@intutic/sync-daemon 2.2.0 → 2.4.0

package/dist/harness/gateBody.d.ts

@@ -1,54 +1,5 @@
-/**
- * The gate evaluator, emitted once per language instead of written thirteen
- * times.
- *
- * # Why this file exists
- *
- * Every harness writer used to hand-author its own copy of the decision logic
- * inside a TypeScript template literal. Four production defects came directly
- * out of that arrangement, and each one silently removed enforcement while every
- * test stayed green:
- *
- * - `claudeCodeHooks` emitted `...UNIVERSAL_PROTECTED_PATHS,` as *literal source
- *   text* into a script that never imported it. Node threw `ReferenceError`
- *   before the gate decided anything — and a Claude Code PreToolUse hook exiting
- *   1 is a hook *error*, not a block, so the call proceeded.
- * - `INTUITIC_` for `INTUTIC_`: the gate died on an unbound variable under
- *   `set -u`, exiting 1 rather than 2 — again, not a block.
- * - Five bash writers wrote `\"` where `\\"` was needed. Bash ate the quotes,
- *   the audit line stopped being parseable JSON, and `drainHookEvents` drops
- *   malformed lines and then *wipes the log* on a successful drain. The record
- *   of a block was destroyed rather than delayed.
- * - `gooseHooks`/`openhandsHooks` never extracted a command at all, so neither
- *   had a shell-bypass guard — for their entire life.
- *
- * The common cause is not carelessness. It is that shell and JavaScript embedded
- * in a template literal have three levels of escaping and no compiler checking
- * any of them. Emitting from one place does not make the escaping easier; it
- * makes there be one of it, with one set of tests.
- *
- * # The contract with a writer
- *
- * # One editing hazard, since it bit four times
- *
- * A backtick inside a comment in an emitted body ends the TypeScript template
- * literal it lives in, and the rest of the gate becomes TypeScript. `tsc` does
- * catch it — but as a syntax error dozens of lines away, which reads as
- * unrelated damage. Use plain quotes in comments inside the emitted strings.
- *
- * A lint for this was tried and removed: a line-based scan cannot cheaply tell
- * a comment inside a template literal from one outside it, and it produced 26
- * false positives on this file's own prose. The compiler is the right detector;
- * this note is the right documentation.
- *
- * A writer supplies the harness-specific parts — how to read the tool call, how
- * to record an event, how to refuse — and interpolates the bodies below. See
- * {@link ShellGateOptions} and {@link JsGateOptions} for exactly what must be in
- * scope.
- *
- * @module
- */
 import { DESTRUCTIVE_COMMAND_PATTERNS, type GuardPattern } from './protectedPaths.js';
+import { type HookGateHarness } from '@intutic/shared-types';
 /**
  * Bumped when the emitted evaluator changes shape.
  *
@@ -69,7 +20,7 @@ import { DESTRUCTIVE_COMMAND_PATTERNS, type GuardPattern } from './protectedPath
  *
  * v5: the residual fail-open edges were closed. Every bash gate now converts
  * an accidental crash (exit != 0 and != 2 under `set -euo pipefail`) into
- * exit 2 via {@link SHELL_FAIL_CLOSED}; every bash gate refuses a stdin
+ * exit 2 via {@link emitShellFailClosed}; every bash gate refuses a stdin
  * payload from which neither a tool name nor a tool_input could be extracted
  * (the envelope posture githubCopilotHooks established, now uniform); every
  * JS gate installs `uncaughtException`/`unhandledRejection` handlers as its
@@ -98,7 +49,7 @@ import { DESTRUCTIVE_COMMAND_PATTERNS, type GuardPattern } from './protectedPath
  *   picks the fail-open reading of that ambiguity rather than blocking every
  *   MCP call the first time a v6 gate meets an old snapshot).
  *
- * v8 (TD-474 item 4): the `hold` severity and the `action` subject. A hold
+ * v8: the `hold` severity and the `action` subject. A hold
  * rule — a `require_approval` SOP rule the control plane resolves, or a local
  * `review_before:` token the daemon compiles as `sop.local.review_before.*` —
  * refuses the call through the harness's own contract, appends the v1 hold
@@ -122,12 +73,133 @@ import { DESTRUCTIVE_COMMAND_PATTERNS, type GuardPattern } from './protectedPath
  * change: an invalid snapshot keeps its `sso_group.*` block rules instead of
  * dropping them with the rest of the dynamic tier. A v8 gate reading a v9
  * snapshot enforces the same rules and drops them on an invalid one.
+ *
+ * v10: the hold classifier matches each action needle's words with a gap
+ * regex (`SQL_GAP_ERE`, replaced in v12) between them, over the normalised command, instead of
+ * as a plain substring of the raw one. `DROP/**\/TABLE`, `DROP -- why` +
+ * newline + `TABLE`, an escaped `\n`, a line continuation and (in the JS
+ * gates, which read the raw command) a tab or a doubled space all dodged a
+ * `review_before: action:db_write` or `action:deploy` hold. Only the emitted
+ * classifier changed; the `.rules` format did not, so v9 and v10 gates read
+ * each other's snapshots — a v9 gate just holds fewer spellings.
+ *
+ * v11: the classifier reads every harness's shell tool ({@link
+ * ACTION_TOOL_NAMES}, now the proxy's `SHELL_TOOLS`, Gemini CLI's
+ * `run_shell_command` included) with the v10 matching. A v10 gate does not
+ * classify a command run through those extra tool names. The `.rules` format
+ * is unchanged.
+ *
+ * v12: no regex runs on a command to find words that may be split apart. The
+ * hold classifier and `phrase`-subject rules (`destructive.sql_drop`) use the
+ * linear phrase matcher (`@intutic/shared-types` phrases.ts, emitted as
+ * JavaScript; `phrases.py`, emitted as Python and run by the bash gates'
+ * extractor), over the raw command. The v10 regex took seconds on a few
+ * hundred kilobytes of `git -- git -- …` in the JS gates, and bash's pattern
+ * substitution a minute on a long run of backslashes. A v11 gate reading a v12
+ * snapshot reads a `phrase` rule's source — the phrases joined by `|` — as a
+ * regex over the command, which still matches their plain spellings.
+ *
+ * v13: no gate rule runs a backtracking regex on a call, and no gate runs
+ * past its own deadline. Rules shaped `A.*B` carry the `s` flag in the
+ * `.rules` flags column (`is` with `i`) and run as sequences of steps
+ * (`@intutic/shared-types` sequence.ts, `sequence.py`); `grep -E` still runs
+ * them as written. A call whose command is over `COMMAND_SIZE_LIMIT` bytes or
+ * whose arguments are over `ARGUMENTS_SIZE_LIMIT` is refused as
+ * `COMMAND_TOO_LARGE`, and a gate still deciding at its deadline refuses
+ * with `GATE_DEADLINE`, ahead of the harnesses that read a
+ * hook timeout as an allow. A v12 gate compares the flags column with `i`, so
+ * it runs a sequence rule as the regex it also is, case-sensitively.
+ *
+ * v14: the MCP server registry and refusal codes. The snapshot carries the
+ * workspace's registry decisions as an `@mcp_registry` data line (two
+ * columns, inside the digest), and the JS and bash gates refuse an
+ * `mcp__<server>__<tool>` call to a blocked or held server, to a server the
+ * workspace has not approved under `mcpDefaultPolicy: deny`, or to a disabled
+ * tool, with the MCP proxy's codes, rule ids and reasons
+ * (`evaluateMcpRegistry` in `@intutic/shared-types`). An invalid snapshot
+ * keeps the record but not its approvals, as it keeps the SSO-group refusals
+ * but not the member's groups. A JSON decision (Cline, Grok Build,
+ * Antigravity) now carries `code` and `ruleId` ({@link HOOK_REFUSAL_CODES}).
+ * The `.rules` rule format is unchanged; a v13 gate skips the record line as
+ * it skips `@sso_groups`, and enforces no registry.
+ *
+ * v15: the in-process gates (the `'throw'` contract: OpenCode's plugin, Pi's
+ * extension, OpenClaw's plugin) run their rules under the same deadline,
+ * measured from the start of the call rather than of the process, which
+ * started long before. Pi and OpenCode await a tool-call handler with no time
+ * limit, and OpenClaw's own hook timeout cannot interrupt synchronous code,
+ * so a v14 in-process gate on a slow ` WHERE ` pattern held the agent.
+ *
+ * v16: the MCP server allowlist moved inside the digest. It was a
+ * `#mcpservers` header, which the digest does not cover, so adding a server
+ * to it by hand widened the allowlist and left the snapshot valid. It is now
+ * an `@mcp_allowlist` data line (tag, severity, comma-joined servers; three
+ * columns, so every rule parser skips it), and a snapshot that fails its
+ * digest keeps the allowlist but admits no server and refuses at `block`,
+ * as it keeps the registry's refusals but not its approvals. The bash gates'
+ * registry decision is `intutic_clawde/gate/mcp_registry.py`, emitted
+ * verbatim. A v15 gate reading a v16 snapshot enforces no allowlist; the
+ * daemon regenerates every gate each sync cycle.
+ *
+ * v17: an unverified snapshot admits no MCP server. A snapshot whose digest
+ * is broken or missing, or that names another workspace, used to keep the
+ * registry's refusals and an allowlist that admitted nothing; but a deleted
+ * record looks exactly like one never set, and an edit to the registry's
+ * blocked list or default policy still widened it. Every gate now refuses
+ * every MCP call on such a snapshot as `POLICY_SNAPSHOT_UNVERIFIED`
+ * (`mcpSnapshotUnverifiedRefusal` in `@intutic/shared-types`), at `block`
+ * in an observe-only workspace too, and the sync daemon restores the last
+ * snapshot it verified. The JS and Python readers also read a snapshot with
+ * no `#digest` line as unverified, as the bash gates already did. And the
+ * compiled floor refuses an edit to a VS Code settings file that sets
+ * `chat.useHooks` or `chat.hookFilesLocations` (`HOOK_SETTING_PATTERNS`),
+ * which can switch off the GitHub Copilot gate. The `.rules` format is
+ * unchanged.
+ *
+ * v18: each gate's deadline is its own harness's: a second under the hook
+ * timeout that harness applies (`HOOK_GATE_TIMEOUTS` and `gateDeadlineMs` in
+ * `@intutic/shared-types`), at most 9 s. One 4 s deadline for every gate,
+ * sized for Grok Build's 5 s default (connect now writes 10 s), refused legitimate calls on a busy machine in
+ * harnesses that wait 10 s or more. The bash gates also screen each subject
+ * with one `grep` holding every rule's pattern before testing rule by rule,
+ * and take the whitespace-collapsed fields from the extractor as they are:
+ * a call at the size limit had forked a hundred `grep`s and spent seconds of
+ * a loaded machine before any rule could match. The `.rules` format is
+ * unchanged.
  */
-export declare const GATE_VERSION = 9;
+export declare const GATE_VERSION = 18;
+/**
+ * The refusal codes a hook gate's JSON decision carries, as `code` beside the
+ * deciding `ruleId` (null when no rule decided), for the harnesses that read
+ * a decision from stdout rather than an exit code: Cline (`cancel`), Grok
+ * Build and Antigravity (`decision: deny`). The exit-code harnesses read the
+ * same refusal as text on stderr, the rule id in brackets. Held to
+ * `packages/shared-types/fixtures/refusal-codes.json` (`hook`) by a test.
+ *
+ * - `BUILT_IN_RULE`: a rule compiled into the gate (a governance bypass, a
+ *   write to a protected path or a skill directory, a secret in content);
+ * - `SNAPSHOT`: a block rule from the policy snapshot (an SOP, the
+ *   destructive-command tier, a skill-content rule);
+ * - `SSO_GROUP`: an `sso_group.*` rule, compiled from the workspace's SSO
+ *   group policy for this member;
+ * - `HELD`: a hold rule, with `holdId`;
+ * - `SERVER_BLOCKED`, `SERVER_HELD`, `SERVER_NOT_APPROVED`, `TOOL_DISABLED`:
+ *   the MCP server registry;
+ * - `SERVER_NOT_ALLOWED`: the workspace's `mcpAllowedServers` list;
+ * - `POLICY_SNAPSHOT_UNVERIFIED`: an MCP call on a snapshot that failed its
+ *   integrity check, which admits no MCP server;
+ * - `COMMAND_TOO_LARGE`: the call is over the size a gate evaluates;
+ * - `GATE_DEADLINE`: the gate did not decide within its harness's deadline
+ *   (`gateDeadlineMs` in `@intutic/shared-types`);
+ * - `UNREADABLE_CALL`: the payload held no tool call the gate could read;
+ * - `GATE_CRASHED`: the gate failed while deciding.
+ */
+export declare const HOOK_REFUSAL_CODES: readonly ["BUILT_IN_RULE", "SNAPSHOT", "SSO_GROUP", "HELD", "SERVER_BLOCKED", "SERVER_HELD", "SERVER_NOT_APPROVED", "TOOL_DISABLED", "SERVER_NOT_ALLOWED", "POLICY_SNAPSHOT_UNVERIFIED", "COMMAND_TOO_LARGE", "GATE_DEADLINE", "UNREADABLE_CALL", "GATE_CRASHED"];
 /**
  * The coarse command → action-token classification the hold tier keys on:
- * `review_before: action:deploy` holds a shell command that contains any of
- * the deploy needles. Deliberately minimal — a gate that tries to be clever
+ * `review_before: action:deploy` holds a shell command that contains one of
+ * the deploy needles, whatever separates its words (the phrase matcher,
+ * `@intutic/shared-types` phrases.ts). Deliberately minimal — a gate that tries to be clever
  * about shell commands is a gate that blocks real work — and it mirrors the
  * proxy's `actions.rs` in both directions: `hookActionParity.test.ts` reads
  * THIS file as text and fails if either side knows a needle the other does
@@ -135,8 +207,15 @@ export declare const GATE_VERSION = 9;
  * that is what the test's regex finds.
  */
 export declare const ACTION_NEEDLES: ReadonlyArray<readonly [string, readonly string[]]>;
-/** The (lower-cased) tool names whose `command` the classifier reads. */
-export declare const ACTION_TOOL_NAMES: readonly ["bash", "shell", "run_command", "terminal", "execute"];
+/**
+ * The (lower-cased) tool names whose `command` the classifier reads: every
+ * harness's shell tool. The same list as the proxy's `SHELL_TOOLS` in
+ * `actions.rs` (`hookActionParity.test.ts` holds them equal), so a hold the
+ * proxy would classify is one the gate can hold before the call runs.
+ * `run_shell_command` is Gemini CLI's, `run_command` Antigravity's and
+ * `execute_command` Cline's.
+ */
+export declare const ACTION_TOOL_NAMES: readonly ["bash", "shell", "run_command", "runcommand", "execute_command", "run_shell_command", "terminal", "execute", "exec"];
 /** Where a gate appends a hold, relative to the workspace root; the daemon's
  *  `drainReviewRequests` reads the same file. */
 export declare const REVIEW_REQUESTS_BASENAME = "review-requests.jsonl";
@@ -144,6 +223,26 @@ export declare const REVIEW_REQUESTS_LOG = ".intutic/events/review-requests.json
 /** Bumped when a hold record's shape changes; the control plane drops any
  *  other version at ingest. */
 export declare const REVIEW_REQUEST_VERSION = 1;
+/**
+ * The Python the bash gates run, defined once per gate script: the phrase
+ * matcher ({@link PHRASES_PY_SOURCE}), the MCP registry decision
+ * ({@link MCP_REGISTRY_PY_SOURCE}) and four entry points over them.
+ *
+ * - `intutic_actions(tool, command)` — the hold classifier, called by
+ *   {@link SHELL_EXTRACT}'s Python, which already reads the raw tool input:
+ *   space-padded action tokens (" action:deploy ") or " ".
+ * - `intutic_phrase_rule(source, command)` — a `phrase`-subject rule: its
+ *   source is `|`-separated phrases, each matched as words with boundaries.
+ * - `intutic_mcp_registry(record_b64, tool)` — the `@mcp_registry` record's
+ *   decision on an MCP call.
+ * - `intutic_mcp_unverified(tool)` — the refusal of an MCP call on a
+ *   snapshot that failed its integrity check.
+ *
+ * The classifier used to be `grep -E` with a gap regex over the normalised
+ * command, and bash's own pattern substitution on it took a minute on a long
+ * run of backslashes. Python is already required by every bash gate.
+ */
+export declare const GATE_PY_LIB: string;
 /**
  * How old a snapshot may be before a gate reports it as stale.
  *
@@ -158,21 +257,23 @@ export declare const SNAPSHOT_STALE_AFTER_DAYS = 7;
  *
  * The three values are not stylistic. Claude Code, Cursor and the bash
  * harnesses read the **exit code** (2 = deny; 1 is an error and lets the call
- * through). Cline and Roo Code ignore the exit code and read a `{"cancel":
- * true}` object on stdout. Grok Build ALSO ignores the exit code, but its
+ * through). Cline ignores the exit code and reads a `{"cancel": true}`
+ * object on stdout. Grok Build ALSO ignores the exit code, but its
  * confirmed verdict shape is a *different* stdout object —
  * `{"decision":"deny","reason":"..."}` — not `{"cancel":true}`. The two
  * stdout contracts are kept as distinct union members rather than folded into
  * one "stdout-cancel" bucket precisely because a gate that emits the wrong
  * field name looks identical in a code review and enforces nothing: Grok
- * Build does not recognise `cancel`, and Cline/Roo Code do not recognise
+ * Build does not recognise `cancel`, and Cline does not recognise
  * `decision`. A gate that uses the wrong one is silently inert.
  */
 /**
  * `'throw'` is for a gate that runs INSIDE the harness process (OpenCode's
- * plugin hook): the refusal is a thrown Error carrying the BLOCKED message,
- * which the host turns into the tool-error the model reads. No exit code, no
- * stdout — the same in-process posture the n8n workflow gate takes.
+ * plugin hook, Pi's extension, OpenClaw's plugin): the refusal is a thrown
+ * Error carrying the BLOCKED message. OpenCode turns it into the tool-error
+ * the model reads; the Pi and OpenClaw handlers catch it and return their
+ * host's block result. No exit code, no stdout — the same in-process posture
+ * the n8n workflow gate takes.
  */
 export type BlockContract = 'exit2' | 'stdout-cancel' | 'stdout-decision-deny' | 'throw';
 /**
@@ -249,11 +350,14 @@ export declare function toRulesLine(p: GuardPattern): string;
  * defined by the writer AFTER this prelude, so the trap probes for it before
  * calling: a crash earlier than the definition still blocks, just without an
  * audit line (stderr carries the reason either way).
+ *
+ * It also starts the gate's deadline, which is the harness's own
+ * ({@link gateDeadlineMs}).
  */
-export declare const SHELL_FAIL_CLOSED = "\n# \u2500\u2500 Intutic fail-closed prelude v9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Any exit status other than the two deliberate verdicts (0 = allow, 2 = block)\n# means this gate crashed rather than decided. The harness would read exit 1 as\n# \"hook errored\" and run the tool anyway, so a crash is converted into a block.\n# EXIT rather than ERR: ERR is unreliable across shells for set -u deaths, and\n# it fires on benign non-zero intermediates; the final status cannot lie.\nintutic_fail_closed() {\n  _intutic_exit_rc=$?\n  # The trap must not itself die on an unset variable or a failed command \u2014\n  # that would replace the exit status it exists to correct.\n  set +eu\n  trap - EXIT\n  if [ \"$_intutic_exit_rc\" = \"0\" ] || [ \"$_intutic_exit_rc\" = \"2\" ]; then\n    exit \"$_intutic_exit_rc\"\n  fi\n  echo \"[Intutic Governance] BLOCKED: gate crashed (exit ${_intutic_exit_rc}) \u2014 failing closed rather than allowing an unevaluated call.\" >&2\n  if command -v log_event >/dev/null 2>&1; then\n    log_event \"tool_blocked\" \"${TOOL:-unknown}\" \"gate crashed (exit ${_intutic_exit_rc}) \u2014 failing closed\" || true\n  fi\n  exit 2\n}\ntrap intutic_fail_closed EXIT\n";
+export declare function emitShellFailClosed(harness: HookGateHarness): string;
 export interface ShellGateOptions {
     /** Harness id, as it appears in audit lines. */
-    harness: string;
+    harness: HookGateHarness;
     /**
      * Name of the shell function the writer defined to record an event.
      * Called as `<fn> <verdict> <tool> <reason>`.
@@ -267,11 +371,24 @@ export interface ShellGateOptions {
      */
     reviewRequestFile?: string;
 }
+/**
+ * The JS classifier, `intuticActions(toolName, command)`. Needs
+ * `intuticNormalise` in scope. Exported for the classifier's tests.
+ */
+export declare function emitJsActionClassifier(): string;
 export declare function emitShellGate(opts: ShellGateOptions): string;
 export interface JsGateOptions {
-    harness: string;
+    /** Harness id, as it appears in audit lines; it also picks the gate's deadline. */
+    harness: HookGateHarness;
     /** How this harness refuses. */
     contract: BlockContract;
+    /**
+     * The harness's decision object may carry only the fields it documents
+     * (Google Antigravity), so a refusal names its code in the reason text,
+     * `(refusal code SERVER_BLOCKED)`, rather than in `code` and `ruleId`
+     * fields. The rule id is already in the reason, in brackets.
+     */
+    documentedFieldsOnly?: boolean;
     /** See {@link ShellGateOptions.reviewRequestFile}. Writers whose artifact
      *  does not live in `.intutic/hooks/` (cline, opencode) pass it. */
     reviewRequestFile?: string;
@@ -286,7 +403,7 @@ export interface JsGateOptions {
  */
 export declare function emitJsGate(opts: JsGateOptions): string;
 /**
- * Pre-image capture — the storage half of the rollback enforcement rung (TD-328).
+ * Pre-image capture — the storage half of the rollback enforcement rung.
  *
  * ## Why this exists and why it is here
  *
@@ -346,7 +463,7 @@ export declare function emitPreImageCapture(): string;
  * every emitted gate for real.
  *
  * Refuses through the harness's contract, like everything else: exit 2 means
- * nothing to cline or roo-code, whose harnesses only read stdout — a crashed
+ * nothing to cline, which only reads stdout — a crashed
  * stdout-cancel gate must still print its cancel object.
  */
 export declare function emitJsFailClosedPrelude(opts: JsGateOptions): string;
@@ -364,7 +481,7 @@ export declare function emitJsFailClosedPrelude(opts: JsGateOptions): string;
  * allow — was a silent hole. The message names the fix, because a developer who
  * hits this needs to act on it rather than file a bug.
  */
-export declare const SHELL_EXTRACT = "\nif ! command -v python3 >/dev/null 2>&1; then\n  echo \"[Intutic Governance] BLOCKED: python3 is required to evaluate tool calls and was not found on PATH.\" >&2\n  echo \"[Intutic Governance] Install python3, or unset the Intutic hooks to run ungoverned.\" >&2\n  exit 2\nfi\n\nINTUTIC_FIELDS=\"$(printf '%s' \"$INPUT\" | python3 -c '\nimport sys, json\ndef clean(v):\n    return \" \".join(str(v).split()) if isinstance(v, str) else \"\"\nstate = \"ok\"\ntry:\n    d = json.load(sys.stdin)\nexcept Exception:\n    d = {}\n    state = \"malformed\"\nif not isinstance(d, dict):\n    d = {}\n    state = \"malformed\"\n# The envelope check githubCopilotHooks established, applied to the bash\n# family: a payload carrying none of the tool fields in any known spelling is\n# one the gate cannot evaluate, and extracting empty fields from it would\n# match no rule \u2014 an allow. Reported as a STATE and decided in the gate body,\n# because log_event is not defined yet at extraction time.\nif state == \"ok\" and not any(\n    k in d for k in (\"tool_name\", \"toolName\", \"tool_input\", \"toolInput\")\n):\n    state = \"malformed\"\ni = d.get(\"tool_input\") or {}\nif not isinstance(i, dict):\n    i = {}\ndef first(*keys):\n    for k in keys:\n        v = i.get(k)\n        if isinstance(v, str) and v:\n            return clean(v)\n    return \"\"\n# The state line comes FIRST: the lines after it may legitimately be empty,\n# and command substitution strips trailing newlines, so the last line is the\n# only position an empty value cannot survive in.\nprint(state)\nprint(clean(d.get(\"tool_name\", \"\")))\nprint(first(\"path\", \"file_path\", \"notebook_path\", \"filePath\"))\nprint(first(\"command\", \"cmd\", \"script\", \"shell_command\"))\nprint(clean(d.get(\"session_id\", d.get(\"sessionId\", \"\"))))\n# The FULL tool_input, serialized to the exact shape argPattern rules are\n# matched against everywhere: JSON.stringify(tool_input) \u2014 compact separators,\n# insertion order, non-ASCII intact. The selected fields above are whitespace-\n# collapsed for token matching; this one must NOT be, or a WHERE clause that\n# spans a key/value boundary matches here and not in the JS gates. json.dumps\n# escapes every newline, so it is still exactly one line to read back.\nprint(json.dumps(i, separators=(\",\", \":\"), ensure_ascii=False))\n' 2>/dev/null || printf '\\n\\n\\n\\n\\n\\n')\"\n\n# Each read is `|| true` because command substitution strips trailing newlines:\n# a tool call with no command argument yields fewer lines than reads, so a late\n# read hits EOF and returns non-zero. Under `set -e` that killed the gate with\n# **exit 1** \u2014 which every harness reads as a hook error and lets the call\n# through. A guard that fails open on the most ordinary input there is (a Write\n# with no shell command) is worse than no guard, because it looks present.\n{ IFS= read -r INTUTIC_EXTRACT_STATE || true; IFS= read -r TOOL || true; IFS= read -r TARGET || true; IFS= read -r COMMAND || true; IFS= read -r SESSION_ID || true; IFS= read -r TOOL_INPUT_JSON || true; } <<EOF_INTUTIC_FIELDS\n$INTUTIC_FIELDS\nEOF_INTUTIC_FIELDS\nTOOL=\"${TOOL:-}\"; TARGET=\"${TARGET:-}\"; COMMAND=\"${COMMAND:-}\"; SESSION_ID=\"${SESSION_ID:-}\"\n# Empty means the extractor itself died (the fallback printf above): treat it\n# exactly like a payload the parser rejected. The gate body refuses on any\n# value other than \"ok\" \u2014 see the envelope refusal in emitShellGate.\nINTUTIC_EXTRACT_STATE=\"${INTUTIC_EXTRACT_STATE:-}\"\n[ -n \"$INTUTIC_EXTRACT_STATE\" ] || INTUTIC_EXTRACT_STATE=\"malformed\"\n# Empty only when the extractor failed wholesale (malformed stdin). Defaulting\n# to the empty OBJECT rather than the empty string keeps the argPattern match\n# well-defined either way.\nTOOL_INPUT_JSON=\"${TOOL_INPUT_JSON:-}\"\n[ -n \"$TOOL_INPUT_JSON\" ] || TOOL_INPUT_JSON=\"{}\"\n# Aliases for the names the older writers used. Kept so this extractor is a\n# drop-in for every bash gate; the canonical names are the unsuffixed ones.\nTOOL_NAME=\"$TOOL\"; TARGET_PATH=\"$TARGET\"\n";
+export declare const SHELL_EXTRACT: string;
 /**
  * The Python gate, for Open WebUI.
  *

package/dist/harness/gateBody.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateBody.d.ts","sourceRoot":"","sources":["../../src/harness/gateBody.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EACL,4BAA4B,EAG5B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,eAAO,MAAM,YAAY,IAAI,CAAA;AAE7B;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK9E,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,kEAAmE,CAAA;AAEjG;iDACiD;AACjD,eAAO,MAAM,wBAAwB,0BAA0B,CAAA;AAC/D,eAAO,MAAM,mBAAmB,0CAAgD,CAAA;AAChF;+BAC+B;AAC/B,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAkBvC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C;;;;;;;;;;;;;;GAcG;AACH;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,sBAAsB,GAAG,OAAO,CAAA;AAmCxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,aAAa,sFAAuF,CAAA;AAEjH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAMnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,iBAAiB,g0CAuB7B,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AA6ID,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAyZ5D;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,QAAQ,EAAE,aAAa,CAAA;IACvB;wEACoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAuGD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAmPtD;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA8H5C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAgCnE;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,4gIA8EzB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAyHvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAuJ5C;AAED;mEACmE;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAA"}
+{"version":3,"file":"gateBody.d.ts","sourceRoot":"","sources":["../../src/harness/gateBody.ts"],"names":[],"mappings":"AAmDA,OAAO,EACL,4BAA4B,EAI5B,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAIL,KAAK,eAAe,EAQrB,MAAM,uBAAuB,CAAA;AAK9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsKG;AACH,eAAO,MAAM,YAAY,KAAK,CAAA;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,kBAAkB,mQAerB,CAAA;AAEV;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK9E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,gIAUpB,CAAA;AAEV;iDACiD;AACjD,eAAO,MAAM,wBAAwB,0BAA0B,CAAA;AAC/D,eAAO,MAAM,mBAAmB,0CAAgD,CAAA;AAChF;+BAC+B;AAC/B,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,QA0CvB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C;;;;;;;;;;;;;;GAcG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,eAAe,GAAG,sBAAsB,GAAG,OAAO,CAAA;AAkDxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,aAAa,sFAAuF,CAAA;AAEjH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAMnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CA8CpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,OAAO,EAAE,eAAe,CAAA;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAeD;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CA0B/C;AAsID,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA8hB5D;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,OAAO,EAAE,eAAe,CAAA;IACxB,gCAAgC;IAChC,QAAQ,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;wEACoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AA0HD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAgWtD;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA8H5C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAkCnE;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,QA2HzB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAiJvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAiL5C;AAED;mEACmE;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAA"}