@lannguyensi/harness 0.18.0 → 0.20.0

package/dist/cli/init/templates.js

@@ -150,6 +150,15 @@ hooks:
     # blew through it. Bumped together with DEFAULT_PREFLIGHT_TIMEOUT_MS
     # (agent-tasks/7265599e).
     budget_ms: 70000
+    # Floor at agent-preflight 0.1.1, the release that distinguishes
+    # "tool not installed" (e.g. an npm script invoking eslint that is
+    # not in devDependencies) from real lint/test/typecheck failures.
+    # Stale 0.1.0 installs silently emit false-positive blockers that
+    # keep the preflight-before-* policies closed forever. version_command
+    # points at the source-of-truth preflight binary, not at the
+    # \`harness session-start preflight\` wrapper.
+    min_version: "0.1.1"
+    version_command: ["preflight", "--version"]
 
   - name: require-review-evidence
     event: PreToolUse
@@ -158,6 +167,20 @@ hooks:
     blocking: hard
     budget_ms: 2000
 
+  # Tool-agnostic parallel of require-review-evidence for operators on the
+  # gh-cli workflow (\`gh pr merge\`) instead of agent-tasks MCP. Same generic
+  # \`harness policy intercept\` entrypoint; the matching review-before-merge-bash
+  # policy below picks up the trigger. A PolicyTrigger can only AND-match one
+  # surface (MCP tool-name OR Bash command), so two parallel definitions are
+  # the minimum-scope way to cover both PR surfaces without bumping the schema.
+  - name: require-review-evidence-bash
+    event: PreToolUse
+    match: "Bash"
+    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'
+    command: harness policy intercept
+    blocking: hard
+    budget_ms: 2000
+
   - name: require-dogfood-evidence
     event: PreToolUse
     match: "Bash"
@@ -181,6 +204,20 @@ hooks:
     blocking: hard
     budget_ms: 2000
 
+  # Bash-surface parallel of require-review-subagent-evidence for operators
+  # who open PRs with \`gh pr create\` instead of agent-tasks MCP. The matching
+  # review-subagent-before-pr-create-bash policy below tags by branch
+  # (\`review-subagent:\${BRANCH}\`) because no task UUID is in \`gh pr create\`
+  # arguments; the working branch is the closest stable handle for "the
+  # PR-in-progress" at this point in the cycle.
+  - name: require-review-subagent-evidence-bash
+    event: PreToolUse
+    match: "Bash"
+    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'
+    command: harness policy intercept
+    blocking: hard
+    budget_ms: 2000
+
   - name: require-preflight-push-evidence
     event: PreToolUse
     match: "Bash"
@@ -213,6 +250,39 @@ policies:
       run:
         - 'mcp__agent-grounding__ledger_add { type: "fact", content: "review:\${PR_NUMBER} — <verdict + key findings + nits>" }'
 
+  # Bash-surface parallel of review-before-merge for operators on the gh-cli
+  # workflow. Two scope notes:
+  #   1. Tag shape: \`review:\${BRANCH}\` instead of \`review:\${PR_NUMBER}\`. The
+  #      \`gh pr merge\` invocation can target the PR by number, by URL, or by
+  #      the current branch (default), and PR_NUMBER is not extractable from
+  #      \`tool_input.command\` with today's JSONPath-only extract DSL. BRANCH
+  #      is the stable identifier the producer can record at review time.
+  #   2. This sits ALONGSIDE review-before-merge — not as a replacement. An
+  #      operator using both surfaces (e.g. agent-tasks MCP for most repos
+  #      + gh-cli for a quick hotfix) will have both gates active, each with
+  #      its own tag shape, which is semantically honest.
+  - name: review-before-merge-bash
+    description: Block \`gh pr merge\` unless a ledger entry tagged review:<branch> exists for this session.
+    trigger:
+      event: PreToolUse
+      match: "Bash"
+      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'
+    requires:
+      ledger_tag: "review:\${BRANCH}"
+    hook: require-review-evidence-bash
+    enforcement: block
+    producers:
+      - kind: mcp
+        verb: mcp__agent-grounding__ledger_add
+        example: '{type:"fact", content:"review:\${BRANCH} — <verdict + key findings + nits>", source:"Agent(general-purpose) review"}'
+        description: Spawn a review subagent against the branch diff, capture its verdict, then persist a ledger entry tagged with the branch name. Mirror of the review-before-merge producer for the gh-cli surface.
+    ux:
+      cannot: "You cannot merge the PR for branch \${BRANCH} via \`gh pr merge\` yet."
+      required:
+        - "a recorded review of the PR for branch \${BRANCH}"
+      run:
+        - 'mcp__agent-grounding__ledger_add { type: "fact", content: "review:\${BRANCH} — <verdict + key findings + nits>" }'
+
   - name: dogfood-before-release
     description: Block npm publish / git tag v* without a recent dogfood ledger entry.
     trigger:
@@ -304,6 +374,34 @@ policies:
       run:
         - 'mcp__agent-grounding__ledger_add { type: "fact", content: "review-subagent:\${TASK_ID} — <verdict + key findings + nits>" }'
 
+  # Bash-surface parallel of review-subagent-before-pr-create. Tag shape is
+  # \`review-subagent:\${BRANCH}\` because TASK_ID is an agent-tasks-only
+  # concept; for the gh-cli workflow the working branch is the closest stable
+  # handle for "the PR-in-progress" at this point. Same rationale as
+  # review-before-merge-bash: sits alongside the MCP variant, not as a
+  # replacement.
+  - name: review-subagent-before-pr-create-bash
+    description: Block \`gh pr create\` unless a review-subagent ledger entry tagged review-subagent:<branch> exists for this session. Forces the rigorous review BEFORE the PR opens.
+    trigger:
+      event: PreToolUse
+      match: "Bash"
+      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'
+    requires:
+      ledger_tag: "review-subagent:\${BRANCH}"
+    hook: require-review-subagent-evidence-bash
+    enforcement: block
+    producers:
+      - kind: mcp
+        verb: mcp__agent-grounding__ledger_add
+        example: '{type:"fact", content:"review-subagent:\${BRANCH} — <verdict + key findings + nits>", source:"Agent(general-purpose) review"}'
+        description: After running a review subagent against the staged diff for the working branch, persist its verdict + load-bearing findings as a ledger entry tagged with the branch name. Mirror of the review-subagent-before-pr-create producer for the gh-cli surface.
+    ux:
+      cannot: "You cannot open a pull request for branch \${BRANCH} via \`gh pr create\` yet."
+      required:
+        - "a completed review-subagent pass on branch \${BRANCH}"
+      run:
+        - 'mcp__agent-grounding__ledger_add { type: "fact", content: "review-subagent:\${BRANCH} — <verdict + key findings + nits>" }'
+
   - name: preflight-before-push
     description: Block git push unless a fresh preflight ledger entry exists for the current branch. Catches the stale-checkout class of incident at the last reversible step.
     trigger:
@@ -326,7 +424,7 @@ policies:
     ux:
       cannot: "You cannot push branch \${BRANCH} yet."
       required:
-        - "a fresh preflight for \${BRANCH} (within the last 10 minutes)"
+        - "a fresh preflight for \${BRANCH}, captured within the last 10 minutes. If you committed since the last preflight, re-run it before pushing: a preflight from earlier in the session does NOT cover a push that landed a new commit since."
       run:
         - "harness preflight"
 
@@ -367,22 +465,27 @@ policy_packs:
         run:
           - "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan"
           - "Run \`harness approve understanding\` and approve the prompt"
-      # approval_lifecycle (agent-tasks/d8ee60ca, v0.18.0+): expire the
-      # approval marker on task-completion boundaries so a multi-task
-      # session re-prompts for an Understanding Report between tasks.
-      # Without this, the legacy "one approval per session" contract
-      # lets a stale interpretation drive the next task's edits.
+      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,
+      # v0.18.0+): expire the approval marker on task-completion
+      # boundaries so a multi-task session re-prompts for an
+      # Understanding Report between tasks. Without this the legacy
+      # "one approval per session" contract lets a stale interpretation
+      # drive the next task's edits.
       #
-      # Defaults shipped when the block is omitted: expire on
-      # agent-tasks task_finish / task_abandon / pull_requests_merge,
-      # no max_age. Operators who prefer the legacy per-session
+      # Full ships both boundary kinds: the agent-tasks MCP verbs for
+      # operators on that workflow, plus a Bash regex list for hybrid
+      # operators who also use gh-cli for PR mechanics. \`max_age\` is
+      # the safety net. Operators who prefer the legacy per-session
       # behaviour opt out with \`approval_lifecycle: { mode: session }\`.
-      # Operators on other task systems override expire_on_tool_match.
+      # Operators on other task systems override the matchers.
       approval_lifecycle:
         expire_on_tool_match:
           - mcp__agent-tasks__task_finish
           - mcp__agent-tasks__task_abandon
           - mcp__agent-tasks__pull_requests_merge
+        expire_on_bash_match:
+          - '^gh pr (merge|close)\\b'
+          - '^git push origin (master|main)\\b'
         max_age: 4h
 
   # branch-protection (agent-tasks/2fdc5bbe, default-enabled since v0.17.2):

package/dist/cli/init/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgZ5B,CAAC;AAEF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuf5B,CAAC;AAEF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/cli/pack/hook-branch-protection.js

@@ -25,6 +25,7 @@
 // edit-on-master incidents, so a bug in the blocker that silently
 // allowed Writes through would defeat the purpose. The block envelope
 // always names a recovery path so the operator is never wedged.
+import * as path from "node:path";
 import { queryLedgerByTag, } from "../../policies/index.js";
 import { ACK_TAG_PREFIX, DEFAULT_PROTECTED_BRANCHES, NON_PROTECTED_TAG_PREFIX, PACK_NAME, PRODUCER_FRESHNESS_MS, resolveProtectedBranches, } from "../../policy-packs/builtin/branch-protection-runtime.js";
 import { resolveGitContext } from "../../runtime/git-context.js";
@@ -32,6 +33,33 @@ import { POLICY_DECISION_TYPE } from "../../runtime/ledger-record.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
 import { PolicyUxSchema } from "../../schema/index.js";
 import { loadManifest } from "../loader.js";
+/**
+ * Pull the destination file path out of a PreToolUse event's `tool_input`
+ * payload for the tools that mutate a single file. Returns null for tools
+ * that don't have a single resolvable target (Bash, search tools, etc.) —
+ * those keep cwd-based protection.
+ *
+ * Path-aware tools today: Write, Edit, MultiEdit, NotebookEdit.
+ */
+function extractTargetPath(toolName, toolInput) {
+    if (typeof toolInput !== "object" || toolInput === null)
+        return null;
+    const input = toolInput;
+    switch (toolName) {
+        case "Write":
+        case "Edit":
+        case "MultiEdit": {
+            const fp = input["file_path"];
+            return typeof fp === "string" && fp.length > 0 ? fp : null;
+        }
+        case "NotebookEdit": {
+            const np = input["notebook_path"];
+            return typeof np === "string" && np.length > 0 ? np : null;
+        }
+        default:
+            return null;
+    }
+}
 async function readStdin(stream) {
     return new Promise((resolve, reject) => {
         let data = "";
@@ -267,17 +295,36 @@ export async function runPackHookBranchProtectionCli(opts = {}) {
         return { exitCode: 0, blocked: false, diagnostic };
     }
     const { branches: protectedList } = resolveProtectedBranches(pack);
-    const { branch } = resolveGitContext(cwd);
     const configUx = parseConfigUx(pack.config["ux"], stderr);
+    // Resolve the branch context to gate against. For tools that target a
+    // single file (Write, Edit, MultiEdit, NotebookEdit), the relevant
+    // branch is whatever repo OWNS the target path — not cwd. Without this
+    // step, a Write to `~/.claude/memory/foo.md` from inside a checkout on
+    // a protected branch would be wrongly blocked, even though the target
+    // is outside any repo (memory files), or inside an unrelated repo, and
+    // the protection rules of cwd's repo have no bearing on it. For
+    // path-less tools (Bash, etc.) we fall back to cwd as before.
+    const targetPath = extractTargetPath(toolName, event.tool_input);
+    let branchSourceDir = cwd;
+    let branchSource = "cwd";
+    if (targetPath !== null) {
+        const absTarget = path.isAbsolute(targetPath)
+            ? targetPath
+            : path.resolve(cwd, targetPath);
+        branchSourceDir = path.dirname(absTarget);
+        branchSource = "target";
+    }
+    const { branch } = resolveGitContext(branchSourceDir);
     // Outside a git work tree (or detached HEAD) we can't tell what the
     // edit would land on. We choose to allow here — the alternative is
     // blocking every Write in non-git workspaces, which would be hostile
-    // to standalone-script workflows. A detached HEAD on an in-repo cwd
-    // also lands here; arguably should block, but git-detached-HEAD
-    // edits don't auto-push to a protected ref so the downstream
+    // to standalone-script workflows and to writes that target machine
+    // state under $HOME / /tmp. A detached HEAD on an in-repo target also
+    // lands here; arguably should block, but detached-HEAD edits don't
+    // auto-push to a protected ref so the downstream
     // `preflight-before-push` gate still catches the actual hazard.
     if (branch === "") {
-        const diagnostic = `cwd is not on a named branch (detached HEAD or outside a git work tree); allowing`;
+        const diagnostic = `${branchSource} is not on a named branch (detached HEAD or outside a git work tree); allowing`;
         note(diagnostic);
         return { exitCode: 0, blocked: false, diagnostic };
     }

package/dist/cli/pack/hook-branch-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-branch-protection.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-branch-protection.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,mCAAmC;AACnC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,8BAA8B;AAC9B,EAAE;AACF,sEAAsE;AACtE,qDAAqD;AACrD,uEAAuE;AACvE,gCAAgC;AAChC,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,gEAAgE;AAEhE,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAgD,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAkChE,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAWD,SAAS,eAAe,CAAC,OAAsB,EAAE,GAAS;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,qBAAqB,CAAC;IACrD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,oBAAoB,GAAkB,IAAI,CAAC;IAC/C,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,4DAA4D;QAC5D,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,+DAA+D;QAC/D,2CAA2C;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,SAAS;QAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAAE,SAAS;QACzC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YAC3B,gBAAgB,GAAG,IAAI,CAAC;YACxB,IAAI,oBAAoB,KAAK,IAAI;gBAAE,oBAAoB,GAAG,CAAC,CAAC,OAAO,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO;QACL,gBAAgB;QAChB,MAAM;QACN,oBAAoB;QACpB,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyB,EACzB,SAAiB,EACjB,IAAqC;IAErC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE,KAAK;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,sBAAsB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,wCAAwC;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,2DAA2D,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,MAAc,EACd,aAAgC,EAChC,EAAwB,EACxB,SAAiB;IAEjB,gEAAgE;IAChE,mEAAmE;IACnE,6DAA6D;IAC7D,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;QAC1D,UAAU;YACR,+BAA+B,QAAQ,yBAAyB,MAAM,KAAK;gBAC3E,GAAG,MAAM,IAAI;gBACb,6DAA6D;gBAC7D,oCAAoC;gBACpC,wCAAwC;gBACxC,8BAA8B,wBAAwB,gBAAgB,OAAO,oCAAoC;gBACjH,IAAI;gBACJ,qCAAqC,cAAc,kEAAkE;gBACrH,6DAA6D;gBAC7D,IAAI;gBACJ,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAwC,EAAE;IAE1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtB,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,yBAA0B,GAAa,CAAC,OAAO,yBAAyB,CAAC;YACxF,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,0DAA0D;YAC1D,+CAA+C;YAC/C,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CACvG,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,SAAS,SAAS,sCAAsC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,SAAS,SAAS,8BAA8B,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAC3B,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,EAC9C,MAAM,CACP,CAAC;IAEF,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,gEAAgE;IAChE,6DAA6D;IAC7D,gEAAgE;IAChE,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,mFAAmF,CAAC;QACvG,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,WAAW,MAAM,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC7G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,kFAAkF,CAAC;QAClG,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,wBAAwB,KAAK,CAAC,UAAU,IAAI,cAAc,aAAa,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,uBAAuB,KAAK,CAAC,oBAAoB,IAAI,wBAAwB,aAAa,CAAC;QAC9G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GACP,KAAK,CAAC,QAAQ,KAAK,IAAI;QACrB,CAAC,CAAC,oBAAoB,KAAK,CAAC,QAAQ,yBAAyB;QAC7D,CAAC,CAAC,YAAY,wBAAwB,SAAS,KAAK,CAAC,YAAY,4BAA4B,cAAc,WAAW,CAAC;IAC3H,MAAM,UAAU,GAAG,WAAW,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"hook-branch-protection.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-branch-protection.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,mCAAmC;AACnC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,8BAA8B;AAC9B,EAAE;AACF,sEAAsE;AACtE,qDAAqD;AACrD,uEAAuE;AACvE,gCAAgC;AAChC,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,gEAAgE;AAEhE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAgD,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAmChE;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,SAAkB;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YAClC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAWD,SAAS,eAAe,CAAC,OAAsB,EAAE,GAAS;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,qBAAqB,CAAC;IACrD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,oBAAoB,GAAkB,IAAI,CAAC;IAC/C,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,4DAA4D;QAC5D,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,+DAA+D;QAC/D,2CAA2C;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,SAAS;QAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAAE,SAAS;QACzC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YAC3B,gBAAgB,GAAG,IAAI,CAAC;YACxB,IAAI,oBAAoB,KAAK,IAAI;gBAAE,oBAAoB,GAAG,CAAC,CAAC,OAAO,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO;QACL,gBAAgB;QAChB,MAAM;QACN,oBAAoB;QACpB,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyB,EACzB,SAAiB,EACjB,IAAqC;IAErC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE,KAAK;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,sBAAsB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,wCAAwC;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,MAAM,EAAE,KAAK;YACb,oBAAoB,EAAE,IAAI;YAC1B,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,2DAA2D,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,MAAc,EACd,aAAgC,EAChC,EAAwB,EACxB,SAAiB;IAEjB,gEAAgE;IAChE,mEAAmE;IACnE,6DAA6D;IAC7D,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;QAC1D,UAAU;YACR,+BAA+B,QAAQ,yBAAyB,MAAM,KAAK;gBAC3E,GAAG,MAAM,IAAI;gBACb,6DAA6D;gBAC7D,oCAAoC;gBACpC,wCAAwC;gBACxC,8BAA8B,wBAAwB,gBAAgB,OAAO,oCAAoC;gBACjH,IAAI;gBACJ,qCAAqC,cAAc,kEAAkE;gBACrH,6DAA6D;gBAC7D,IAAI;gBACJ,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAwC,EAAE;IAE1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtB,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,yBAA0B,GAAa,CAAC,OAAO,yBAAyB,CAAC;YACxF,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,0DAA0D;YAC1D,+CAA+C;YAC/C,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CACvG,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,SAAS,SAAS,sCAAsC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,SAAS,SAAS,8BAA8B,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,aAAa,CAC3B,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,EAC9C,MAAM,CACP,CAAC;IAEF,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,eAAe,GAAG,GAAG,CAAC;IAC1B,IAAI,YAAY,GAAqB,KAAK,CAAC;IAC3C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC3C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,YAAY,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAEtD,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,iDAAiD;IACjD,gEAAgE;IAChE,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,GAAG,YAAY,gFAAgF,CAAC;QACnH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,WAAW,MAAM,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC7G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,kFAAkF,CAAC;QAClG,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,wBAAwB,KAAK,CAAC,UAAU,IAAI,cAAc,aAAa,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,uBAAuB,KAAK,CAAC,oBAAoB,IAAI,wBAAwB,aAAa,CAAC;QAC9G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GACP,KAAK,CAAC,QAAQ,KAAK,IAAI;QACrB,CAAC,CAAC,oBAAoB,KAAK,CAAC,QAAQ,yBAAyB;QAC7D,CAAC,CAAC,YAAY,wBAAwB,SAAS,KAAK,CAAC,YAAY,4BAA4B,cAAc,WAAW,CAAC;IAC3H,MAAM,UAAU,GAAG,WAAW,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/cli/pack/hook-post-tool-use.d.ts

@@ -3,16 +3,40 @@ import { type LoaderOptions } from "../loader.js";
 export interface PackHookPostToolUseOptions extends LoaderOptions {
     pack?: string;
     generatedDir?: string;
+    /**
+     * Override the persisted-report directory. Defaults to
+     * `defaultReportsDir()` which honours `UNDERSTANDING_GATE_REPORT_DIR`
+     * (set by the pack's hook-command wrapper) or falls back to
+     * `<cwd>/.understanding-gate/reports`.
+     */
+    reportsDir?: string;
     stdin?: NodeJS.ReadableStream;
     stderr?: NodeJS.WritableStream;
     manifest?: Manifest;
+    /** Override "now" for deterministic tests. */
+    now?: Date;
 }
 export interface PackHookPostToolUseResult {
     exitCode: number;
     /** Did the just-completed tool match the expiry list? */
     matchedExpiry: boolean;
-    /** Was the marker actually cleared (false if it was already absent). */
+    /** Was the session marker actually cleared (false if it was already absent). */
     markerCleared: boolean;
+    /**
+     * Was a task-scoped marker also cleared (harness/1ee26e77)? Only set
+     * when the matched tool was an agent-tasks task-transition verb AND
+     * `tool_input.taskId` was present in the event, AND a marker existed
+     * for that task id. False otherwise. Independent of markerCleared.
+     */
+    taskMarkerCleared: boolean;
+    /**
+     * Was the persisted report (`.understanding-gate/reports/...json`)
+     * flipped from `approved` to `expired`? Closes the silent re-approval
+     * bypass that pre-this-fix existed since PR #172: the marker was
+     * deleted on task_finish but the persisted-report fallback still
+     * satisfied the gate.
+     */
+    persistedReportExpired: boolean;
     /** Diagnostic line emitted to stderr. */
     diagnostic: string;
 }

package/dist/cli/pack/hook-post-tool-use.js

@@ -21,7 +21,7 @@
 // persists past the intended boundary, which degrades to the legacy
 // per-session contract.
 import { existsSync } from "node:fs";
-import { approvalMarkerPathFor, clearApprovalMarker, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { approvalMarkerPathFor, clearApprovalMarker, clearTaskApprovalMarker, defaultReportsDir, expirePersistedReport, parseApprovalLifecycle, taskApprovalMarkerPathFor, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
 import { loadManifest } from "../loader.js";
 const PACK_NAME = "understanding-before-execution";
@@ -38,8 +38,7 @@ async function readStdin(stream) {
 }
 // Match a tool name against one of the patterns. The pattern is a plain
 // tool name like `mcp__agent-tasks__task_finish`; wildcard expansion is
-// deliberately not supported in v1 so operators write what they mean
-// (a future `Bash(gh pr merge*)`-style shape can layer in later).
+// deliberately not supported in v1 so operators write what they mean.
 function toolMatches(toolName, patterns) {
     for (const p of patterns) {
         if (p === toolName)
@@ -47,9 +46,52 @@ function toolMatches(toolName, patterns) {
     }
     return false;
 }
+// Match a Bash tool_input.command against the operator's regex list.
+// Patterns are pre-compiled by parseApprovalLifecycle, so invalid
+// regexes were dropped (with a warning) at parse time and we just
+// iterate here. Empty / missing command short-circuits to false.
+function bashCommandMatches(command, patterns) {
+    if (command === "")
+        return undefined;
+    for (const re of patterns) {
+        if (re.test(command))
+            return re;
+    }
+    return undefined;
+}
+function extractBashCommand(toolInput) {
+    if (typeof toolInput !== "object" ||
+        toolInput === null ||
+        Array.isArray(toolInput)) {
+        return "";
+    }
+    const command = toolInput["command"];
+    return typeof command === "string" ? command : "";
+}
+// Pull `taskId` out of an MCP tool_input payload. agent-tasks verbs that
+// mark a task boundary (`task_finish`, `task_abandon`, etc.) carry the
+// taskId as a top-level string field. When present, the post-tool-use
+// hook also clears the corresponding task-scoped approval marker
+// (harness/1ee26e77). Returns "" when absent / malformed.
+function extractTaskId(toolInput) {
+    if (typeof toolInput !== "object" ||
+        toolInput === null ||
+        Array.isArray(toolInput)) {
+        return "";
+    }
+    const tid = toolInput["taskId"];
+    return typeof tid === "string" ? tid : "";
+}
 function noop(diagnostic, stderr) {
     stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, matchedExpiry: false, markerCleared: false, diagnostic };
+    return {
+        exitCode: 0,
+        matchedExpiry: false,
+        markerCleared: false,
+        taskMarkerCleared: false,
+        persistedReportExpired: false,
+        diagnostic,
+    };
 }
 export async function runPackHookPostToolUseCli(opts = {}) {
     const stdin = opts.stdin ?? process.stdin;
@@ -93,11 +135,24 @@ export async function runPackHookPostToolUseCli(opts = {}) {
         return noop(`harness pack hook post-tool-use: pack "${packName}" is enabled:false, skipping`, stderr);
     }
     const lifecycle = parseApprovalLifecycle(declared.config["approval_lifecycle"], stderr);
-    if (lifecycle.legacyMode || lifecycle.expireOnToolMatch.length === 0) {
-        return noop(`harness pack hook post-tool-use: no expire_on_tool_match configured (${lifecycle.legacyMode ? "legacy-session mode" : "empty list"}), skipping`, stderr);
+    if (lifecycle.legacyMode) {
+        return noop(`harness pack hook post-tool-use: legacy-session mode, skipping`, stderr);
     }
-    if (!toolMatches(toolName, lifecycle.expireOnToolMatch)) {
-        return noop(`harness pack hook post-tool-use: tool ${toolName} not in expire_on_tool_match, skipping`, stderr);
+    const noBoundariesConfigured = lifecycle.expireOnToolMatch.length === 0 && lifecycle.expireOnBashMatch.length === 0;
+    if (noBoundariesConfigured) {
+        return noop(`harness pack hook post-tool-use: no expire_on_tool_match or expire_on_bash_match configured, skipping`, stderr);
+    }
+    const toolNameMatched = toolMatches(toolName, lifecycle.expireOnToolMatch);
+    // Bash check only runs when the event is actually a Bash call; an MCP
+    // tool whose name happens to match a regex is not a Bash boundary.
+    const bashRegex = toolName === "Bash"
+        ? bashCommandMatches(extractBashCommand(event.tool_input), lifecycle.expireOnBashMatch)
+        : undefined;
+    if (!toolNameMatched && bashRegex === undefined) {
+        const detail = toolName === "Bash"
+            ? `Bash command did not match any expire_on_bash_match regex`
+            : `tool ${toolName} not in expire_on_tool_match`;
+        return noop(`harness pack hook post-tool-use: ${detail}, skipping`, stderr);
     }
     const generatedDir = opts.generatedDir ??
         (manifestPath !== undefined
@@ -117,14 +172,52 @@ export async function runPackHookPostToolUseCli(opts = {}) {
     const markerPath = approvalMarkerPathFor(generatedDir, sessionId);
     const wasPresent = existsSync(markerPath);
     clearApprovalMarker(generatedDir, sessionId);
+    // Task-scoped marker cleanup (harness/1ee26e77). Only when the
+    // matched tool is an MCP task-transition verb whose tool_input.taskId
+    // names a specific task; Bash regex boundaries don't carry a taskId
+    // by design.
+    let taskMarkerCleared = false;
+    let clearedTaskId = "";
+    if (toolNameMatched) {
+        const taskId = extractTaskId(event.tool_input);
+        if (taskId !== "") {
+            const taskMarkerPath = taskApprovalMarkerPathFor(generatedDir, taskId);
+            if (existsSync(taskMarkerPath)) {
+                clearTaskApprovalMarker(generatedDir, taskId);
+                taskMarkerCleared = true;
+                clearedTaskId = taskId;
+            }
+        }
+    }
+    // Persisted-report expiry (harness/1ee26e77 follow-up). Closes the
+    // silent bypass that existed since PR #172: marker-deletion alone
+    // did not invalidate the persisted-report fallback the gate consults
+    // when the marker is absent, so the next Edit/Write/Bash silently
+    // re-approved via the report even though the marker had just been
+    // expired. Best-effort; a missing reports dir or unrelated read
+    // failure is logged but does not break the hook.
+    const reportsDir = opts.reportsDir ?? defaultReportsDir();
+    const reportExpiry = expirePersistedReport(reportsDir, sessionId, opts.now);
+    const persistedReportExpired = reportExpiry.ok;
+    const matchSource = bashRegex !== undefined
+        ? `bash regex /${bashRegex.source}/`
+        : `tool name`;
+    const taskNote = taskMarkerCleared
+        ? `; also cleared task marker for task ${clearedTaskId}`
+        : "";
+    const reportNote = reportExpiry.ok
+        ? `; expired persisted report ${reportExpiry.filePath}`
+        : `; persisted-report expiry skipped (${reportExpiry.reason})`;
     const diagnostic = wasPresent
-        ? `harness pack hook post-tool-use: expired approval marker for session ${sessionId} after ${toolName}`
-        : `harness pack hook post-tool-use: ${toolName} matched expire_on_tool_match but no marker present for session ${sessionId}`;
+        ? `harness pack hook post-tool-use: expired approval marker for session ${sessionId} after ${toolName} (${matchSource})${taskNote}${reportNote}`
+        : `harness pack hook post-tool-use: ${toolName} matched ${matchSource} but no marker present for session ${sessionId}${taskNote}${reportNote}`;
     stderr.write(`${diagnostic}\n`);
     return {
         exitCode: 0,
         matchedExpiry: true,
         markerCleared: wasPresent,
+        taskMarkerCleared,
+        persistedReportExpired,
         diagnostic,
     };
 }

package/dist/cli/pack/hook-post-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAyBnD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,SAAS,WAAW,CAAC,QAAgB,EAAE,QAA2B;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CACT,wEAAwE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,aAAa,EAChJ,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CACT,yCAAyC,QAAQ,wCAAwC,EACzF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,4DAA4D;IAC5D,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,wEAAwE,SAAS,UAAU,QAAQ,EAAE;QACvG,CAAC,CAAC,oCAAoC,QAAQ,mEAAmE,SAAS,EAAE,CAAC;IAC/H,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,UAAU;QACzB,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAkDnD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,WAAW,CAAC,QAAgB,EAAE,QAA2B;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAA2B;IACtE,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAkB;IAC5C,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,iEAAiE;AACjE,0DAA0D;AAC1D,SAAS,aAAa,CAAC,SAAkB;IACvC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAI,SAAqC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,gEAAgE,EAChE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uGAAuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC3E,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,SAAS,GACb,QAAQ,KAAK,MAAM;QACjB,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,iBAAiB,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,eAAe,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,MAAM,GACV,QAAQ,KAAK,MAAM;YACjB,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B,CAAC;QACrD,OAAO,IAAI,CACT,oCAAoC,MAAM,YAAY,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,4DAA4D;IAC5D,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/B,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,sBAAsB,GAAG,YAAY,CAAC,EAAE,CAAC;IAE/C,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,uCAAuC,aAAa,EAAE;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE;QAChC,CAAC,CAAC,8BAA8B,YAAY,CAAC,QAAQ,EAAE;QACvD,CAAC,CAAC,sCAAsC,YAAY,CAAC,MAAM,GAAG,CAAC;IACjE,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,wEAAwE,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAChJ,CAAC,CAAC,oCAAoC,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;IACjJ,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,UAAU;QACzB,iBAAiB;QACjB,sBAAsB;QACtB,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.js

@@ -22,7 +22,7 @@
 // (Phase 4 #6) surfaces the runtime audit trail when configured.
 import { queryLedgerByTag, } from "../../policies/index.js";
 import { renderProducers } from "../../policies/producers.js";
-import { checkApprovalMarker, checkPersistedReport, defaultReportsDir, matchLedgerEntries, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { checkAnyTaskApprovalMarker, checkApprovalMarker, checkPersistedReport, defaultReportsDir, matchLedgerEntries, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir, writePendingApproval, } from "../../runtime/pending-approval.js";
 import { PolicyUxSchema, ProducerSchema, } from "../../schema/index.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
@@ -294,9 +294,30 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // manifest without a resolved path: only happens in tests).
     if (generatedDir !== undefined) {
         const lifecycle = parseApprovalLifecycle(declared.config["approval_lifecycle"], stderr);
-        const marker = checkApprovalMarker(generatedDir, sessionId, {
-            ...(lifecycle.maxAgeMs !== undefined && { maxAgeMs: lifecycle.maxAgeMs }),
-        });
+        const ageOpts = lifecycle.maxAgeMs !== undefined
+            ? { maxAgeMs: lifecycle.maxAgeMs }
+            : {};
+        // Source 1a: task-scoped marker (harness/1ee26e77). Any fresh
+        // `.approvals/task-<id>` marker satisfies the gate, regardless of
+        // which session approved it. This is the design-intent target for
+        // multi-task sessions; the operator opts in by passing `--task <id>`
+        // to `harness approve understanding`. When no task markers exist
+        // (operator never used --task, or all markers expired), the gate
+        // falls through to the session marker below — preserving the legacy
+        // contract for solo workflows.
+        const taskMarker = checkAnyTaskApprovalMarker(generatedDir, ageOpts);
+        if (taskMarker.matched) {
+            const diagnostic = `harness pack hook: ${taskMarker.detail}, allowing.`;
+            stderr.write(`${diagnostic}\n`);
+            return {
+                exitCode: 0,
+                blocked: false,
+                approvalCheck: { approved: true, source: "marker", detail: taskMarker.detail },
+                diagnostic,
+            };
+        }
+        // Source 1b: session-scoped marker (legacy / fallback).
+        const marker = checkApprovalMarker(generatedDir, sessionId, ageOpts);
         if (marker.matched) {
             const diagnostic = `harness pack hook: ${marker.detail}, allowing.`;
             stderr.write(`${diagnostic}\n`);