(path.dirname(configPath), { recursive: true });
     const tmp = configPath + '.intutic-tmp';
     await fs.writeFile(tmp, stringifyToml(doc), 'utf-8');
@@ -335,21 +337,21 @@ export async function writeGrokHooks(workspaceRoot, proxyUrl, workspaceId = '')
     await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
     await fs.rename(tmpScript, hookScriptPath);
     await fs.chmod(hookScriptPath, 0o755);
-    const registration = buildHookRegistration(hookScriptPath);
+    const registration = JSON.stringify(buildHookRegistration(hookScriptPath), null, 2) + '\n';
     // 1. Project-level: <root>/.grok/hooks/intutic-governance.json
     const projectHooksDir = path.join(workspaceRoot, '.grok', 'hooks');
-    await atomicWriteJson(path.join(projectHooksDir, HOOK_FILENAME), registration);
+    await writeOwnedFile(path.join(projectHooksDir, HOOK_FILENAME), workspaceRoot, registration);
     log.info({ action: 'grok_hooks_written', level: 'project', path: projectHooksDir }, 'Grok project-level hooks written');
     // 2. User-level: ~/.grok/hooks/intutic-governance.json
     const userHooksDir = path.join(GROK_USER_DIR, 'hooks');
-    await atomicWriteJson(path.join(userHooksDir, HOOK_FILENAME), registration);
+    await writeOwnedFile(path.join(userHooksDir, HOOK_FILENAME), workspaceRoot, registration);
     log.info({ action: 'grok_hooks_written', level: 'user', path: userHooksDir }, 'Grok user-level hooks written');
     // 3. config.toml model base_url — project and user level.
     // Grok Build talks to xAI's OpenAI-compatible API (its own default base_url
     // is https://api.x.ai/v1) and appends /chat/completions, so the proxy URL it
     // needs is the OpenAI-style one, ending in /v1.
     const modelBaseUrl = openaiBaseUrl(proxyUrl);
-    await mergeGrokConfigToml(path.join(workspaceRoot, '.grok', 'config.toml'), modelBaseUrl);
-    await mergeGrokConfigToml(path.join(GROK_USER_DIR, 'config.toml'), modelBaseUrl);
+    await mergeGrokConfigToml(path.join(workspaceRoot, '.grok', 'config.toml'), modelBaseUrl, workspaceRoot);
+    await mergeGrokConfigToml(path.join(GROK_USER_DIR, 'config.toml'), modelBaseUrl, workspaceRoot);
 }
 //# sourceMappingURL=grokHooks.js.map

package/dist/harness/grokHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"grokHooks.js","sourceRoot":"","sources":["../../src/harness/grokHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAE3C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;AAEtD;;;;;kCAKkC;AAClC,MAAM,aAAa,GAAG,yBAAyB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,qBAAqB,CAAC,cAAsB;IACnD,OAAO;QACL,QAAQ,EAAE,wDAAwD;QAClE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,sDAAsD;YACtD,UAAU,EAAE;gBACV;oBACE,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,SAAS,cAAc,GAAG;4BACnC,iEAAiE;4BACjE,iEAAiE;4BACjE,iEAAiE;4BACjE,oBAAoB;4BACpB,OAAO,EAAE,CAAC;yBACX;qBACF;iBACF;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;;;;;;;gFAOA,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;;;;;;;;;;;;;;;;;;wBAkB3C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CpD,CAAA;AACD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,QAAQ,GAAG,cAAc,CAAA;IACrC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,KAAK,UAAU,6BAA6B,CAC1C,UAAkB,EAClB,WAAmB,EACnB,QAAgB;IAEhB,IAAI,IAAI,GAAG,WAAW,CAAA;IACtB,MAAM,WAAW,GAAG,WAAW,qBAAqB,IAAI,CAAA;IACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACtF,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,WAAW,gBAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAA;IACxF,CAAC;IACD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAM;IAEhC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,EACjF,yEAAyE,CAC1E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,QAAgB;IACrE,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,wEAAwE;IAC1E,CAAC;IAED,IAAI,GAAgB,CAAA;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE,SAAS,CAAC,QAAQ,CAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAClF,qFAAqF,CACtF,CAAA;QACD,MAAM,6BAA6B,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GACT,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,qEAAqE;QACrE,uEAAuE;QACvE,WAAW;QACX,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAC9F,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/E,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;gBAC9C,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,OAAM;IACR,CAAC;IAED,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,iDAAiD,CAAC,CAAA;AAChI,CAAC;AAED,2EAA2E;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,YAAY,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAA;IAE1D,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAEvH,uDAAuD;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;IAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAE9G,0DAA0D;IAC1D,4EAA4E;IAC5E,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;IACzF,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;AAClF,CAAC"}
+{"version":3,"file":"grokHooks.js","sourceRoot":"","sources":["../../src/harness/grokHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAE3C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;AAEtD;;;;;kCAKkC;AAClC,MAAM,aAAa,GAAG,yBAAyB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,qBAAqB,CAAC,cAAsB;IACnD,OAAO;QACL,QAAQ,EAAE,wDAAwD;QAClE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL,sDAAsD;YACtD,UAAU,EAAE;gBACV;oBACE,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,SAAS,cAAc,GAAG;4BACnC,iEAAiE;4BACjE,iEAAiE;4BACjE,iEAAiE;4BACjE,2DAA2D;4BAC3D,sEAAsE;4BACtE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI;yBAClD;qBACF;iBACF;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;;;;;;;gFAOA,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;wBAsB3C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CpD,CAAA;AACD,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,KAAK,UAAU,6BAA6B,CAC1C,UAAkB,EAClB,WAAmB,EACnB,QAAgB;IAEhB,IAAI,IAAI,GAAG,WAAW,CAAA;IACtB,MAAM,WAAW,GAAG,WAAW,qBAAqB,IAAI,CAAA;IACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACtF,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,WAAW,gBAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAA;IACxF,CAAC;IACD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAM;IAEhC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,EACjF,yEAAyE,CAC1E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,QAAgB,EAAE,aAAqB;IAC5F,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,wEAAwE;IAC1E,CAAC;IAED,IAAI,GAAgB,CAAA;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE,SAAS,CAAC,QAAQ,CAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAClF,qFAAqF,CACtF,CAAA;QACD,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;QAC7C,MAAM,6BAA6B,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GACT,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,qEAAqE;QACrE,uEAAuE;QACvE,WAAW;QACX,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAC9F,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/E,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;gBAC9C,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,OAAM;IACR,CAAC;IAED,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,iDAAiD,CAAC,CAAA;AAChI,CAAC;AAED,2EAA2E;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAE1F,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;IAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAEvH,uDAAuD;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;IACzF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAE9G,0DAA0D;IAC1D,4EAA4E;IAC5E,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;IACxG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;AACjG,CAAC"}

package/dist/harness/hermesHooks.d.ts

@@ -2,7 +2,7 @@
  * hermesHooks.ts — Hermes AI agent governance hook injection.
  *
  * Hermes is a skills-based AI agent that reads `~/.hermes/config.yaml`
- * for configuration. Hook commands are registered under `hooks.preToolUse`.
+ * for configuration. The gate is a shell hook under `hooks.pre_tool_call`.
  * This module:
  *
  * 1. YAML-safe-merges `~/.hermes/config.yaml` to register the hook command.
@@ -11,18 +11,28 @@
  * 4. Writes `.intutic/env/hermes.env` — env snippet for IDE/shell integration.
  *
  * WS-C1 — Hermes harness (Phase 3 cross-harness defence)
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
  *
  * @module
  */
 /**
- * Merge the hook registration into the Hermes config: `hooks.preToolUse.command`
- * is set to the gate, and everything else in the file — other hooks, MCP
- * servers, comments — is kept. Edited through the `yaml` document model; an
- * earlier line-based version replaced the first `command:` line anywhere in
- * the file, whichever key it belonged to. A file that does not parse, or is
- * not a mapping, is left untouched and reported.
+ * The gate's shell-hook entry: \`fail_closed\` makes Hermes refuse the call
+ * when the gate times out, crashes or prints something it cannot read, where
+ * its default runs it; \`timeout\` replaces Hermes's 60 s default, and the
+ * gate refuses at its own deadline inside it. Hermes splits \`command\` with
+ * shlex, so a path with a space or a quote in it is quoted.
+ */
+export declare function hermesHookEntry(hookScriptPath: string): Record<string, unknown>;
+/**
+ * Merge the hook registration into the Hermes config: the gate's entry is put
+ * in the \`hooks.pre_tool_call\` list, replacing an earlier one of ours, and
+ * everything else in the file — other hooks, MCP servers, comments — is kept.
+ * Edited through the \`yaml\` document model. A file that does not parse, or
+ * is not a mapping, or holds \`hooks\` or \`pre_tool_call\` in a shape Hermes
+ * would not read, is left untouched and reported.
+ *
+ * Earlier versions wrote \`hooks.preToolUse.command\`, which Hermes skips as an
+ * unknown event: that registration is removed.
  */
 export declare function mergeHermesYaml(existing: string, hookScriptPath: string): string | null;
 /**

package/dist/harness/hermesHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hermesHooks.d.ts","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6FH;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYvF;AA6CD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAiEf"}
+{"version":3,"file":"hermesHooks.d.ts","sourceRoot":"","sources":["../../src/harness/hermesHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmGH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG/E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBvF;AA6CD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAqEf"}