@fusengine/harness 0.1.63 → 0.1.65

package/dist/adapters/claude/index.d.mts

@@ -1,2 +1,2 @@
-import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-ce2J1bHC.mjs";
+import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-a6kvHEPa.mjs";
 export { ClaudeHookInput, attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-C0xGMbeA.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-CVQlXOl8.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "../../evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,8 +1,13 @@
 import { t as Prompt } from "../../types-DVbIl9md.mjs";
-import { a as denyResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-ce2J1bHC.mjs";
+import { a as denyResponse, c as informResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-a6kvHEPa.mjs";
 
 //#region src/adapters/codex/index.d.ts
-/** Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny. */
+/**
+* Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny.
+* NOTE: the REAL wired route is `harness hook codex` → handleHook → respond.ts
+* (source of truth for the ask→deny downgrade); this thin export exists for
+* direct package consumers and is kept aligned so it never silently diverges.
+*/
 declare function toCodexResponse(prompt: Prompt): string;
 /**
 * Run the bundled policy over a Codex payload and return the native response
@@ -11,4 +16,4 @@ declare function toCodexResponse(prompt: Prompt): string;
 */
 declare function guard(input: ClaudeHookInput): string | null;
 //#endregion
-export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, readClaudeInput as readCodexInput, toCodexResponse };
+export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, informResponse, readClaudeInput as readCodexInput, toCodexResponse };

package/dist/adapters/codex/index.mjs

@@ -1,8 +1,8 @@
 import { f as countLines } from "../../home-state-D0RLWP8J.mjs";
-import { t as evaluate } from "../../evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "../../evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
-import { t as parseApplyPatch } from "../../apply-patch-CIS2EZ_q.mjs";
-import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse } from "../../claude-C0xGMbeA.mjs";
+import { n as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-BN3MNgbm.mjs";
+import { c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse, v as commandToString } from "../../claude-CVQlXOl8.mjs";
 //#region src/adapters/codex/index.ts
 /**
 * OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)
@@ -21,10 +21,15 @@ import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as con
 *    an explicit deny.
 */
 const ASK_PREFIX = "[downgraded from ask — Codex has no interactive approval]";
-/** Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny. */
+/**
+* Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny.
+* NOTE: the REAL wired route is `harness hook codex` → handleHook → respond.ts
+* (source of truth for the ask→deny downgrade); this thin export exists for
+* direct package consumers and is kept aligned so it never silently diverges.
+*/
 function toCodexResponse(prompt) {
 	const message = formatPrompt(prompt);
-	if (prompt.kind === "inform") return contextResponse("PreToolUse", message);
+	if (prompt.kind === "inform") return prompt.userMessage ? informResponse("PreToolUse", prompt.userMessage, prompt.reason ? message : "") : contextResponse("PreToolUse", message);
 	if (prompt.kind === "ask") return denyResponse("PreToolUse", `${ASK_PREFIX}\n${message}`);
 	return denyResponse("PreToolUse", message);
 }
@@ -49,7 +54,8 @@ function resolvePrompt(input) {
 		tool: input.tool_name ?? "Write",
 		filePath: i?.file_path,
 		content: i?.content ?? i?.new_string,
-		command: commandToString(i?.command)
+		command: commandToString(i?.command),
+		neverApproval: isBypassPermissions(input.permission_mode)
 	});
 	return r.decision === "allow" || !r.prompt ? null : r.prompt;
 }
@@ -63,4 +69,4 @@ function guard(input) {
 	return prompt ? toCodexResponse(prompt) : null;
 }
 //#endregion
-export { contextResponse, denyResponse, guard, readClaudeInput as readCodexInput, toCodexResponse };
+export { contextResponse, denyResponse, guard, informResponse, readClaudeInput as readCodexInput, toCodexResponse };

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "../../evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "../../evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-C1gt6ooE.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-DKTAji46.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/{claude-C0xGMbeA.mjs → claude-CVQlXOl8.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "./evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
@@ -81,11 +81,23 @@ function spawnCapture(cmd, args, cwd) {
 		return "";
 	}
 }
-/** Read the full process stdin as UTF-8 text (works under Node and Bun). */
+/**
+* Read the full process stdin as UTF-8 text (works under Node and Bun).
+* Synchronous fd-0 read — never `for await (const c of process.stdin)` —
+* because Bun has a confirmed Linux-only bug where merely adding a new
+* top-level module import shifts stdin's internal init order and makes
+* that async iterator silently yield zero bytes (oven-sh/bun#25320,
+* #27849): exactly what broke every `harness hook` invocation on CI the
+* moment `figures` became this package's first runtime dependency.
+* `readFileSync(0)` bypasses that stream/ownership machinery entirely and
+* is well-supported for piped (non-TTY) stdin under both runtimes.
+*/
 async function readStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(chunk);
-	return Buffer.concat(chunks).toString("utf8");
+	try {
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
 }
 /**
 * Recursively collect files under `dir` whose extension is in `exts`, skipping
@@ -113,10 +125,7 @@ function collectFiles(dir, exts, out, cap) {
 }
 //#endregion
 //#region src/adapters/claude/index.ts
-/**
-* Claude Code adapter — the thin Claude-only shim over the portable policy core.
-* Reads the hook stdin payload and emits hookSpecificOutput responses.
-*/
+/** Claude Code adapter — the thin Claude-only shim over the portable policy core; reads the hook stdin payload and emits hookSpecificOutput responses. */
 /** Read & parse the Claude hook payload from stdin (empty object on bad input). */
 async function readClaudeInput() {
 	const text = await readStdin();
@@ -214,4 +223,4 @@ function guard(input) {
 /** @deprecated use {@link guard}. Kept for back-compat. */
 const fileSizeGuard = guard;
 //#endregion
-export { commandToString as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };
+export { writeText as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, spawnCapture as g, sleep as h, denyResponse as i, systemMessage as l, readText as m, blockResponse as n, guard as o, readStdin as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u, commandToString as v };

package/dist/cli/bin.mjs

@@ -2,9 +2,10 @@
 import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-Jj8aL1FL.mjs";
 import { t as detectHarness } from "../harness-Cb9xR8dC.mjs";
 import { t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-kVHXFVug.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-BCQAHUrx.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-CjwRTMOv.mjs";
+import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-DnxRzNuY.mjs";
+import { p as readStdin$1 } from "../claude-CVQlXOl8.mjs";
 import { delimiter, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -361,15 +362,19 @@ function discoverRefs(home, cwd, marketplaces) {
 *   harness hook <id>      runtime: read a hook payload on stdin, route to the adapter, print the response
 *   harness changelog      fetch + diff the Claude Code changelog, print a JSON summary (changelog-watcher)
 */
+const hookDebug = process.env.FUSE_HARNESS_DEBUG === "1";
+function traceHook(label, data) {
+	if (hookDebug) process.stderr.write(`[hook-debug] ${label}: ${typeof data === "string" ? data : JSON.stringify(data)}\n`);
+}
 async function readStdin() {
-	const chunks = [];
-	for await (const c of process.stdin) chunks.push(c);
-	const text = Buffer.concat(chunks).toString("utf8").trim();
+	const text = (await readStdin$1()).trim();
+	traceHook("stdin-text-length", text.length);
 	if (!text) return {};
 	try {
 		const parsed = JSON.parse(text);
 		return typeof parsed === "object" && parsed !== null ? parsed : {};
-	} catch {
+	} catch (e) {
+		traceHook("stdin-parse-error", e instanceof Error ? e.message : String(e));
 		return {};
 	}
 }
@@ -399,13 +404,27 @@ if (cmd === "--version" || cmd === "-v") {
 	])).has(scopeArg) ? scopeArg : "core";
 	const marketplaces = (process.env.FUSE_HARNESS_MARKETPLACES ?? "fusengine-plugins").split(",").map((s) => s.trim()).filter(Boolean);
 	const refsDir = process.env.FUSE_HARNESS_REFS || discoverRefs(homedir(), process.cwd(), marketplaces) || void 0;
-	const outcome = await handleHook(id, await readStdin(), {
-		now: Date.now(),
-		cwd: process.cwd(),
-		refsDir,
-		windowMs: resolveTtlSec(process.env) * 1e3,
+	traceHook("args", {
+		id,
 		scope
 	});
+	let outcome;
+	try {
+		outcome = await handleHook(id, await readStdin(), {
+			now: Date.now(),
+			cwd: process.cwd(),
+			refsDir,
+			windowMs: resolveTtlSec(process.env) * 1e3,
+			scope
+		});
+	} catch (e) {
+		traceHook("handleHook-threw", e instanceof Error ? `${e.message}\n${e.stack}` : String(e));
+		throw e;
+	}
+	traceHook("outcome", {
+		stdoutLength: outcome.stdout.length,
+		exit: outcome.exit
+	});
 	if (outcome.stdout) process.stdout.write(outcome.stdout);
 	process.exit(outcome.exit);
 } else if (cmd === "init") {

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-kVHXFVug.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-BCQAHUrx.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{evaluate-wDDbojx6.mjs → evaluate-I9CAwUlI.mjs}

@@ -305,7 +305,9 @@ const PROTECTED_FRAGMENTS = [
 	".fuse-harness/cache/sessions",
 	".claude/apex/",
 	".harness/track",
-	".harness/memory/state"
+	".harness/memory/state",
+	".codex/config.toml",
+	".codex/rules/"
 ];
 /**
 * Matches a real `.git` directory segment (`/.git/`, `~/.git`, leading or
@@ -733,6 +735,50 @@ function runGuards(ctx) {
 	return null;
 }
 //#endregion
+//#region src/policy/never-approval.ts
+/**
+* Shell metacharacters that turn a "simple" command into a chained/composite
+* one: `&&`, `||`, `;`, `|`, a lone background `&` (POSIX control operator —
+* `cmd1 & cmd2` runs BOTH; `&(?!>)` excludes bash's `&>`/`&>>` redirects, which
+* cannot introduce a second command), a backtick, `$(`, or a literal newline.
+* Bounded alternation, no nested quantifiers — no ReDoS. Quote-unaware by
+* design: a quoted `"R&D"` gates as ask (fail-closed).
+*/
+const CHAIN_RE = /&&|\|\||[;|`]|&(?!>)|\$\(|\n/;
+/**
+* True when `cmd` has no chaining operator. evaluate.ts's neverApproval
+* exemption must NEVER fire on a composite command — `git commit -m x &&
+* git push --force` would otherwise slip a blocked op past the RALPH_SAFE
+* subset check, since that check is a `startsWith` on the leading verb only.
+*/
+function isSingleCommand(cmd) {
+	return !CHAIN_RE.test(cmd);
+}
+/** Next steps offered on the auto-approve notice — the only channel left once `ask` is unavailable. */
+const ACTIONS = [
+	"Set approval_policy=on-request for interactive confirmation",
+	"Or set RALPH_MODE=1 to auto-approve silently (no notice)",
+	"Or run the command manually outside the agent loop"
+];
+/**
+* Builds the auto-approve `inform` prompt for a command evaluate.ts has
+* already proven safe (RALPH_SAFE subset, not GIT_BLOCKED, not chained —
+* see {@link isSingleCommand}). Pure formatting only; the 3-condition
+* decision itself lives in evaluate.ts, where the anti-chaining guarantee
+* must stay visible and auditable.
+* @param cmd - The already-vetted command.
+*/
+function buildNeverApprovalPrompt(cmd) {
+	const trimmed = cmd.trim();
+	return {
+		kind: "inform",
+		title: "Auto-approved (approval_policy=never)",
+		reason: `Auto-approved "${trimmed}" under approval_policy=never.`,
+		actions: [...ACTIONS],
+		userMessage: `[fuse-harness] Auto-approved "${trimmed}" — approval_policy=never has no ask channel. Destructive git commands still deny. Set approval_policy=on-request, or RALPH_MODE=1, to keep asking.`
+	};
+}
+//#endregion
 //#region src/policy/evaluate.ts
 /**
 * Evaluate a single tool-use against the bundled policies, returning a pure
@@ -748,6 +794,14 @@ function evaluate(ctx) {
 	};
 	const cmd = ctx.command;
 	const ralphSafe = !!cmd && isRalphMode() && RALPH_SAFE.some((s) => cmd.startsWith(s));
+	if (!ralphSafe && !!ctx.neverApproval && !!cmd && !matchPatterns(cmd, GIT_BLOCKED) && isSingleCommand(cmd) && RALPH_SAFE.some((s) => cmd.startsWith(s)) && cmd) {
+		const prompt = buildNeverApprovalPrompt(cmd);
+		return {
+			decision: "warn",
+			message: prompt.reason,
+			prompt
+		};
+	}
 	if (!ralphSafe && ctx.command && matchPatterns(ctx.command, GIT_BLOCKED)) {
 		const reason = `Destructive git command: ${ctx.command}`;
 		return {

package/dist/{handle-CjwRTMOv.mjs → handle-DnxRzNuY.mjs}

@@ -4,7 +4,7 @@ import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { A as detectCreationIntent, E as isExcludedSwiftPath, F as docConsultedGate, H as detectProjectType$1, I as evaluateApex, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, S as usesTailwindUtilities, T as isExcludedJsPath, V as detectModularArchitecture, W as requiredArchSkill, _ as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, k as capVerbosity, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DnOqIZD_.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, t as claudeHome } from "./home-state-D0RLWP8J.mjs";
-import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-wDDbojx6.mjs";
+import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-I9CAwUlI.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
 import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DhItkBzk.mjs";
@@ -13,9 +13,9 @@ import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as se
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-CQ4roWrU.mjs";
-import { t as parseApplyPatch } from "./apply-patch-CIS2EZ_q.mjs";
-import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-C0xGMbeA.mjs";
-import { r as toHermesResponse } from "./hermes-C1gt6ooE.mjs";
+import { n as parseApplyPatch, t as isBypassPermissions } from "./permission-mode-BN3MNgbm.mjs";
+import { _ as writeText, d as collectFiles, f as pathExists, g as spawnCapture, h as sleep, i as denyResponse, l as systemMessage, m as readText, n as blockResponse, r as contextResponse, s as informResponse, t as attachSystemMessage, v as commandToString } from "./claude-CVQlXOl8.mjs";
+import { r as toHermesResponse } from "./hermes-DKTAji46.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -23,6 +23,7 @@ import { mkdir, rmdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { execFileSync, execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import figures from "figures";
 //#region src/runtime/lifecycle/security/skill-state.ts
 /**
 * Shared security-tracker state: per-UTC-day JSON under
@@ -93,7 +94,8 @@ function normalizeEvent(id, payload) {
 		tool,
 		input,
 		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
-		agentType: str(payload.agent_type) ?? str(input.subagent_type)
+		agentType: str(payload.agent_type) ?? str(input.subagent_type),
+		permissionMode: str(payload.permission_mode)
 	};
 	if (tool === "apply_patch") {
 		const files = parseApplyPatch(str(input.command) ?? str(payload.command) ?? "").map((f) => ({
@@ -6812,7 +6814,8 @@ async function runGates(input) {
 			content: input.content,
 			command: input.command,
 			agentType: input.agentType,
-			existingLines
+			existingLines,
+			neverApproval: input.neverApproval
 		});
 	} catch {
 		return FAIL_CLOSED;
@@ -7053,6 +7056,56 @@ function respond(id, prompt) {
 	}
 }
 //#endregion
+//#region src/runtime/deny-notice.ts
+/**
+* @module deny-notice
+* Attach a user-visible notice to a deny/ask hook response — the owner-reported
+* gap where `permissionDecision: deny/ask` (the agent-only channel) left the
+* human staring at a silent terminal. Mirrors {@link module:notices}'s
+* compliance notices but for the BLOCKING outcomes those never covered.
+* @packageDocumentation
+*/
+/**
+* The human-facing line for a block/ask outcome: the gate's own
+* {@link Prompt.userMessage} when it set one, else a generic symbol + title —
+* text-presentation Unicode only (`figures.cross`/`?`), never emoji: terminal-safe,
+* single-cell width, with the Windows fallbacks `figures` already resolves, matching
+* the existing notice family (`notices.ts`'s `✓`/`⚠`, left untouched by this module).
+* Null for `inform` ({@link module:respond}'s own `userMessage` path already
+* covers it) or when neither applies.
+*/
+function denyAskNotice(prompt) {
+	if (prompt.kind === "block") return prompt.userMessage ?? `${figures.cross} ${prompt.title}`;
+	if (prompt.kind === "ask") return prompt.userMessage ?? `? ${prompt.title}`;
+	return null;
+}
+/**
+* Attach {@link denyAskNotice} onto an already-rendered deny/ask `stdout`, for
+* the harnesses whose human channel is `systemMessage` (claude-code/codex —
+* `permissionDecision`/`permissionDecisionReason` stay byte-intact, only the
+* top-level field is added). Every other harness passes `stdout` through
+* unchanged: Cursor already emits `user_message` natively (respond.ts), Hermes
+* and cline have no human channel. Deduped via {@link onceExclusive} against
+* the ~11 sibling-plugin fan-out for one real event (same window as the
+* sniper reminder / compliance notices).
+* @param id - Harness id (`ctx.id` from `PreContext`).
+* @param stdout - The rendered hook response (from {@link module:respond.respond}).
+* @param prompt - The {@link Prompt} that produced `stdout`.
+* @param sessionId - Current session id (dedup scope).
+* @param dir - State-dir for the dedup marker (per-project state dir).
+* @param now - Event clock (tests pass a fake one).
+*/
+function withDenyNotice(id, stdout, prompt, sessionId, dir, now) {
+	if (id !== "claude-code" && id !== "codex") return stdout;
+	const notice = denyAskNotice(prompt);
+	if (!notice) return stdout;
+	if (!onceExclusive(`deny-notice:${sessionId}:${prompt.title}`, 2e3, {
+		now,
+		dir
+	})) return stdout;
+	return attachSystemMessage(stdout, notice);
+}
+//#endregion
 //#region src/policy/design/content-checks.ts
 /** Accessibility warnings: icon buttons need aria-label, images need alt. */
 function checkAccessibility(content) {
@@ -7595,9 +7648,7 @@ function applyPatchGate(files, cwd) {
 //#endregion
 //#region src/runtime/handle-pre.ts
 /**
-* Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX
-* Task context injection, then the stateless+APEX gate chain. Returns the native
-* hook outcome (deny/ask/inject or allow).
+* Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX Task context injection, then the stateless+APEX gate chain, returning the native hook outcome (deny/ask/inject or allow).
 * @param ctx - The resolved pre-context.
 * @returns The hook outcome.
 */
@@ -7618,7 +7669,7 @@ async function handlePre(ctx) {
 	}
 	const designBlock = designGate(payload, event, mcpDir, opts.cwd);
 	if (designBlock) return {
-		stdout: respond(id, designBlock),
+		stdout: withDenyNotice(id, respond(id, designBlock), designBlock, event.sessionId, dirname(file), opts.now),
 		exit: 0
 	};
 	if (opts.scope === "security") return {
@@ -7639,7 +7690,7 @@ async function handlePre(ctx) {
 	if (event.files && event.files.length > 0) {
 		const patchPrompt = applyPatchGate(event.files, opts.cwd);
 		if (patchPrompt) return {
-			stdout: respond(id, patchPrompt),
+			stdout: withDenyNotice(id, respond(id, patchPrompt), patchPrompt, event.sessionId, dirname(file), opts.now),
 			exit: 0
 		};
 	}
@@ -7658,10 +7709,11 @@ async function handlePre(ctx) {
 		windowMs: opts.windowMs,
 		now: opts.now,
 		trackFile: file,
-		transcriptPath: typeof payload.transcript_path === "string" ? payload.transcript_path : void 0
+		transcriptPath: typeof payload.transcript_path === "string" ? payload.transcript_path : void 0,
+		neverApproval: id === "codex" && isBypassPermissions(event.permissionMode)
 	});
 	if (prompt) return {
-		stdout: respond(id, prompt),
+		stdout: withDenyNotice(id, respond(id, prompt), prompt, event.sessionId, dirname(file), opts.now),
 		exit: 0
 	};
 	return allowOutcome(id, event, payload, mcpDir, opts.cwd, {

package/dist/{hermes-C1gt6ooE.mjs → hermes-DKTAji46.mjs}

@@ -1,6 +1,6 @@
-import { t as evaluate } from "./evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "./evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { _ as commandToString, c as readClaudeInput } from "./claude-C0xGMbeA.mjs";
+import { c as readClaudeInput, v as commandToString } from "./claude-CVQlXOl8.mjs";
 //#region src/adapters/hermes/index.ts
 /**
 * Hermes Agent adapter (hook-mode). Nous Research's hermes-agent (2026) pipes a

package/dist/{index-C9jYdElK.d.mts → index-CU3oHxOe.d.mts}

@@ -131,6 +131,8 @@ interface PolicyContext {
   agentType?: string;
   /** Line count of the existing on-disk file (so an Edit on an oversized file blocks). */
   existingLines?: number;
+  /** Codex-only, populated by handle-pre.ts from the resolved `permission_mode` of an `approval_policy=never` session (adapters/codex/permission-mode.ts) — auto-approve gate, wired through evaluate.ts's anti-chaining check. */
+  neverApproval?: boolean;
 }
 /** Harness-agnostic policy decision (+ a portable prompt for adapters to render). */
 interface PolicyResult {

package/dist/{index-ce2J1bHC.d.mts → index-a6kvHEPa.d.mts}

@@ -12,6 +12,8 @@ interface ClaudeHookInput {
     command?: string | string[];
   };
   cwd?: string;
+  /** Shared Claude/Codex hook field — Codex maps approval_policy=never to "bypassPermissions" (adapters/codex/permission-mode.ts). */
+  permission_mode?: string;
 }
 /** Read & parse the Claude hook payload from stdin (empty object on bad input). */
 declare function readClaudeInput(): Promise<ClaudeHookInput>;

package/dist/index.d.mts

@@ -5,7 +5,7 @@ import { a as HarnessInfo, i as HarnessId, n as detectMode, o as HarnessMode, r
 import { a as isDocConsulted, i as formatDocSatisfactionStatus, n as DocSatisfactionStatus, o as resolveSessions, r as formatDocDeny, t as AuthEntry } from "./doc-helpers-CEKzGg2u.mjs";
 import { t as incrementTrivialEditCounter } from "./index-BOBXQ91y.mjs";
 import { a as compactJson, i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./index-BEMumjOw.mjs";
-import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "./index-C9jYdElK.mjs";
+import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "./index-CU3oHxOe.mjs";
 import { n as RouteResult, r as ScoredRef, t as RefMeta } from "./types-CY5qT2X1.mjs";
 import { a as PRE_AUTH_GATES, c as evaluateApex, i as POST_AUTH_GATES, l as freshnessGate, n as ApexContext, o as brainstormGate, r as ApexGate, s as docConsultedGate, t as APEX_GATES, u as solidReadGate } from "./apex-Wdi1nq_w.mjs";
 import { a as ReminderState, c as readState, d as throttleMs, i as registryFile, l as setStateField, n as addRoot, o as lessonsFileFor, r as readRoots, s as nowStamp, t as ensureMemoryGitignore, u as stateFileFor } from "./index-DLYhervv.mjs";

package/dist/index.mjs

@@ -6,7 +6,7 @@ import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFi
 import { n as detectMode, r as modeFor, t as detectHarness } from "./harness-Cb9xR8dC.mjs";
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DnOqIZD_.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "./home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-wDDbojx6.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-I9CAwUlI.mjs";
 import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "./doc-helpers-CWZegVdR.mjs";
 import { i as parseFrontmatter, n as scoreReferences, r as globToRe, t as routeReferences } from "./router-PKVNBHge.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";

package/dist/{apply-patch-CIS2EZ_q.mjs → permission-mode-BN3MNgbm.mjs}

@@ -78,4 +78,22 @@ function parseApplyPatch(text) {
 	return files;
 }
 //#endregion
-export { parseApplyPatch as t };
+//#region src/adapters/codex/permission-mode.ts
+/**
+* Codex maps `AskForApproval::Never` -> `permission_mode: "bypassPermissions"`
+* in its hook payload (codex-rs/core/src/hook_runtime.rs::hook_permission_mode)
+* — the only value that isolates `never`; the other three approval policies
+* (`untrusted`, `on-failure`, `on-request`) all collapse to `"default"`.
+* Verified at openai/codex@342e4d4b, hook_runtime.rs run_pre_tool_use_hooks +
+* pre_tool_use.rs PreToolUseRequest. Undocumented implementation detail, not
+* a public contract — see the mapping-regression test that pins this string.
+* @param permissionMode - The payload's `permission_mode` field, if present.
+* @returns True only on an EXACT match — fail-closed. A near-miss
+* (`"BypassPermissions"`, `"bypassPermissions "`, or a substring match) must
+* never accidentally grant the neverApproval exemption.
+*/
+function isBypassPermissions(permissionMode) {
+	return permissionMode === "bypassPermissions";
+}
+//#endregion
+export { parseApplyPatch as n, isBypassPermissions as t };

package/dist/policy/index.d.mts

@@ -1,3 +1,3 @@
-import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "../index-C9jYdElK.mjs";
+import { $ as ASK_PATTERNS, A as FAIL_CLOSED, B as SWIFT_PROTO_RE, C as usesTailwindUtilities, Ct as ModularArchitecture, D as MAX_TOKENS, Dt as isApexCommand, E as MAX_EXA_RESULTS, Et as detectProjectType, F as installGuard, G as CODE_MUTATORS, H as interfaceSeparationGuard, I as GO_DECL_RE, J as SAFE_PREFIXES, K as CODE_REDIRECT, L as JAVA_DECL_RE, M as clearUserGuards, N as registerGuard, O as capVerbosity, Ot as requiredArchSkill, P as runGuards, Q as protectedPathGuard, R as PHP_DECL_RE, S as skillTriggerGate, St as DEV_KEYWORDS, T as frameworkSolidGate, Tt as detectModularArchitecture, U as bashWriteGuard, V as TS_DECL_RE, W as ASK_WRITERS, X as PROTECTED_FRAGMENTS, Y as SESSION_STATE_FRAGMENT, Z as PROTECTED_GIT_RE, _ as DEV_VERBS, _t as SOLID_REF, a as firstHeading, at as evaluate, b as detectClaudeMdProjectType, bt as evaluateFileSize, c as parseEntry, ct as GIT_ASK, d as EXCLUDE_DIRS, dt as RALPH_SAFE, et as CRITICAL_PATTERNS, f as PROJECT_INDICATORS, ft as SYSTEM_INSTALL, g as loadApexTaskState, gt as PLUGINS_DIR, h as buildApexTaskInjection, ht as FileSizeVerdict, i as firstComment, it as GuardContext, j as GUARDS, k as detectCreationIntent, l as parseBodyDesc, lt as GIT_BLOCKED, m as buildApexTaskContext, mt as matchPatterns, n as missingSeoElements, nt as securityGuard, o as TreeEntry, ot as PolicyContext, p as ApexTaskState, pt as isRalphMode, q as FILE_REDIRECT, r as descFromText, rt as Guard, s as parseEnrichment, st as PolicyResult, t as isHtmlLike, tt as LabeledPattern, u as parseField, ut as PROJECT_INSTALL, v as buildApexInstruction, vt as countFrameworkCodeLines, w as SKILL_TRIGGERS, wt as ProjectType, x as detectRequiredSkills, xt as detectFramework, y as buildClaudeMdContext, yt as countLines, z as PY_MODEL_RE } from "../index-CU3oHxOe.mjs";
 import { a as PRE_AUTH_GATES, c as evaluateApex, i as POST_AUTH_GATES, l as freshnessGate, n as ApexContext, o as brainstormGate, r as ApexGate, s as docConsultedGate, t as APEX_GATES, u as solidReadGate } from "../apex-Wdi1nq_w.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, ApexContext, ApexGate, ApexTaskState, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, FileSizeVerdict, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, Guard, GuardContext, JAVA_DECL_RE, LabeledPattern, MAX_EXA_RESULTS, MAX_TOKENS, ModularArchitecture, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, type PolicyContext, type PolicyResult, ProjectType, RALPH_SAFE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, TreeEntry, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, installGuard, interfaceSeparationGuard, isApexCommand, isHtmlLike, isRalphMode, loadApexTaskState, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/policy/index.mjs

@@ -1,5 +1,5 @@
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "../validate-DnOqIZD_.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "../home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-wDDbojx6.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-I9CAwUlI.mjs";
 import "../policy-la_KkjCS.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, JAVA_DECL_RE, MAX_EXA_RESULTS, MAX_TOKENS, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, RALPH_SAFE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, installGuard, interfaceSeparationGuard, isApexCommand, isHtmlLike, isRalphMode, loadApexTaskState, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/{run-kVHXFVug.mjs → run-BCQAHUrx.mjs}

@@ -1,5 +1,5 @@
 import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
-import { t as evaluate } from "./evaluate-wDDbojx6.mjs";
+import { t as evaluate } from "./evaluate-I9CAwUlI.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/run.ts

package/dist/runtime/index.d.mts

@@ -102,6 +102,8 @@ interface GateInput {
   agentId?: string;
   /** Absolute path to the session transcript (Claude `transcript_path`) for evidence-based freshness. */
   transcriptPath?: string;
+  /** See PolicyContext.neverApproval — populated only by handle-pre.ts for id==="codex" (approval_policy=never has no interactive ask channel). */
+  neverApproval?: boolean;
 }
 //#endregion
 //#region src/runtime/gate.d.ts
@@ -167,6 +169,8 @@ interface NormalizedEvent {
   command?: string;
   /** Subagent type, if the tool-use came from one (Explore/Plan are file-size-exempt). */
   agentType?: string;
+  /** Harness-resolved permission mode (Claude emits it natively; Codex maps `AskForApproval::Never` to the same "bypassPermissions" string — see adapters/codex/permission-mode.ts). Generic field, Codex-only consumer today. */
+  permissionMode?: string;
   /**
   * Per-file changes when the tool is a multi-file edit primitive (Codex
   * `apply_patch`). Present ONLY for `apply_patch`; the file gates OR each
@@ -835,9 +839,7 @@ interface PreContext {
   opts: HandleOptions;
 }
 /**
-* Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX
-* Task context injection, then the stateless+APEX gate chain. Returns the native
-* hook outcome (deny/ask/inject or allow).
+* Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX Task context injection, then the stateless+APEX gate chain, returning the native hook outcome (deny/ask/inject or allow).
 * @param ctx - The resolved pre-context.
 * @returns The hook outcome.
 */

package/dist/runtime/index.mjs

@@ -1,6 +1,6 @@
 import { r as projectLayout } from "../layout-C0jaaCQC.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, i as loadSessionState, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, s as sessionStatePath, t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-CjwRTMOv.mjs";
+import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-DnxRzNuY.mjs";
 //#region src/runtime/storage.ts
 /**
 * The project's single state dir (`<root>/.harness`) — neutral + harness-agnostic,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",
@@ -152,5 +152,8 @@
     "tsdown": "^0.22.3",
     "typedoc": "^0.28.19",
     "typescript": "^6.0.3"
+  },
+  "dependencies": {
+    "figures": "^6.1.0"
   }
 }