@intutic/sync-daemon 2.2.0 → 2.4.0

package/dist/harness/antigravityCliHooks.js

@@ -0,0 +1,207 @@
+/**
+ * antigravityCliHooks.ts — Google Antigravity governance hook injection.
+ *
+ * Antigravity (the 2.0 desktop app, the IDE and Antigravity CLI, which
+ * replaced Gemini CLI for individual users in 2026) runs command hooks from
+ * `<workspace>/.agents/hooks.json` and `~/.gemini/config/hooks.json`
+ * (https://antigravity.google/docs/hooks/). This module:
+ *
+ * 1. Writes the gate script to `.intutic/hooks/antigravity-cli-check.js`.
+ * 2. Merges an `intutic-governance` entry into `~/.gemini/config/hooks.json`,
+ *    keeping every other hook in the file. A file that is not a plain JSON
+ *    object is left alone and reported.
+ *
+ * # The hook contract, from the documentation
+ *
+ * The file's top-level keys are hook names; each maps event names to
+ * handlers. `PreToolUse` takes `{matcher, hooks: [{type, command, timeout?}]}`
+ * entries, where a matcher of `"*"` applies to every tool. The command gets
+ * `{toolCall: {name, args}, conversationId, workspacePaths, ...}` on stdin,
+ * camelCase, with Antigravity's own tool names (`run_command` with
+ * `CommandLine`, `write_to_file` and `replace_file_content` with
+ * `TargetFile`). It refuses a call by printing
+ * `{"decision":"deny","reason":"..."}` on stdout — the same shape as Grok
+ * Build's, so the gate uses the `stdout-decision-deny` contract.
+ *
+ * On an allowed call the gate prints `{}`: a JSON object, which every hook
+ * must print, with no decision in it, so Antigravity's own permission
+ * settings decide. The documented values all change what the user sees:
+ * `allow` is documented to auto-approve the call past the permission prompts
+ * the user configured, `ask` and `force_ask` to prompt, and
+ * `deny_unless_prior_grant` to refuse what was never granted. The
+ * documentation marks `decision` as required without saying how a result
+ * without one is read, so it was read from Antigravity itself (2.21.1, its
+ * `language_server`): `decision` is an optional string, `{}` parses to an
+ * empty one, and an empty decision is the lowest-ranked result when several
+ * hooks answer (deny > force_ask > deny_unless_prior_grant > ask >
+ * auto_approve > allow > none), so it never overrides another hook, and the
+ * permission check skips it, leaving the call to the user's own permission
+ * settings. A decision Antigravity does not know is reported as an error.
+ *
+ * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { keepOriginal } from '../disconnect/originals.js';
+import { newIso } from '@intutic/id';
+import { HOOK_TIMEOUT_SECONDS } from '@intutic/shared-types';
+import { emitJsGate, emitJsFailClosedPrelude } from './gateBody.js';
+import { readJsonObjectForMerge } from './jsonMergeTarget.js';
+const log = createLogger('sync-antigravity-cli-hooks');
+/** The key Intutic owns in Antigravity's hooks file. */
+export const ANTIGRAVITY_HOOK_NAME = 'intutic-governance';
+/** The gate script's file name in `.intutic/hooks/`. */
+export const ANTIGRAVITY_CLI_GATE = 'antigravity-cli-check.js';
+/** `~/.gemini/config/hooks.json`, resolved at call time so a moved HOME is honoured. */
+export function antigravityHooksPath() {
+    return path.join(os.homedir(), '.gemini', 'config', 'hooks.json');
+}
+/** The `intutic-governance` entry for Antigravity's hooks file. */
+export function buildAntigravityHookEntry(hookScriptPath) {
+    return {
+        enabled: true,
+        PreToolUse: [
+            {
+                // Every tool: the gate decides from the arguments, so a tool name
+                // nobody anticipated is still evaluated.
+                matcher: '*',
+                hooks: [{ type: 'command', command: `node ${JSON.stringify(hookScriptPath)}`, timeout: HOOK_TIMEOUT_SECONDS }],
+            },
+        ],
+    };
+}
+function buildHookScript(proxyUrl, workspaceRoot, workspaceId) {
+    const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
+    return `#!/usr/bin/env node
+/**
+ * Intutic Antigravity governance gate.
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ */
+${emitJsFailClosedPrelude({ harness: 'antigravity', contract: 'stdout-decision-deny', documentedFieldsOnly: true })}
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
+
+// Runtime credentials
+const _runtimeEnvPath = require('path').join(require('os').homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
+
+${emitJsGate({ harness: 'antigravity', contract: 'stdout-decision-deny', documentedFieldsOnly: true })}
+
+let _intuticSessionId = '';
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    // The event's id: random, made once here, and resent with the line it is
+    // written into, so the control plane processes the event once.
+    const eventId = crypto.randomBytes(16).toString('hex');
+    const entry = JSON.stringify({
+      event: verdict,
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'antigravity',
+      timestamp: ts,
+      incidentId,
+      eventId,
+      ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
+    }) + '\\n';
+    fs.appendFileSync(${JSON.stringify(hookEventsLog)}, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const mod = urlObj.protocol === 'https:' ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || 443, path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
+}
+
+let raw = '';
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', () => {
+  try {
+    const ctx = JSON.parse(raw);
+    _intuticSessionId = ctx.conversationId || ctx.session_id || '';
+    // Antigravity sends {toolCall: {name, args}}; the Claude-Code-shaped
+    // fields are read too, so the shared gate test matrix drives this gate
+    // with the payload it sends every other one.
+    intuticGuardEnvelope(ctx, ['toolCall', 'tool_name', 'tool_input'], logEvent);
+    const call = (ctx.toolCall && typeof ctx.toolCall === 'object') ? ctx.toolCall : {};
+    const toolName = call.name || ctx.tool_name || 'tool';
+    const input = call.args || ctx.tool_input || {};
+
+    const targetPath = input.TargetFile || input.AbsolutePath || input.path || input.file_path ||
+      input.filePath || input.target || '';
+    const command = input.CommandLine || input.command || input.cmd || '';
+
+    intuticGate(toolName, targetPath, command, logEvent, _intuticWsId, input);
+
+    // Allow: a result with no decision in it, so the user's own permission
+    // settings decide (see the module doc).
+    logEvent('tool_allowed', toolName, '');
+    process.stdout.write('{}\\n');
+    process.exit(0);
+  } catch (err) {
+    // Fail CLOSED — the stdout-decision-deny contract, even on a crash inside
+    // this handler (the module-level prelude above covers crashes outside it).
+    const errMsg = String(err);
+    process.stderr.write('[Intutic Governance] Hook error (fail-closed): ' + errMsg + '\\n');
+    logEvent('tool_blocked', 'unknown', errMsg);
+    process.stdout.write(JSON.stringify({ decision: 'deny', reason: '[Intutic Governance] Hook error (fail-closed): ' + errMsg + ' (refusal code GATE_CRASHED)' }) + '\\n');
+    process.exit(0);
+  }
+});
+`;
+}
+/**
+ * Write the Antigravity gate script and merge its registration into
+ * `~/.gemini/config/hooks.json`.
+ *
+ * @param workspaceRoot - Absolute workspace root path.
+ * @param proxyUrl      - Intutic proxy URL written into the script header.
+ * @param workspaceId   - Workspace ID embedded in every hook event payload.
+ */
+export async function writeAntigravityCliHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    const hookScriptDir = path.join(workspaceRoot, '.intutic', 'hooks');
+    const hooksFile = antigravityHooksPath();
+    await keepOriginal(hooksFile, workspaceRoot);
+    await Promise.all([
+        fs.mkdir(hookScriptDir, { recursive: true }),
+        fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true }),
+        fs.mkdir(path.dirname(hooksFile), { recursive: true }),
+    ]);
+    const hookScriptPath = path.join(hookScriptDir, ANTIGRAVITY_CLI_GATE);
+    const tmpScript = hookScriptPath + '.intutic-tmp';
+    await fs.writeFile(tmpScript, buildHookScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
+    await fs.rename(tmpScript, hookScriptPath);
+    await fs.chmod(hookScriptPath, 0o755);
+    log.info({ action: 'antigravity_cli_hook_script_written', path: hookScriptPath }, 'Antigravity hook script written');
+    const existing = await readJsonObjectForMerge(hooksFile);
+    if (existing === null)
+        return;
+    // Only Intutic's own key is replaced; every hook the user registered stays.
+    const merged = { ...existing, [ANTIGRAVITY_HOOK_NAME]: buildAntigravityHookEntry(hookScriptPath) };
+    const tmp = hooksFile + '.intutic-tmp';
+    await fs.writeFile(tmp, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmp, hooksFile);
+    log.info({ action: 'antigravity_cli_hooks_written', path: hooksFile }, 'Merged Intutic PreToolUse hook into ~/.gemini/config/hooks.json');
+}
+//# sourceMappingURL=antigravityCliHooks.js.map

package/dist/harness/antigravityCliHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravityCliHooks.js","sourceRoot":"","sources":["../../src/harness/antigravityCliHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAEtD,wDAAwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAA;AAEzD,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AAE9D,wFAAwF;AACxF,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;AACnE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE;YACV;gBACE,kEAAkE;gBAClE,yCAAyC;gBACzC,OAAO,EAAE,GAAG;gBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;aAC/G;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;;YAIG,QAAQ;gBACJ,MAAM,EAAE;;EAEtB,uBAAuB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;;;;;;;gFAOnC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;wBAoB9E,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDpD,CAAA;AACD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IAExC,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7E,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACvD,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEpH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAM;IAE7B,4EAA4E;IAC5E,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,cAAc,CAAC,EAAE,CAAA;IAClG,MAAM,GAAG,GAAG,SAAS,GAAG,cAAc,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,iEAAiE,CAAC,CAAA;AAC3I,CAAC"}

package/dist/harness/antigravityHooks.d.ts

@@ -25,14 +25,24 @@
  *
  * Hook events:
  *   Every block/allow is appended to `.intutic/events/hook-events.jsonl`
- *   and drained to the control plane via FSEvents-driven drain.
+ *   and drained to the control plane via FSEvents-driven drain, under the
+ *   gate id `gemini-cli` rather than the harness id: the Antigravity gate
+ *   reports as `antigravity`, so liveness, the AI inventory and SIEM can tell
+ *   the two products apart (gateIdentity.ts in @intutic/shared-types).
  *
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
  * HLD §3.x  — Gemini CLI / Antigravity harness
  *
  * @module
  */
+/**
+ * The `BeforeTool` entry that registers the gate: a catch-all matcher, since
+ * the gate decides from the arguments and a tool name nobody anticipated is
+ * still evaluated. Shared with the MDM manifest, so the two cannot drift.
+ * Gemini CLI's \`timeout\` is in milliseconds (default 60 000), and it runs a
+ * call whose hook times out; the gate refuses at its own deadline inside it.
+ */
+export declare function buildGeminiBeforeToolEntry(hookScriptPath: string): Record<string, unknown>;
 /**
  * Write the Antigravity (Gemini CLI) governance hook script and merge
  * hook configuration into `~/.gemini/settings.json`.

package/dist/harness/antigravityHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"antigravityHooks.d.ts","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAyFH;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA2Ef"}
+{"version":3,"file":"antigravityHooks.d.ts","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA4FH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU1F;AAQD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAmEf"}

package/dist/harness/antigravityHooks.js

@@ -25,9 +25,11 @@
  *
  * Hook events:
  *   Every block/allow is appended to `.intutic/events/hook-events.jsonl`
- *   and drained to the control plane via FSEvents-driven drain.
+ *   and drained to the control plane via FSEvents-driven drain, under the
+ *   gate id `gemini-cli` rather than the harness id: the Antigravity gate
+ *   reports as `antigravity`, so liveness, the AI inventory and SIEM can tell
+ *   the two products apart (gateIdentity.ts in @intutic/shared-types).
  *
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
  * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
  * HLD §3.x  — Gemini CLI / Antigravity harness
  *
@@ -39,7 +41,8 @@ import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { keepOriginal } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
-import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
+import { GEMINI_CLI_GATE_ID, HOOK_TIMEOUT_SECONDS } from '@intutic/shared-types';
+import { emitShellGate, SHELL_EXTRACT, emitShellFailClosed } from './gateBody.js';
 import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 const log = createLogger('sync-antigravity-hooks');
 /** Governance-sensitive paths that the hook gate protects. */
@@ -53,7 +56,7 @@ function buildAntigravityCheckScript(proxyUrl, workspaceRoot, workspaceId) {
 # Generated: ${newIso()}
 # Workspace: ${workspaceId}
 set -euo pipefail
-${SHELL_FAIL_CLOSED}
+${emitShellFailClosed(GEMINI_CLI_GATE_ID)}
 INPUT="$(cat)"
 ${SHELL_EXTRACT}
 
@@ -93,7 +96,11 @@ log_event() {
   ws="\${ws//\\\\/\\\\\\\\}"; ws="\${ws//\\"/\\\\\\"}"; ws="\${ws//[\$'\\x01'-\$'\\x1f']/ }"
   local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   local incident_id; incident_id="\$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo \"\$(date +%s)\")"
-  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"antigravity\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\"}"
+  # The event's id: random, made once here, and resent with the line it is
+  # written into, so the control plane processes the event once.
+  local event_id; event_id="\$(od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \\n' || true)"
+  [ -n "\$event_id" ] || event_id="\$(date +%s)\$\$\${RANDOM}\${RANDOM}\${RANDOM}"
+  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"${GEMINI_CLI_GATE_ID}\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\",\\"eventId\\":\\"\${event_id}\\"}"
   printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
   if [ -n "\$INTUTIC_API_KEY" ]; then
     curl -s -o /dev/null --max-time 3 -X POST \\
@@ -104,11 +111,32 @@ log_event() {
   fi
 }
 
-${emitShellGate({ harness: "antigravity" })}
+${emitShellGate({ harness: GEMINI_CLI_GATE_ID })}
 log_event "tool_allowed" "$TOOL_NAME" ""
 exit 0
 `;
 }
+/**
+ * The `BeforeTool` entry that registers the gate: a catch-all matcher, since
+ * the gate decides from the arguments and a tool name nobody anticipated is
+ * still evaluated. Shared with the MDM manifest, so the two cannot drift.
+ * Gemini CLI's \`timeout\` is in milliseconds (default 60 000), and it runs a
+ * call whose hook times out; the gate refuses at its own deadline inside it.
+ */
+export function buildGeminiBeforeToolEntry(hookScriptPath) {
+    return {
+        matcher: '.*',
+        hooks: [{
+                name: 'intutic-governance',
+                type: 'command',
+                command: geminiGateCommand(hookScriptPath),
+                timeout: HOOK_TIMEOUT_SECONDS * 1000,
+            }],
+    };
+}
+function geminiGateCommand(hookScriptPath) {
+    return `bash ${JSON.stringify(hookScriptPath)}`;
+}
 // ─── Main export ──────────────────────────────────────────────────────────────
 /**
  * Write the Antigravity (Gemini CLI) governance hook script and merge
@@ -154,7 +182,7 @@ export async function writeAntigravityHooks(workspaceRoot, proxyUrl, workspaceId
     const existingBeforeTool = Array.isArray(keptHooks.BeforeTool) ? keptHooks.BeforeTool : [];
     // De-duplicated by command, so repeated syncs replace this entry rather than
     // stacking copies, and every hook the user registered is kept.
-    const intuticCmd = `bash ${JSON.stringify(hookScriptPath)}`;
+    const intuticCmd = geminiGateCommand(hookScriptPath);
     const filtered = existingBeforeTool.filter((entry) => {
         if (typeof entry !== 'object' || entry === null)
             return true;
@@ -166,15 +194,7 @@ export async function writeAntigravityHooks(workspaceRoot, proxyUrl, workspaceId
         ...existingSettings,
         hooks: {
             ...keptHooks,
-            BeforeTool: [
-                ...filtered,
-                {
-                    // Catch-all: the gate decides from the arguments, so a tool name
-                    // nobody anticipated is still evaluated.
-                    matcher: '.*',
-                    hooks: [{ name: 'intutic-governance', type: 'command', command: intuticCmd }],
-                },
-            ],
+            BeforeTool: [...filtered, buildGeminiBeforeToolEntry(hookScriptPath)],
         },
     };
     const tmpSettings = geminiSettings + '.intutic-tmp';

package/dist/harness/antigravityHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"antigravityHooks.js","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAGlD,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,2BAA2B,CAClC,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;EAEjB,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqChD,aAAa,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;;;CAG1C,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IAE1E,MAAM,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACjD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACvE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACzG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEhH,6EAA6E;IAE7E,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACrE,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAM;IAErC,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,KAAK,IAAI;QAClG,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,EAAE,CAA4B,CAAA;IAClC,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,SAAS,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAA;IAC/D,OAAO,SAAS,CAAC,OAAO,CAAA;IACxB,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,SAAS,CAAC,UAAwB,CAAC,CAAC,CAAC,EAAE,CAAA;IAEzG,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,QAAQ,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAAC,CAC1H,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG;QACrB,GAAG,gBAAgB;QACnB,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,UAAU,EAAE;gBACV,GAAG,QAAQ;gBACX;oBACE,iEAAiE;oBACjE,yCAAyC;oBACzC,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;iBAC9E;aACF;SACF;KACF,CAAA;IAED,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,EAChE,6DAA6D,CAC9D,CAAA;AACH,CAAC"}
+{"version":3,"file":"antigravityHooks.js","sourceRoot":"","sources":["../../src/harness/antigravityHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAGlD,8DAA8D;AAC9D,iFAAiF;AAEjF,SAAS,2BAA2B,CAClC,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,mBAAmB,CAAC,kBAAkB,CAAC;;EAEvC,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gKA8B8G,kBAAkB;;;;;;;;;;;EAWhL,aAAa,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;;;CAG/C,CAAA;AACD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC;gBACN,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,iBAAiB,CAAC,cAAc,CAAC;gBAC1C,OAAO,EAAE,oBAAoB,GAAG,IAAI;aACrC,CAAC;KACH,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,cAAsB;IAC/C,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAA;AACjD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IAE1E,MAAM,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACjD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACvE,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IACzG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEhH,6EAA6E;IAE7E,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACrE,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAM;IAErC,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,KAAK,IAAI;QAClG,CAAC,CAAC,gBAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,EAAE,CAA4B,CAAA;IAClC,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,SAAS,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAA;IAC/D,OAAO,SAAS,CAAC,OAAO,CAAA;IACxB,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,SAAS,CAAC,UAAwB,CAAC,CAAC,CAAC,EAAE,CAAA;IAEzG,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC5D,MAAM,KAAK,GAAK,KAAiC,CAAC,KAAmB,IAAI,EAAE,CAAA;QAC3E,OAAO,CAAC,CACN,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,UAAU,CAAC,CAC1H,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG;QACrB,GAAG,gBAAgB;QACnB,KAAK,EAAE;YACL,GAAG,SAAS;YACZ,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,0BAA0B,CAAC,cAAc,CAAC,CAAC;SACtE;KACF,CAAA;IAED,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IACxF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAE5C,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,EAChE,6DAA6D,CAC9D,CAAA;AACH,CAAC"}

package/dist/harness/antigravityProducts.d.ts

@@ -0,0 +1,40 @@
+/**
+ * antigravityProducts.ts — which of the two Google products behind the
+ * `antigravity` harness are on this machine.
+ *
+ * The harness installs two gates: Google Antigravity's (`PreToolUse` in
+ * `~/.gemini/config/hooks.json`) and Gemini CLI's (`BeforeTool` in
+ * `~/.gemini/settings.json`). Each reports under its own gate id
+ * (`gateIdentitiesOf` in `@intutic/shared-types`), and this says which of
+ * them to expect: the agent report registers a gate for each product found,
+ * so the silent-gate check does not wait on a gate whose product is absent,
+ * and the AI inventory lists each product with its own gate file and last
+ * event. The CLI's harness detection uses the same answer, so a machine with
+ * only Gemini CLI installed is detected too.
+ *
+ * - Antigravity: its app-data directories under `~/.gemini` (the 2.0 app, the
+ *   CLI and the IDE), a project `.agents/hooks.json`, or `antigravity` on PATH.
+ * - Gemini CLI: `gemini` on PATH, a project `.gemini` directory, or a
+ *   `~/.gemini/settings.json` holding a setting of its own. Intutic writes
+ *   `hooks` and its own `intutic` MCP server into that file, so a file with
+ *   nothing else in it is Intutic's and says nothing about Gemini CLI.
+ *
+ * @module
+ */
+export interface ProductProbeOptions {
+    home?: string;
+    /** The PATH to search; defaults to this process's. */
+    path?: string;
+}
+/**
+ * The gate ids of the `antigravity` harness whose products are on this
+ * machine: `antigravity`, `gemini-cli`, both, or neither.
+ */
+export declare function antigravityGateIdentities(workspaceRoot: string, opts?: ProductProbeOptions): Promise<string[]>;
+/**
+ * The gate ids a configured harness reports under on this machine: for
+ * `antigravity`, the products found, or the harness id itself when neither is
+ * (a configured harness is never dropped); for any other harness, its own id.
+ */
+export declare function presentGateIdentities(harness: string, workspaceRoot: string, opts?: ProductProbeOptions): Promise<string[]>;
+//# sourceMappingURL=antigravityProducts.d.ts.map

package/dist/harness/antigravityProducts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravityProducts.d.ts","sourceRoot":"","sources":["../../src/harness/antigravityProducts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AA+DD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQxH;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIrI"}

package/dist/harness/antigravityProducts.js

@@ -0,0 +1,109 @@
+/**
+ * antigravityProducts.ts — which of the two Google products behind the
+ * `antigravity` harness are on this machine.
+ *
+ * The harness installs two gates: Google Antigravity's (`PreToolUse` in
+ * `~/.gemini/config/hooks.json`) and Gemini CLI's (`BeforeTool` in
+ * `~/.gemini/settings.json`). Each reports under its own gate id
+ * (`gateIdentitiesOf` in `@intutic/shared-types`), and this says which of
+ * them to expect: the agent report registers a gate for each product found,
+ * so the silent-gate check does not wait on a gate whose product is absent,
+ * and the AI inventory lists each product with its own gate file and last
+ * event. The CLI's harness detection uses the same answer, so a machine with
+ * only Gemini CLI installed is detected too.
+ *
+ * - Antigravity: its app-data directories under `~/.gemini` (the 2.0 app, the
+ *   CLI and the IDE), a project `.agents/hooks.json`, or `antigravity` on PATH.
+ * - Gemini CLI: `gemini` on PATH, a project `.gemini` directory, or a
+ *   `~/.gemini/settings.json` holding a setting of its own. Intutic writes
+ *   `hooks` and its own `intutic` MCP server into that file, so a file with
+ *   nothing else in it is Intutic's and says nothing about Gemini CLI.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs/promises';
+import * as node_path from 'node:path';
+import { homedir } from 'node:os';
+import { GEMINI_CLI_GATE_ID } from '@intutic/shared-types';
+async function exists(p) {
+    try {
+        await node_fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether an executable named `bin` is in one of PATH's directories. */
+async function onPath(bin, pathEnv) {
+    const names = process.platform === 'win32' ? [`${bin}.cmd`, `${bin}.exe`, bin] : [bin];
+    for (const dir of pathEnv.split(node_path.delimiter)) {
+        if (!dir)
+            continue;
+        for (const name of names) {
+            try {
+                await node_fs.access(node_path.join(dir, name), node_fs.constants.X_OK);
+                return true;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return false;
+}
+/** Whether a setting is only what Intutic writes: the hooks, or an `mcpServers` holding no server but `intutic`. */
+function intuticsOwn(key, value) {
+    if (key === 'hooks')
+        return true;
+    return key === 'mcpServers' && typeof value === 'object' && value !== null && Object.keys(value).every((name) => name === 'intutic');
+}
+/** Whether `~/.gemini/settings.json` holds any setting besides what Intutic writes. */
+async function geminiSettingsInUse(home) {
+    try {
+        const parsed = JSON.parse(await node_fs.readFile(node_path.join(home, '.gemini', 'settings.json'), 'utf-8'));
+        return (typeof parsed === 'object' &&
+            parsed !== null &&
+            Object.entries(parsed).some(([key, value]) => !intuticsOwn(key, value)));
+    }
+    catch {
+        return false;
+    }
+}
+async function antigravityPresent(workspaceRoot, home, pathEnv) {
+    for (const dir of ['antigravity', 'antigravity-cli', 'antigravity-ide']) {
+        if (await exists(node_path.join(home, '.gemini', dir)))
+            return true;
+    }
+    return (await exists(node_path.join(workspaceRoot, '.agents', 'hooks.json'))) || onPath('antigravity', pathEnv);
+}
+async function geminiCliPresent(workspaceRoot, home, pathEnv) {
+    return ((await onPath('gemini', pathEnv)) ||
+        (await exists(node_path.join(workspaceRoot, '.gemini'))) ||
+        geminiSettingsInUse(home));
+}
+/**
+ * The gate ids of the `antigravity` harness whose products are on this
+ * machine: `antigravity`, `gemini-cli`, both, or neither.
+ */
+export async function antigravityGateIdentities(workspaceRoot, opts = {}) {
+    const home = opts.home ?? homedir();
+    const pathEnv = opts.path ?? process.env.PATH ?? '';
+    const [antigravity, geminiCli] = await Promise.all([
+        antigravityPresent(workspaceRoot, home, pathEnv),
+        geminiCliPresent(workspaceRoot, home, pathEnv),
+    ]);
+    return [...(antigravity ? ['antigravity'] : []), ...(geminiCli ? [GEMINI_CLI_GATE_ID] : [])];
+}
+/**
+ * The gate ids a configured harness reports under on this machine: for
+ * `antigravity`, the products found, or the harness id itself when neither is
+ * (a configured harness is never dropped); for any other harness, its own id.
+ */
+export async function presentGateIdentities(harness, workspaceRoot, opts = {}) {
+    if (harness !== 'antigravity')
+        return [harness];
+    const found = await antigravityGateIdentities(workspaceRoot, opts);
+    return found.length > 0 ? found : [harness];
+}
+//# sourceMappingURL=antigravityProducts.js.map

package/dist/harness/antigravityProducts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravityProducts.js","sourceRoot":"","sources":["../../src/harness/antigravityProducts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAQ1D,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,OAAe;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACtF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBACvE,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oHAAoH;AACpH,SAAS,WAAW,CAAC,GAAW,EAAE,KAAc;IAC9C,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,GAAG,KAAK,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;AACtI,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACrH,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,IAAY,EAAE,OAAe;IACpF,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxE,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IACrE,CAAC;IACD,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;AACjH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,IAAY,EAAE,OAAe;IAClF,OAAO,CACL,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;QACxD,mBAAmB,CAAC,IAAI,CAAC,CAC1B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,aAAqB,EAAE,OAA4B,EAAE;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IACnD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC;QAChD,gBAAgB,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC;KAC/C,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,aAAqB,EAAE,OAA4B,EAAE;IAChH,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IAClE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC"}

package/dist/harness/claudeAgentsMd.d.ts

@@ -0,0 +1,29 @@
+/**
+ * claudeAgentsMd.ts — whether Claude Code reads the workspace's `AGENTS.md`.
+ *
+ * Claude Code gets its rule sets and the decisions log from
+ * `.claude/rules/`, which it loads at launch whatever other instruction
+ * files exist. It also reads `AGENTS.md`, but only sometimes
+ * (https://code.claude.com/docs/en/memory#when-claude-code-reads-agentsmd):
+ *
+ * - under the default **Project instructions** setting,
+ *   `claude-md-or-agents-md`, only when there is no `CLAUDE.md`,
+ *   `.claude/CLAUDE.md` or `CLAUDE.local.md` in the working directory or a
+ *   directory above it (`~/.claude/CLAUDE.md` does not count);
+ * - always under `claude-md-and-agents-md`, and never under `claude-md` or
+ *   `managed-only`.
+ *
+ * The setting is honoured only from user, `--settings` or managed settings,
+ * under `pluginConfigs["cc-plugin-agents-md@builtin"].options.instructionFiles`
+ * (`agents-md@builtin` before v2.1.285); a project's settings cannot change
+ * it. This reads the user's `~/.claude/settings.json`.
+ *
+ * When Claude Code reads `AGENTS.md`, whatever Intutic puts there for the
+ * other harnesses reaches Claude Code too, so the writers leave it out of
+ * `.claude/rules/` to keep Claude Code from reading it twice.
+ *
+ * @module
+ */
+/** Whether Claude Code, started in `workspaceRoot`, reads its `AGENTS.md`. */
+export declare function claudeCodeReadsAgentsMd(workspaceRoot: string): Promise<boolean>;
+//# sourceMappingURL=claudeAgentsMd.d.ts.map

package/dist/harness/claudeAgentsMd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeAgentsMd.d.ts","sourceRoot":"","sources":["../../src/harness/claudeAgentsMd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAgDH,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKrF"}

package/dist/harness/claudeAgentsMd.js

@@ -0,0 +1,80 @@
+/**
+ * claudeAgentsMd.ts — whether Claude Code reads the workspace's `AGENTS.md`.
+ *
+ * Claude Code gets its rule sets and the decisions log from
+ * `.claude/rules/`, which it loads at launch whatever other instruction
+ * files exist. It also reads `AGENTS.md`, but only sometimes
+ * (https://code.claude.com/docs/en/memory#when-claude-code-reads-agentsmd):
+ *
+ * - under the default **Project instructions** setting,
+ *   `claude-md-or-agents-md`, only when there is no `CLAUDE.md`,
+ *   `.claude/CLAUDE.md` or `CLAUDE.local.md` in the working directory or a
+ *   directory above it (`~/.claude/CLAUDE.md` does not count);
+ * - always under `claude-md-and-agents-md`, and never under `claude-md` or
+ *   `managed-only`.
+ *
+ * The setting is honoured only from user, `--settings` or managed settings,
+ * under `pluginConfigs["cc-plugin-agents-md@builtin"].options.instructionFiles`
+ * (`agents-md@builtin` before v2.1.285); a project's settings cannot change
+ * it. This reads the user's `~/.claude/settings.json`.
+ *
+ * When Claude Code reads `AGENTS.md`, whatever Intutic puts there for the
+ * other harnesses reaches Claude Code too, so the writers leave it out of
+ * `.claude/rules/` to keep Claude Code from reading it twice.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const PLUGIN_IDS = ['cc-plugin-agents-md@builtin', 'agents-md@builtin'];
+/** The Project instructions value in the user's settings; undefined when unset. */
+async function instructionFilesSetting() {
+    try {
+        const settings = JSON.parse(await fs.readFile(path.join(os.homedir(), '.claude', 'settings.json'), 'utf-8'));
+        for (const id of PLUGIN_IDS) {
+            const value = settings.pluginConfigs?.[id]?.options?.instructionFiles;
+            if (typeof value === 'string')
+                return value;
+        }
+    }
+    catch {
+        // No user settings, or not JSON: the default applies.
+    }
+    return undefined;
+}
+async function exists(file) {
+    try {
+        await fs.access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether a `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` is in `dir` or above it, the user's own `~/.claude/CLAUDE.md` aside. */
+async function claudeMdOnPath(dir) {
+    const userFile = path.join(os.homedir(), '.claude', 'CLAUDE.md');
+    let current = path.resolve(dir);
+    for (;;) {
+        for (const name of ['CLAUDE.md', path.join('.claude', 'CLAUDE.md'), 'CLAUDE.local.md']) {
+            const file = path.join(current, name);
+            if (file !== userFile && (await exists(file)))
+                return true;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return false;
+        current = parent;
+    }
+}
+/** Whether Claude Code, started in `workspaceRoot`, reads its `AGENTS.md`. */
+export async function claudeCodeReadsAgentsMd(workspaceRoot) {
+    const setting = await instructionFilesSetting();
+    if (setting === 'claude-md-and-agents-md')
+        return true;
+    if (setting === 'claude-md' || setting === 'managed-only')
+        return false;
+    return !(await claudeMdOnPath(workspaceRoot));
+}
+//# sourceMappingURL=claudeAgentsMd.js.map