@lannguyensi/harness 0.25.2 → 0.27.0

package/dist/cli/event-input.js

@@ -0,0 +1,73 @@
+// Shared tool-event input handling for the Risk Gate verbs that take a
+// tool-event JSON file: `harness explain-action`, `harness test-risk`,
+// `harness resolve-env`, and `harness explain-policy`.
+//
+// Each applies the same not-found / malformed / non-object guards,
+// resolves the same ambient `EnvelopeContext` (git, host, user, now),
+// and builds the Action Envelope. This module is that shared front end
+// so every verb stays byte-identical in how it reads and normalizes
+// its input.
+import * as fs from "node:fs";
+import * as os from "node:os";
+import { buildActionEnvelope, resolveGitContext, } from "../runtime/index.js";
+import { EX_NOINPUT, HarnessExitError } from "./exit-codes.js";
+function safeUser() {
+    try {
+        return os.userInfo().username;
+    }
+    catch {
+        return "";
+    }
+}
+function safeHost() {
+    try {
+        return os.hostname();
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Read a tool-event JSON file and build its Action Envelope.
+ *
+ * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
+ * valid JSON, or does not decode to a JSON object. A well-formed but
+ * sparse event (e.g. `{}`) is accepted: the envelope builder fills
+ * absent fields with empty values rather than throwing. `verb` only
+ * prefixes the error messages so the operator sees which command failed.
+ */
+export function loadEventEnvelope(eventPath, seams = {}, verb = "explain-action") {
+    let raw;
+    try {
+        raw = fs.readFileSync(eventPath, "utf8");
+    }
+    catch {
+        throw new HarnessExitError(`${verb}: event file not found or unreadable: ${eventPath}`, EX_NOINPUT);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new HarnessExitError(`${verb}: malformed event JSON in ${eventPath}: ${err.message}`, EX_NOINPUT);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        const got = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
+        throw new HarnessExitError(`${verb}: event JSON must be an object, got ${got}`, EX_NOINPUT);
+    }
+    const event = parsed;
+    const fallbackCwd = seams.cwdFallback ?? process.cwd();
+    const cwd = typeof event.cwd === "string" && event.cwd.length > 0
+        ? event.cwd
+        : fallbackCwd;
+    const resolveGit = seams.resolveGit ?? resolveGitContext;
+    const envelope = buildActionEnvelope(event, {
+        cwd,
+        git: resolveGit(cwd),
+        user: seams.user ?? safeUser(),
+        host: seams.host ?? safeHost(),
+        now: seams.now ?? new Date(),
+    });
+    return { event, envelope };
+}
+//# sourceMappingURL=event-input.js.map

package/dist/cli/event-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-input.js","sourceRoot":"","sources":["../../src/cli/event-input.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,aAAa;AAEb,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAIlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAqB/D,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,QAAyB,EAAE,EAC3B,IAAI,GAAG,gBAAgB;IAEvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,yCAAyC,SAAS,EAAE,EAC3D,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,6BAA6B,SAAS,KAAM,GAAa,CAAC,OAAO,EAAE,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC;QAC7E,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,uCAAuC,GAAG,EAAE,EACnD,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAmB,CAAC;IAElC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,CAAC,KAAK,CAAC,GAAG;QACX,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAEzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC1C,GAAG;QACH,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/cli/explain-action.d.ts

@@ -0,0 +1,20 @@
+import type { ActionEnvelope } from "../runtime/index.js";
+import { type EventInputSeams } from "./event-input.js";
+export interface ExplainActionOptions extends EventInputSeams {
+    /** Path to the tool-event JSON file. */
+    eventPath: string;
+    /** Emit JSON instead of YAML. */
+    json?: boolean;
+}
+export interface ExplainActionResult {
+    output: string;
+    envelope: ActionEnvelope;
+}
+/**
+ * Build and render the Action Envelope for a tool-event JSON file.
+ *
+ * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
+ * valid JSON, or does not decode to a JSON object (see
+ * `loadEventEnvelope`). A well-formed but sparse event is accepted.
+ */
+export declare function explainAction(opts: ExplainActionOptions): ExplainActionResult;

package/dist/cli/explain-action.js

@@ -0,0 +1,27 @@
+// Phase 7 #2 — `harness explain-action` CLI entrypoint.
+//
+// Debug verb for the Risk Gate. Reads a tool-event JSON file (the
+// Claude Code PreToolUse hook payload shape), builds the Action
+// Envelope, and prints it. This is the inspection surface for the
+// envelope normalization that Phase 7 #3-#5 build the classifier,
+// resolver, and policy evaluator on top of.
+//
+// File read, JSON guards, and envelope build live in the shared
+// `event-input` front end; this module only renders the result.
+import { stringify as stringifyYaml } from "yaml";
+import { loadEventEnvelope } from "./event-input.js";
+/**
+ * Build and render the Action Envelope for a tool-event JSON file.
+ *
+ * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
+ * valid JSON, or does not decode to a JSON object (see
+ * `loadEventEnvelope`). A well-formed but sparse event is accepted.
+ */
+export function explainAction(opts) {
+    const { envelope } = loadEventEnvelope(opts.eventPath, opts, "explain-action");
+    const output = opts.json
+        ? `${JSON.stringify(envelope, null, 2)}\n`
+        : stringifyYaml(envelope, { lineWidth: 0 });
+    return { output, envelope };
+}
+//# sourceMappingURL=explain-action.js.map

package/dist/cli/explain-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-action.js","sourceRoot":"","sources":["../../src/cli/explain-action.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,kEAAkE;AAClE,gEAAgE;AAChE,kEAAkE;AAClE,kEAAkE;AAClE,4CAA4C;AAC5C,EAAE;AACF,gEAAgE;AAChE,gEAAgE;AAEhE,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAc3E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC1C,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/cli/explain-policy.d.ts

@@ -0,0 +1,54 @@
+import { type EnvironmentResolution, type RiskProfile, type WhenClauseResult } from "../runtime/index.js";
+import type { Manifest } from "../schema/index.js";
+import { type EventInputSeams } from "./event-input.js";
+import { type LoaderOptions } from "./loader.js";
+export interface ExplainPolicyOptions extends EventInputSeams, LoaderOptions {
+    /** Path to the tool-event JSON file (the `--event` argument). */
+    eventPath: string;
+    /** Emit JSON instead of YAML. */
+    json?: boolean;
+    /** Inject the resolved manifest (tests); bypasses `loadManifest`. */
+    manifest?: Manifest;
+    /** Inject env vars for `env_var_patterns` (tests); defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    /** Inject the kube context (tests); bypasses `~/.kube/config`. */
+    kubeContext?: string;
+    /** Inject the kube namespace (tests); bypasses `~/.kube/config`. */
+    kubeNamespace?: string;
+}
+interface ExplainPolicyProjection {
+    policy: string;
+    description: string;
+    trigger: {
+        event: string;
+        match?: string;
+        path_match?: string;
+        bash_match?: string;
+        matched: boolean;
+    };
+    classifier: RiskProfile;
+    environment: EnvironmentResolution;
+    when: {
+        declared: false;
+    } | {
+        declared: true;
+        matched: boolean;
+        clauses: WhenClauseResult[];
+        unclassifiedFallback: boolean;
+    };
+    /** trigger AND when — would this policy fire on this event? */
+    applies: boolean;
+}
+export interface ExplainPolicyResult {
+    output: string;
+    projection: ExplainPolicyProjection;
+}
+/**
+ * Explain whether `policyName` applies to the event at `opts.eventPath`.
+ *
+ * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
+ * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
+ * `loadEventEnvelope`) when the event file is missing or malformed.
+ */
+export declare function explainPolicy(policyName: string, opts: ExplainPolicyOptions): ExplainPolicyResult;
+export {};

package/dist/cli/explain-policy.js

@@ -0,0 +1,81 @@
+// Phase 7 #5 — `harness explain-policy` CLI entrypoint.
+//
+// Risk Gate debug verb: given a policy name and a tool-event JSON file,
+// explain whether the policy would APPLY to that event, and why. A
+// policy applies only when its `trigger:` matches AND — when declared —
+// every `when:` clause holds against the enriched Action Envelope. This
+// verb shows both verdicts side by side: the trigger match, the Risk
+// Classifier profile, the resolved environment, and a per-clause `when:`
+// breakdown, so an operator authoring a risk policy sees exactly which
+// clause admitted an action or held it back.
+//
+// Distinct from `harness explain <policy> --trace`: that replays the
+// LAST recorded decision from the evidence ledger; `explain-policy`
+// evaluates a hypothetical event live and reads nothing from the ledger.
+import { stringify as stringifyYaml } from "yaml";
+import { classifyRisk, evaluateWhen, policyMatchesEvent, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
+import { loadEventEnvelope } from "./event-input.js";
+import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
+import { loadManifest } from "./loader.js";
+/**
+ * Explain whether `policyName` applies to the event at `opts.eventPath`.
+ *
+ * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
+ * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
+ * `loadEventEnvelope`) when the event file is missing or malformed.
+ */
+export function explainPolicy(policyName, opts) {
+    const manifest = opts.manifest ?? loadManifest(opts).manifest;
+    const policy = manifest.policies.find((p) => p.name === policyName);
+    if (!policy) {
+        const available = manifest.policies.map((p) => p.name).join(", ") || "(none)";
+        throw new HarnessExitError(`no policy named "${policyName}" declared; available: ${available}`, EX_USAGE);
+    }
+    const { event, envelope } = loadEventEnvelope(opts.eventPath, opts, "explain-policy");
+    // Kube seams resolve together: if either is injected, skip the
+    // `~/.kube/config` read entirely — same contract as `resolve-env`.
+    const kube = opts.kubeContext !== undefined || opts.kubeNamespace !== undefined
+        ? { context: opts.kubeContext ?? "", namespace: opts.kubeNamespace ?? "" }
+        : resolveKubeContext();
+    const classifier = classifyRisk(envelope, manifest.risk.classifiers);
+    const environment = resolveEnvironment(envelope, manifest.environments.resolvers, {
+        env: opts.env ?? process.env,
+        kubeContext: kube.context,
+        kubeNamespace: kube.namespace,
+    });
+    const triggerMatched = policyMatchesEvent(policy, event);
+    const whenEval = policy.when !== undefined
+        ? evaluateWhen(policy.when, { risk: classifier, environment })
+        : undefined;
+    const projection = {
+        policy: policy.name,
+        description: policy.description,
+        trigger: {
+            event: policy.trigger.event,
+            ...(policy.trigger.match !== undefined && { match: policy.trigger.match }),
+            ...(policy.trigger.path_match !== undefined && {
+                path_match: policy.trigger.path_match,
+            }),
+            ...(policy.trigger.bash_match !== undefined && {
+                bash_match: policy.trigger.bash_match,
+            }),
+            matched: triggerMatched,
+        },
+        classifier,
+        environment,
+        when: whenEval
+            ? {
+                declared: true,
+                matched: whenEval.matched,
+                clauses: whenEval.clauses,
+                unclassifiedFallback: whenEval.unclassifiedFallback,
+            }
+            : { declared: false },
+        applies: triggerMatched && (whenEval ? whenEval.matched : true),
+    };
+    const output = opts.json
+        ? `${JSON.stringify(projection, null, 2)}\n`
+        : stringifyYaml(projection, { lineWidth: 0 });
+    return { output, projection };
+}
+//# sourceMappingURL=explain-policy.js.map

package/dist/cli/explain-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AA8C/D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAC3C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/explain.js

@@ -121,6 +121,10 @@ function renderTrace(latest, manifest, sessionId, json) {
             ...(trigger?.match !== undefined && { match: trigger.match }),
             ...(trigger?.bash_match !== undefined && { bashMatch: trigger.bash_match }),
         },
+        ...(latest.payload.risk && { classifier: latest.payload.risk }),
+        ...(latest.payload.environment && {
+            environment: latest.payload.environment,
+        }),
         extract: latest.payload.extractValues,
         ...(latest.payload.requiresEval && { requiresEval: latest.payload.requiresEval }),
         ...(policy && {

package/dist/cli/explain.js.map

@@ -1 +1 @@
-{"version":3,"file":"explain.js","sourceRoot":"","sources":["../../src/cli/explain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,eAAe,EACf,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAmD/D,SAAS,cAAc,CAAC,IAAoB;IAC1C,OAAO,KAAK,EAAE,SAAiB,EAA8B,EAAE;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,OAAsB;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB,EACtB,cAAsC;IAEtC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,cAAc,CAC5E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,YAAY,kBAAkB,SAAS,6DAA6D,EACnI,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,4EAA4E,EAC5E,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,mEAAmE;YACnE,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,kEAAkE;YAClE,6CAA6C;YAC7C,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,mEAAmE;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,UAAU,mBAAmB,SAAS,MAAM;YAClF,0EAA0E;YAC1E,kEAAkE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAClB,MAAe,EACf,QAAqD,EACrD,SAAiB,EACjB,IAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;QAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;QACnC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,cAAc,EAAE;YACd,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,oDAAoD;YAC7E,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;SAC5E;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QACrC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjF,GAAG,CAAC,MAAM,IAAI;YACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtE,CAAC;QACF,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;KACnD,CAAC;IAEF,OAAO,IAAI;QACT,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"explain.js","sourceRoot":"","sources":["../../src/cli/explain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,eAAe,EACf,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AA4D/D,SAAS,cAAc,CAAC,IAAoB;IAC1C,OAAO,KAAK,EAAE,SAAiB,EAA8B,EAAE;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,OAAsB;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB,EACtB,cAAsC;IAEtC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,cAAc,CAC5E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,YAAY,kBAAkB,SAAS,6DAA6D,EACnI,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,4EAA4E,EAC5E,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,mEAAmE;YACnE,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,kEAAkE;YAClE,6CAA6C;YAC7C,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,mEAAmE;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,UAAU,mBAAmB,SAAS,MAAM;YAClF,0EAA0E;YAC1E,kEAAkE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAClB,MAAe,EACf,QAAqD,EACrD,SAAiB,EACjB,IAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;QAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;QACnC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,cAAc,EAAE;YACd,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,oDAAoD;YAC7E,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;SAC5E;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI;YAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;SACxC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QACrC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjF,GAAG,CAAC,MAAM,IAAI;YACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtE,CAAC;QACF,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;KACnD,CAAC;IAEF,OAAO,IAAI;QACT,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/index.js

@@ -32,6 +32,7 @@ import { runPackHookCodexPreToolUseCli } from "./pack/hook-codex-pre-tool-use.js
 import { runPackHookCodexStopCli } from "./pack/hook-codex-stop.js";
 import { runPackHookCodexUserPromptSubmitCli } from "./pack/hook-codex-user-prompt-submit.js";
 import { isRuntime, KNOWN_RUNTIMES } from "../policy-packs/index.js";
+import { approveRisk } from "./approve/risk.js";
 import { approveUnderstanding } from "./approve/understanding.js";
 import { describe, isPillar } from "./describe.js";
 import { diff as diffRun } from "./diff/index.js";
@@ -41,6 +42,10 @@ import { doctor, isDoctorTarget, KNOWN_DOCTOR_TARGETS } from "./doctor/index.js"
 import { format as formatDoctor } from "./doctor/format.js";
 import { EX_FAIL, EX_USAGE, HarnessExitError } from "./exit-codes.js";
 import { explain } from "./explain.js";
+import { explainAction } from "./explain-action.js";
+import { explainPolicy } from "./explain-policy.js";
+import { testRisk } from "./test-risk.js";
+import { resolveEnv } from "./resolve-env.js";
 import { detect as detectInit } from "./init/detect.js";
 import { init, isTemplate, KNOWN_TEMPLATES } from "./init/index.js";
 import { runInteractive } from "./init/interactive.js";
@@ -986,7 +991,49 @@ export function buildProgram(opts = {}) {
         }
         stdout(`${lines.join("\n")}\n`);
     });
-    const VALID_DECISION_FILTERS = ["allow", "deny", "warn-degraded"];
+    approveCmd
+        .command("risk")
+        .description("Grant a Risk Gate require_approval decision: write the " +
+        "risk-approved:${SESSION_ID} evidence-ledger tag the blocked policy's " +
+        "requires consults. Operator action — run it after reviewing the blocked action.")
+        .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
+        .option("--project <name>", "apply per-project overrides")
+        .option("--session <id>", "explicit session id (default: $CLAUDE_SESSION_ID, then $CODEX_SESSION_ID, then staged .pending-approval)")
+        .action(async (options) => {
+        const cliOpts = {};
+        if (options.config)
+            cliOpts.configPath = options.config;
+        if (options.project)
+            cliOpts.project = options.project;
+        if (options.session)
+            cliOpts.session = options.session;
+        const result = await approveRisk(cliOpts);
+        const lines = [];
+        const sourceNote = result.sessionSource === "pending-approval"
+            ? " (resolved from .pending-approval staged by the gate hook)"
+            : result.sessionSource === "env-claude"
+                ? " (from $CLAUDE_SESSION_ID)"
+                : result.sessionSource === "env-codex"
+                    ? " (from $CODEX_SESSION_ID)"
+                    : "";
+        lines.push(`session: ${result.sessionId}${sourceNote}`);
+        if (result.ledger.ok) {
+            lines.push(`ledger:  ✓ wrote ${result.ledger.tag}`);
+            lines.push("  the Risk Gate require_approval policy now passes for this session.");
+        }
+        else {
+            lines.push(`ledger:  ✗ FAILED (${result.ledger.reason ?? "unknown"})`);
+            lines.push("  the require_approval gate stays blocked until the tag is recorded.");
+        }
+        stdout(`${lines.join("\n")}\n`);
+    });
+    const VALID_DECISION_FILTERS = [
+        "allow",
+        "warn",
+        "require_approval",
+        "deny",
+        "warn-degraded",
+    ];
     const isDecisionFilter = (v) => VALID_DECISION_FILTERS.includes(v);
     program
         .command("explain [policy]")
@@ -996,7 +1043,7 @@ export function buildProgram(opts = {}) {
         .option("--json", "emit JSON instead of YAML")
         .option("--trace", "include the full decision trail from the most recent evaluation")
         .option("--last", "trace the most recent policy decision in the ledger (any policy); mutually exclusive with <policy>")
-        .option("--decision <outcome>", "with --last, restrict to decisions of this outcome (allow / deny / warn-degraded)")
+        .option("--decision <outcome>", `with --last, restrict to decisions of this outcome (${VALID_DECISION_FILTERS.join(" / ")})`)
         .option("--session <id>", "grounding session whose audit log to read (default: $CLAUDE_SESSION_ID, then 'default')")
         .action(async (policyName, options) => {
         if (options.last && policyName !== undefined) {
@@ -1006,7 +1053,7 @@ export function buildProgram(opts = {}) {
             throw new HarnessExitError("explain: --decision requires --last", EX_USAGE);
         }
         if (options.decision !== undefined && !isDecisionFilter(options.decision)) {
-            throw new HarnessExitError(`explain: --decision must be one of allow, deny, warn-degraded (got "${options.decision}")`, EX_USAGE);
+            throw new HarnessExitError(`explain: --decision must be one of ${VALID_DECISION_FILTERS.join(", ")} (got "${options.decision}")`, EX_USAGE);
         }
         const explainOpts = {};
         if (options.config)
@@ -1027,12 +1074,87 @@ export function buildProgram(opts = {}) {
         const result = await explain(policyName, explainOpts);
         stdout(result.output);
     });
+    program
+        .command("explain-action <event.json>")
+        .description("Risk Gate debug verb (Phase 7): read a tool-event JSON file (the Claude Code PreToolUse hook payload shape: " +
+        "{ hook_event_name, tool_name, tool_input, session_id, cwd }) and print the normalized Action Envelope. " +
+        "Inspection surface for the envelope that downstream Risk Gate stages consume; does not evaluate policies.")
+        .option("--json", "emit the envelope as JSON instead of YAML")
+        .action((eventPath, options) => {
+        const result = explainAction({
+            eventPath,
+            ...(options.json === true && { json: true }),
+        });
+        stdout(result.output);
+        if (!result.output.endsWith("\n"))
+            stdout("\n");
+    });
+    program
+        .command("test-risk <event.json>")
+        .description("Risk Gate debug verb (Phase 7): read a tool-event JSON file, build its Action Envelope, and classify it " +
+        "against the manifest's risk.classifiers[]. Prints the risk profile (severity, categories, reversibility, " +
+        "confidence, reasons). An action no pattern matches reports as unclassified, not as safe.")
+        .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
+        .option("--project <name>", "apply per-project overrides")
+        .option("--json", "emit the risk profile as JSON instead of YAML")
+        .action((eventPath, options) => {
+        const result = testRisk({
+            eventPath,
+            ...(options.config !== undefined && { configPath: options.config }),
+            ...(options.project !== undefined && { project: options.project }),
+            ...(options.json === true && { json: true }),
+        });
+        stdout(result.output);
+        if (!result.output.endsWith("\n"))
+            stdout("\n");
+    });
+    program
+        .command("resolve-env <event.json>")
+        .description("Risk Gate debug verb (Phase 7): read a tool-event JSON file, build its Action Envelope, and resolve its " +
+        "target environment against the manifest's environments.resolvers[] (branch / env-var / kube-context / " +
+        "kube-namespace signals). An action no resolver matches resolves to `unknown`, not to a safe default.")
+        .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
+        .option("--project <name>", "apply per-project overrides")
+        .option("--json", "emit the environment resolution as JSON instead of YAML")
+        .action((eventPath, options) => {
+        const result = resolveEnv({
+            eventPath,
+            ...(options.config !== undefined && { configPath: options.config }),
+            ...(options.project !== undefined && { project: options.project }),
+            ...(options.json === true && { json: true }),
+        });
+        stdout(result.output);
+        if (!result.output.endsWith("\n"))
+            stdout("\n");
+    });
+    program
+        .command("explain-policy <policy>")
+        .description("Risk Gate debug verb (Phase 7): explain whether <policy> would APPLY to a tool event. " +
+        "Reads the event from --event, builds and enriches the Action Envelope, and shows the " +
+        "trigger match, the risk classification, the resolved environment, and a per-clause " +
+        "`when:` breakdown. Evaluates a hypothetical event live and reads nothing from the " +
+        "ledger (use `harness explain <policy> --trace` for the last recorded decision).")
+        .requiredOption("--event <event.json>", "path to the tool-event JSON file")
+        .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
+        .option("--project <name>", "apply per-project overrides")
+        .option("--json", "emit the explanation as JSON instead of YAML")
+        .action((policyName, options) => {
+        const result = explainPolicy(policyName, {
+            eventPath: options.event,
+            ...(options.config !== undefined && { configPath: options.config }),
+            ...(options.project !== undefined && { project: options.project }),
+            ...(options.json === true && { json: true }),
+        });
+        stdout(result.output);
+        if (!result.output.endsWith("\n"))
+            stdout("\n");
+    });
     program
         .command("audit")
         .description("Replay policy decisions from the evidence ledger for a time window")
         .option("--since <duration>", "time window (default: 24h)")
         .option("--policy <name>", "filter to a single policy by name")
-        .option("--outcome <outcome>", "filter by decision outcome (allow / deny / warn-degraded)")
+        .option("--outcome <outcome>", "filter by decision outcome (allow / warn / require_approval / deny / warn-degraded)")
         .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
         .option("--project <name>", "apply per-project overrides")
         .option("--session <id>", "grounding session whose audit log to read (default: $CLAUDE_SESSION_ID, then 'default')")