@lannguyensi/harness 0.27.0 → 0.28.0

package/dist/cli/init/templates.d.ts

@@ -1,4 +1,4 @@
 export declare const MINIMAL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template minimal`.\n#\n# This is the empty-but-valid manifest. Run `harness validate` to confirm it\n# parses, then add entries under the five top-level keys:\n#\n#   grounding:  evidence-ledger + claim-gate config (see docs/ARCHITECTURE.md \u00A72)\n#   tools:      mcp / cli / skills / builtin inventory   (\u00A73)\n#   memory:     directories, retention, scopes           (\u00A74)\n#   hooks:      event-bound shell commands               (\u00A75)\n#   policies:   named rules that bind hooks to triggers  (\u00A76)\n#\n# Phase 2 verbs to add entries safely: `harness add mcp <name> ...`,\n# `harness add cli`, `harness add hook`, `harness add skill`.\n# Per-machine overrides live at ~/.harness/machines/<discriminator>.harness.overrides.yaml\n# (ARCHITECTURE.md \u00A78) for paths that vary per host.\n#\n# Docs: https://github.com/LanNguyenSi/harness\n\nversion: 1\n";
-export declare const FULL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template full`. The reference manifest:\n# every example policy from docs/examples/full-manifest.yaml wired through\n# the generic `harness policy intercept` engine, so no external shell\n# scripts under ~/.claude/hooks/ are required.\n#\n# Canonical source for the policy + policy_packs sections is\n# docs/examples/full-manifest.yaml. A parity vitest\n# (tests/cli/init-full-template-parity.test.ts) fails the build if the\n# two diverge on policy names or load-bearing fields.\n#\n# What you still need on PATH (the wizard offers to `npm i -g` these on\n# init): agent-tasks-mcp-bridge, grounding-mcp, memory-router-*,\n# understanding-gate-claude-*.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n  policies_source: ~/.claude/harness.d/policies/claim-gate.yaml\n\ntools:\n  mcp:\n    # codebase-oracle (the Pandora RAG MCP server) is intentionally NOT\n    # in the Full default. It is published as\n    # `@lannguyensi/codebase-oracle` and works fine standalone, but it\n    # is an opinionated workflow add-on (multi-repo semantic search)\n    # rather than infrastructure harness itself assumes. Operators who\n    # want it wire it explicitly:\n    #   npm i -g @lannguyensi/codebase-oracle\n    #   harness add mcp codebase-oracle --command codebase-oracle,mcp\n    # Set ORACLE_SCAN_ROOT (absolute path; tilde is not expanded by the\n    # MCP env block) and OPENAI_API_KEY (or switch providers via\n    # ORACLE_LLM_PROVIDER) before the first call.\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH. The bridge owns token\n      # storage and defaults to the hosted backend; override with\n      # `AGENT_TASKS_BASE_URL` / `AGENT_TASKS_TOKEN` for self-hosted.\n      # `min_version` floor: 0.6.0 added the `--version` short-circuit\n      # the doctor probe needs (PR agent-tasks/240, release-cut PR 241).\n      # Bump the floor whenever a fix you depend on lands; loose floors\n      # are fine, the point is the drift signal not pinning a specific cut.\n      command: [agent-tasks-mcp-bridge]\n      min_version: \"0.6.0\"\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # Published bin from `@lannguyensi/grounding-mcp`. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident). `min_version` floor: 0.2.0\n      # added the `--version` short-circuit the doctor probe needs (PR\n      # agent-grounding/76, release-cut PR 77).\n      command: [grounding-mcp]\n      min_version: \"0.2.0\"\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n\n  cli:\n    - name: gh\n      binary: gh\n      required: true\n\n  skills:\n    enabled:\n      - simplify\n      - init\n      - review\n      - security-review\n    source_dirs:\n      - ~/.claude/skills\n\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # Published bin from `@lannguyensi/memory-router`.\n    # `min_version` floor: 0.3.0 added the `--version` short-circuit\n    # the doctor probe needs (PR agent-memory/40, release-cut PR 41).\n    command: [memory-router-user-prompt-submit]\n    min_version: \"0.3.0\"\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\n# All PreToolUse hooks share the generic `harness policy intercept` CLI\n# entrypoint. The engine reads the tool event on stdin, evaluates whichever\n# policy below has a matching trigger (`match` + optional `bash_match`),\n# and emits Claude Code's deny envelope when the required ledger tag is\n# absent. No external shell scripts are required.\n#\n# The `git-preflight` SessionStart hook is the producer side of the\n# `preflight-before-*` policies: `harness session-start preflight` runs\n# agent-preflight against the session cwd and, on a ready:true result,\n# records `preflight:${REPO}` to the evidence ledger. It needs the\n# `preflight` binary on PATH (`npm i -g @lannguyensi/agent-preflight`); when\n# that is absent the hook logs to stderr and exits 0, so the session is\n# never broken \u2014 the preflight gates just stay closed until a tag is\n# produced some other way.\nhooks:\n  - name: git-preflight\n    event: SessionStart\n    command: harness session-start preflight\n    blocking: false\n    # 70s budget gives the wrapped preflight (default 60s) headroom plus\n    # ledger-write time. Was 30s through v0.17.4, but a healthy preflight\n    # on a medium-size repo takes ~28s and the old 25s wrapper ceiling\n    # blew through it. Bumped together with DEFAULT_PREFLIGHT_TIMEOUT_MS\n    # (agent-tasks/7265599e).\n    budget_ms: 70000\n    # Floor at agent-preflight 0.2.0, the release that makes secret\n    # detection git-aware and diff-scoped: a gitignored+untracked .env,\n    # a .md doc, a non-git dir, or a secret in a tracked file the branch\n    # never touched is a non-blocking warn, not a hard fail. Pre-0.2.0\n    # installs hard-fail preflight on the normal correct state (a\n    # gitignored .env holding real credentials), so this SessionStart\n    # producer never writes a preflight: tag and the preflight-before-*\n    # policies stay closed forever on any repo with a local .env. (0.1.1\n    # had already fixed the wrapper-script \"tool not installed\" false\n    # positive.) version_command points at the source-of-truth preflight\n    # binary, not at the `harness session-start preflight` wrapper.\n    min_version: \"0.2.0\"\n    version_command: [\"preflight\", \"--version\"]\n\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Tool-agnostic parallel of require-review-evidence for operators on the\n  # gh-cli workflow (`gh pr merge`) instead of agent-tasks MCP. Same generic\n  # `harness policy intercept` entrypoint; the matching review-before-merge-bash\n  # policy below picks up the trigger. A PolicyTrigger can only AND-match one\n  # surface (MCP tool-name OR Bash command), so two parallel definitions are\n  # the minimum-scope way to cover both PR surfaces without bumping the schema.\n  - name: require-review-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-dogfood-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  - name: require-review-subagent-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_create\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Bash-surface parallel of require-review-subagent-evidence for operators\n  # who open PRs with `gh pr create` instead of agent-tasks MCP. The matching\n  # review-subagent-before-pr-create-bash policy below tags by branch\n  # (`review-subagent:${BRANCH}`) because no task UUID is in `gh pr create`\n  # arguments; the working branch is the closest stable handle for \"the\n  # PR-in-progress\" at this point in the cycle.\n  - name: require-review-subagent-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-push-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # risk-gate (Phase 7 #6): the Risk Gate enforcement hook. The\n  # gate-prod-destructive policies below reference it. Same generic\n  # `harness policy intercept` entrypoint as every other policy hook;\n  # the interceptor builds the Action Envelope, classifies risk against\n  # `risk.classifiers[]`, resolves the environment against\n  # `environments.resolvers[]`, and evaluates the policies' `when:`.\n  - name: risk-gate\n    event: PreToolUse\n    match: \"Bash\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number. The content should be self-contained enough for an auditor to read without re-opening the chat.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-before-merge for operators on the gh-cli\n  # workflow. Two scope notes:\n  #   1. Tag shape: `review:${BRANCH}` instead of `review:${PR_NUMBER}`. The\n  #      `gh pr merge` invocation can target the PR by number, by URL, or by\n  #      the current branch (default), and PR_NUMBER is not extractable from\n  #      `tool_input.command` with today's JSONPath-only extract DSL. BRANCH\n  #      is the stable identifier the producer can record at review time.\n  #   2. This sits ALONGSIDE review-before-merge \u2014 not as a replacement. An\n  #      operator using both surfaces (e.g. agent-tasks MCP for most repos\n  #      + gh-cli for a quick hotfix) will have both gates active, each with\n  #      its own tag shape, which is semantically honest.\n  - name: review-before-merge-bash\n    description: Block `gh pr merge` unless a ledger entry tagged review:<branch> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    requires:\n      ledger_tag: \"review:${BRANCH}\"\n    hook: require-review-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the branch diff, capture its verdict, then persist a ledger entry tagged with the branch name. Mirror of the review-before-merge producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot merge the PR for branch ${BRANCH} via `gh pr merge` yet.\"\n      required:\n        - \"a recorded review of the PR for branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: dogfood-before-release\n    description: Block npm publish / git tag v* without a recent dogfood ledger entry.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    requires:\n      ledger_tag: \"dogfood:${SESSION_ID}\"\n      within: 24h\n    hook: require-dogfood-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary against the live system>\", source:\"manual smoke test\"}'\n        description: Before tagging or publishing, run the release path end-to-end against the live system (not just unit tests) and persist the result as a session-tagged ledger entry. Document what you exercised (install, CLI happy path, MCP handshake, etc.) so a future auditor can tell whether the smoke covered the change.\n    ux:\n      cannot: \"You cannot publish a release yet.\"\n      required:\n        - \"an end-to-end dogfood run in this session\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary>\" }'\n\n  - name: two-reviewers-required\n    description: At least two distinct reviewer ledger entries must exist for the PR.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n      count:\n        min: 2\n    hook: require-review-evidence\n    enforcement: warn\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review (reviewer 2)\"}'\n        description: Same shape as review-before-merge but TWO DISTINCT reviewer entries must exist before the gate is satisfied (count.min 2). Distinguish reviewers by source so the count is honest. Warn-level enforcement, so the agent CAN merge with one reviewer but should consider spawning a second for load-bearing changes.\n\n  - name: preflight-before-investigation\n    description: Block investigative git reads (status/log/diff/branch) when agent-preflight has not run recently with ready:true for the current repo.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    requires:\n      ledger_tag: \"preflight:${REPO}\"\n      within: 1h\n    hook: require-preflight-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${REPO} to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${REPO}\", source:\"manual\"}'\n        description: Direct ledger write. Use when the Bash hook is locked down (e.g. understanding-gate active) or when the standard producer is unavailable.\n    ux:\n      cannot: \"You cannot investigate this repository yet.\"\n      required:\n        - \"verified repository preflight\"\n      run:\n        - \"harness preflight\"\n\n  - name: review-subagent-before-pr-create\n    description: Block agent-tasks PR creation unless a review-subagent ledger entry tagged for this task already exists. Forces the rigorous review BEFORE the PR opens, not after.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_create\"\n      extract:\n        TASK_ID: \"toolArgs.taskId\"\n    requires:\n      ledger_tag: \"review-subagent:${TASK_ID}\"\n    hook: require-review-subagent-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff, persist its verdict + load-bearing findings as a ledger entry tagged with the task UUID. The content should be self-contained enough to audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot open a pull request for task ${TASK_ID} yet.\"\n      required:\n        - \"a completed review-subagent pass on this task\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-subagent-before-pr-create. Tag shape is\n  # `review-subagent:${BRANCH}` because TASK_ID is an agent-tasks-only\n  # concept; for the gh-cli workflow the working branch is the closest stable\n  # handle for \"the PR-in-progress\" at this point. Same rationale as\n  # review-before-merge-bash: sits alongside the MCP variant, not as a\n  # replacement.\n  - name: review-subagent-before-pr-create-bash\n    description: Block `gh pr create` unless a review-subagent ledger entry tagged review-subagent:<branch> exists for this session. Forces the rigorous review BEFORE the PR opens.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    requires:\n      ledger_tag: \"review-subagent:${BRANCH}\"\n    hook: require-review-subagent-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff for the working branch, persist its verdict + load-bearing findings as a ledger entry tagged with the branch name. Mirror of the review-subagent-before-pr-create producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot open a pull request for branch ${BRANCH} via `gh pr create` yet.\"\n      required:\n        - \"a completed review-subagent pass on branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: preflight-before-push\n    description: Block git push unless a fresh preflight ledger entry exists for the current branch. Catches the stale-checkout class of incident at the last reversible step.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    requires:\n      ledger_tag: \"preflight:${BRANCH}\"\n      within: 10m\n      # at_head:true lets a preflight at the current HEAD satisfy the\n      # gate at any age (the standard producer writes head:<sha> into\n      # the tag content). The 10m window remains the freshness ceiling\n      # for the head-mismatch case (operator switched branch, preflight\n      # predates HEAD shift, runtime couldn't resolve a sha).\n      at_head: true\n    hook: require-preflight-push-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${BRANCH} ready:true confidence:<n> head:<sha> to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${BRANCH} head:<full-sha> \u2014 <summary of what is on the branch + smoke results>\", source:\"manual\"}'\n        description: Direct ledger write. Include head:<full-sha> if you want the entry to count under at_head; the branch is the WIP review surface and the content should summarise what is staged + the smoke evidence so a reviewer can audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot push branch ${BRANCH} yet.\"\n      required:\n        - \"a preflight for ${BRANCH} at the current HEAD (any age) OR any preflight within the last 10 minutes. Re-run `harness preflight` if you committed since the last preflight AND it has been more than 10 minutes.\"\n      run:\n        - \"harness preflight\"\n\n  # Phase 7 Risk Gate \u2014 the canonical built-in worked example. These two\n  # policies, with the dangerous-shell classifier and production-signals\n  # resolver below, are the Risk Gate's default stance: a destructive\n  # shell action whose target environment resolves to production is\n  # gated before the runtime fires it. Both fire ONLY when the\n  # environment resolves to production (a main / release branch, a\n  # prod-looking DATABASE_URL, or a prod kube context); on an ordinary\n  # feature branch the environment is unknown and neither fires. Ordered\n  # deny-first so a critical action (which also matches the high\n  # threshold) gets the hard-deny envelope. See docs/risk-gate.md.\n  - name: gate-prod-destructive\n    description: Deny critical-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: critical\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-override:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: block\n    ux:\n      cannot: \"You cannot run this critical destructive action against production.\"\n      required:\n        - \"a deliberate operator override: a critical production mutation has no benign reading\"\n      run:\n        - \"Choose a non-destructive alternative, or run the command yourself outside the agent.\"\n        - \"Operator override (deliberate): record a risk-override:${SESSION_ID} entry in the evidence ledger.\"\n  - name: gate-prod-destructive-approval\n    description: Require operator approval for high-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: high\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-approved:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: require_approval\n    ux:\n      cannot: \"You cannot run this destructive production action yet.\"\n      required:\n        - \"operator approval of this Risk Gate decision\"\n      run:\n        - \"harness approve risk\"\n\n# Full inherits the Solo/Team understanding-gate stack: the Stop hook\n# persists each Understanding Report and the PreToolUse pre-tool-use\n# blocker refuses Edit/Write/Bash until the report is approved. Drop\n# this block if you want the reference policies above without the\n# baseline gate.\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # Producers (agent-tasks/25bced52): rendered into the gate's deny\n      # envelope by the same engine as policy producers. Constraint at\n      # this layer: at-least-one `ask`. Post-v0.14.0 the gate signal\n      # is a filesystem marker and the mcp ledger_add path no longer\n      # satisfies the gate; the canonical unblock surface is the\n      # operator-approval prompt.\n      producers:\n        - kind: ask\n          command: harness approve understanding\n          description: \"Bare command, no pipes or chaining. The hook recognises it via isEscapeCommand and emits permissionDecision:ask; the operator's go on that prompt IS the gate approval. Golden path.\"\n        - kind: bash\n          command: harness approve understanding\n          description: Same command from any un-hooked terminal (operator only, not reachable from inside the gated session). Writes the canonical marker at harness.generated/.approvals/${SESSION_ID}.\n      # ux (agent-tasks/e48e3b45): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details (the BLOCK reason naming session id /\n      # marker / report state) still land in stderr for operator audit;\n      # the agent only sees this.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan\"\n          - \"Run `harness approve understanding` and approve the prompt\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries so a multi-task session re-prompts for an\n      # Understanding Report between tasks. Without this the legacy\n      # \"one approval per session\" contract lets a stale interpretation\n      # drive the next task's edits.\n      #\n      # Full ships both boundary kinds: the agent-tasks MCP verbs for\n      # operators on that workflow, plus a Bash regex list for hybrid\n      # operators who also use gh-cli for PR mechanics. `max_age` is\n      # the safety net. Operators who prefer the legacy per-session\n      # behaviour opt out with `approval_lifecycle: { mode: session }`.\n      # Operators on other task systems override the matchers.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n\n  # branch-protection (agent-tasks/2fdc5bbe, default-enabled since v0.17.2):\n  # blocks Write/Edit (claude-code) or apply_patch (codex) on protected\n  # branches (default: master, main, develop). Complements\n  # preflight-before-push, which fires at the LAST reversible step;\n  # branch-protection fires at the FIRST source mutation, catching the\n  # \"forgot to branch off master\" pattern earlier in the cycle.\n  #\n  # Two satisfying signals: a fresh `branch:non-protected:<branch>` tag\n  # from the SessionStart producer (`harness session-start branch-check`),\n  # or a `branch-protection-ack:<reason>` override the operator writes\n  # via mcp__agent-grounding__ledger_add for deliberate protected-branch\n  # edits (version bumps, CI workflow patches, hotfixes).\n  #\n  # Fails closed (any load / parse / ledger error refuses). Disable by\n  # setting `enabled: false` or removing this entry if your workflow\n  # routinely edits master directly. Override the protected list via\n  # `config.protected_branches`. Full reference:\n  # docs/policy-packs/branch-protection.md.\n  - name: branch-protection\n    source: builtin\n    enabled: true\n    description: Block Write/Edit on protected branches (master, main, develop) at the first source mutation.\n    config:\n      # ux (agent-tasks/9806d4f8): replaces the legacy\n      # \"branch-protection: refusing ...\" envelope with the\n      # plain-language { cannot, required, run } shape. Engine details\n      # (the BLOCK reason naming session id / freshness window) stay\n      # on stderr for operator audit.\n      ux:\n        cannot: \"You cannot edit files on protected branch ${BRANCH} yet.\"\n        required:\n          - \"a checkout of a non-protected branch (current `${BRANCH}` is protected)\"\n        run:\n          - \"git checkout -b feat/<your-task>\"\n          - \"harness session-start branch-check\"\n\n# Phase 7 Risk Gate vocabulary. The dangerous-shell classifier and\n# production-signals resolver feed the gate-prod-destructive policies\n# above: `harness policy intercept` builds the Action Envelope,\n# classifies the action against `risk.classifiers[]`, resolves the\n# target environment against `environments.resolvers[]`, and evaluates\n# each policy's `when:` clauses against the result. Full design and the\n# decision model: docs/risk-gate.md.\nrisk:\n  classifiers:\n    - name: dangerous-shell\n      tool: Bash\n      patterns:\n        - pattern: 'rm\\s+-rf\\s+(/|/var|/data|/mnt|~)'\n          categories: [destructive, data_loss]\n          severity: critical\n        - pattern: 'DROP\\s+TABLE|TRUNCATE\\s+TABLE|DELETE\\s+FROM'\n          categories: [destructive, data_loss]\n          severity: high\n        - pattern: 'kubectl\\s+delete\\s+(namespace|deployment|statefulset|pvc)'\n          categories: [destructive, infrastructure_change]\n          severity: high\n        - pattern: 'terraform\\s+destroy'\n          categories: [destructive, infrastructure_change]\n          severity: critical\n\nenvironments:\n  resolvers:\n    - name: production-signals\n      environment: production\n      signals:\n        branch_patterns: [main, \"release/*\"]\n        env_var_patterns:\n          - var: DATABASE_URL\n            patterns: [prod, production]\n        kube_context_patterns: [\".*prod.*\"]\n        kube_namespace_patterns: [prod, production]\n";
+export declare const FULL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template full`. The reference manifest:\n# every example policy from docs/examples/full-manifest.yaml wired through\n# the generic `harness policy intercept` engine, so no external shell\n# scripts under ~/.claude/hooks/ are required.\n#\n# Canonical source for the policy + policy_packs sections is\n# docs/examples/full-manifest.yaml. A parity vitest\n# (tests/cli/init-full-template-parity.test.ts) fails the build if the\n# two diverge on policy names or load-bearing fields.\n#\n# What you still need on PATH (the wizard offers to `npm i -g` these on\n# init): agent-tasks-mcp-bridge, grounding-mcp, memory-router-*,\n# understanding-gate-claude-*.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n  policies_source: ~/.claude/harness.d/policies/claim-gate.yaml\n\ntools:\n  mcp:\n    # codebase-oracle (the Pandora RAG MCP server) is intentionally NOT\n    # in the Full default. It is published as\n    # `@lannguyensi/codebase-oracle` and works fine standalone, but it\n    # is an opinionated workflow add-on (multi-repo semantic search)\n    # rather than infrastructure harness itself assumes. Operators who\n    # want it wire it explicitly:\n    #   npm i -g @lannguyensi/codebase-oracle\n    #   harness add mcp codebase-oracle --command codebase-oracle,mcp\n    # Set ORACLE_SCAN_ROOT (absolute path; tilde is not expanded by the\n    # MCP env block) and OPENAI_API_KEY (or switch providers via\n    # ORACLE_LLM_PROVIDER) before the first call.\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH. The bridge owns token\n      # storage and defaults to the hosted backend; override with\n      # `AGENT_TASKS_BASE_URL` / `AGENT_TASKS_TOKEN` for self-hosted.\n      # `min_version` floor: 0.6.0 added the `--version` short-circuit\n      # the doctor probe needs (PR agent-tasks/240, release-cut PR 241).\n      # Bump the floor whenever a fix you depend on lands; loose floors\n      # are fine, the point is the drift signal not pinning a specific cut.\n      command: [agent-tasks-mcp-bridge]\n      min_version: \"0.6.0\"\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # Published bin from `@lannguyensi/grounding-mcp`. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident). `min_version` floor: 0.2.0\n      # added the `--version` short-circuit the doctor probe needs (PR\n      # agent-grounding/76, release-cut PR 77).\n      command: [grounding-mcp]\n      min_version: \"0.2.0\"\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n\n  cli:\n    - name: gh\n      binary: gh\n      required: true\n\n  skills:\n    enabled:\n      - simplify\n      - init\n      - review\n      - security-review\n    source_dirs:\n      - ~/.claude/skills\n\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # Published bin from `@lannguyensi/memory-router`.\n    # `min_version` floor: 0.3.0 added the `--version` short-circuit\n    # the doctor probe needs (PR agent-memory/40, release-cut PR 41).\n    command: [memory-router-user-prompt-submit]\n    min_version: \"0.3.0\"\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\n# All PreToolUse hooks share the generic `harness policy intercept` CLI\n# entrypoint. The engine reads the tool event on stdin, evaluates whichever\n# policy below has a matching trigger (`match` + optional `bash_match`),\n# and emits Claude Code's deny envelope when the required ledger tag is\n# absent. No external shell scripts are required.\n#\n# The `git-preflight` SessionStart hook is the producer side of the\n# `preflight-before-*` policies: `harness session-start preflight` runs\n# agent-preflight against the session cwd and, on a ready:true result,\n# records `preflight:${REPO}` to the evidence ledger. It needs the\n# `preflight` binary on PATH (`npm i -g @lannguyensi/agent-preflight`); when\n# that is absent the hook logs to stderr and exits 0, so the session is\n# never broken \u2014 the preflight gates just stay closed until a tag is\n# produced some other way.\nhooks:\n  - name: git-preflight\n    event: SessionStart\n    command: harness session-start preflight\n    blocking: false\n    # 70s budget gives the wrapped preflight (default 60s) headroom plus\n    # ledger-write time. Was 30s through v0.17.4, but a healthy preflight\n    # on a medium-size repo takes ~28s and the old 25s wrapper ceiling\n    # blew through it. Bumped together with DEFAULT_PREFLIGHT_TIMEOUT_MS\n    # (agent-tasks/7265599e).\n    budget_ms: 70000\n    # Floor at agent-preflight 0.2.0, the release that makes secret\n    # detection git-aware and diff-scoped: a gitignored+untracked .env,\n    # a .md doc, a non-git dir, or a secret in a tracked file the branch\n    # never touched is a non-blocking warn, not a hard fail. Pre-0.2.0\n    # installs hard-fail preflight on the normal correct state (a\n    # gitignored .env holding real credentials), so this SessionStart\n    # producer never writes a preflight: tag and the preflight-before-*\n    # policies stay closed forever on any repo with a local .env. (0.1.1\n    # had already fixed the wrapper-script \"tool not installed\" false\n    # positive.) version_command points at the source-of-truth preflight\n    # binary, not at the `harness session-start preflight` wrapper.\n    min_version: \"0.2.0\"\n    version_command: [\"preflight\", \"--version\"]\n\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Tool-agnostic parallel of require-review-evidence for operators on the\n  # gh-cli workflow (`gh pr merge`) instead of agent-tasks MCP. Same generic\n  # `harness policy intercept` entrypoint; the matching review-before-merge-bash\n  # policy below picks up the trigger. A PolicyTrigger can only AND-match one\n  # surface (MCP tool-name OR Bash command), so two parallel definitions are\n  # the minimum-scope way to cover both PR surfaces without bumping the schema.\n  - name: require-review-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-dogfood-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  - name: require-review-subagent-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_create\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Bash-surface parallel of require-review-subagent-evidence for operators\n  # who open PRs with `gh pr create` instead of agent-tasks MCP. The matching\n  # review-subagent-before-pr-create-bash policy below tags by branch\n  # (`review-subagent:${BRANCH}`) because no task UUID is in `gh pr create`\n  # arguments; the working branch is the closest stable handle for \"the\n  # PR-in-progress\" at this point in the cycle.\n  - name: require-review-subagent-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-push-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # risk-gate (Phase 7 #6): the Risk Gate enforcement hook. The\n  # gate-prod-destructive policies below reference it. Same generic\n  # `harness policy intercept` entrypoint as every other policy hook;\n  # the interceptor builds the Action Envelope, classifies risk against\n  # `risk.classifiers[]`, resolves the environment against\n  # `environments.resolvers[]`, and evaluates the policies' `when:`.\n  - name: risk-gate\n    event: PreToolUse\n    match: \"Bash\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number. The content should be self-contained enough for an auditor to read without re-opening the chat.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-before-merge for operators on the gh-cli\n  # workflow. Two scope notes:\n  #   1. Tag shape: `review:${BRANCH}` instead of `review:${PR_NUMBER}`. The\n  #      `gh pr merge` invocation can target the PR by number, by URL, or by\n  #      the current branch (default), and PR_NUMBER is not extractable from\n  #      `tool_input.command` with today's JSONPath-only extract DSL. BRANCH\n  #      is the stable identifier the producer can record at review time.\n  #   2. This sits ALONGSIDE review-before-merge \u2014 not as a replacement. An\n  #      operator using both surfaces (e.g. agent-tasks MCP for most repos\n  #      + gh-cli for a quick hotfix) will have both gates active, each with\n  #      its own tag shape, which is semantically honest.\n  - name: review-before-merge-bash\n    description: Block `gh pr merge` unless a ledger entry tagged review:<branch> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    requires:\n      ledger_tag: \"review:${BRANCH}\"\n    hook: require-review-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the branch diff, capture its verdict, then persist a ledger entry tagged with the branch name. Mirror of the review-before-merge producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot merge the PR for branch ${BRANCH} via `gh pr merge` yet.\"\n      required:\n        - \"a recorded review of the PR for branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: dogfood-before-release\n    description: Block npm publish / git tag v* without a recent dogfood ledger entry.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    requires:\n      ledger_tag: \"dogfood:${SESSION_ID}\"\n      within: 24h\n    hook: require-dogfood-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary against the live system>\", source:\"manual smoke test\"}'\n        description: Before tagging or publishing, run the release path end-to-end against the live system (not just unit tests) and persist the result as a session-tagged ledger entry. Document what you exercised (install, CLI happy path, MCP handshake, etc.) so a future auditor can tell whether the smoke covered the change.\n    ux:\n      cannot: \"You cannot publish a release yet.\"\n      required:\n        - \"an end-to-end dogfood run in this session\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary>\" }'\n\n  - name: two-reviewers-required\n    description: At least two distinct reviewer ledger entries must exist for the PR.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n      count:\n        min: 2\n    hook: require-review-evidence\n    enforcement: warn\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review (reviewer 2)\"}'\n        description: Same shape as review-before-merge but TWO DISTINCT reviewer entries must exist before the gate is satisfied (count.min 2). Distinguish reviewers by source so the count is honest. Warn-level enforcement, so the agent CAN merge with one reviewer but should consider spawning a second for load-bearing changes.\n\n  - name: preflight-before-investigation\n    description: Block investigative git reads (status/log/diff/branch) when agent-preflight has not run recently with ready:true for the current repo.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    requires:\n      ledger_tag: \"preflight:${REPO}\"\n      within: 1h\n    hook: require-preflight-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${REPO} to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${REPO}\", source:\"manual\"}'\n        description: Direct ledger write. Use when the Bash hook is locked down (e.g. understanding-gate active) or when the standard producer is unavailable.\n    ux:\n      cannot: \"You cannot investigate this repository yet.\"\n      required:\n        - \"verified repository preflight\"\n      run:\n        - \"harness preflight\"\n\n  - name: review-subagent-before-pr-create\n    description: Block agent-tasks PR creation unless a review-subagent ledger entry tagged for this task already exists. Forces the rigorous review BEFORE the PR opens, not after.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_create\"\n      extract:\n        TASK_ID: \"toolArgs.taskId\"\n    requires:\n      ledger_tag: \"review-subagent:${TASK_ID}\"\n    hook: require-review-subagent-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff, persist its verdict + load-bearing findings as a ledger entry tagged with the task UUID. The content should be self-contained enough to audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot open a pull request for task ${TASK_ID} yet.\"\n      required:\n        - \"a completed review-subagent pass on this task\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-subagent-before-pr-create. Tag shape is\n  # `review-subagent:${BRANCH}` because TASK_ID is an agent-tasks-only\n  # concept; for the gh-cli workflow the working branch is the closest stable\n  # handle for \"the PR-in-progress\" at this point. Same rationale as\n  # review-before-merge-bash: sits alongside the MCP variant, not as a\n  # replacement.\n  - name: review-subagent-before-pr-create-bash\n    description: Block `gh pr create` unless a review-subagent ledger entry tagged review-subagent:<branch> exists for this session. Forces the rigorous review BEFORE the PR opens.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    requires:\n      ledger_tag: \"review-subagent:${BRANCH}\"\n    hook: require-review-subagent-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff for the working branch, persist its verdict + load-bearing findings as a ledger entry tagged with the branch name. Mirror of the review-subagent-before-pr-create producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot open a pull request for branch ${BRANCH} via `gh pr create` yet.\"\n      required:\n        - \"a completed review-subagent pass on branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: preflight-before-push\n    description: Block git push unless a fresh preflight ledger entry exists for the current branch. Catches the stale-checkout class of incident at the last reversible step.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    requires:\n      ledger_tag: \"preflight:${BRANCH}\"\n      within: 10m\n      # at_head:true lets a preflight at the current HEAD satisfy the\n      # gate at any age (the standard producer writes head:<sha> into\n      # the tag content). The 10m window remains the freshness ceiling\n      # for the head-mismatch case (operator switched branch, preflight\n      # predates HEAD shift, runtime couldn't resolve a sha).\n      at_head: true\n    hook: require-preflight-push-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${BRANCH} ready:true confidence:<n> head:<sha> to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${BRANCH} head:<full-sha> \u2014 <summary of what is on the branch + smoke results>\", source:\"manual\"}'\n        description: Direct ledger write. Include head:<full-sha> if you want the entry to count under at_head; the branch is the WIP review surface and the content should summarise what is staged + the smoke evidence so a reviewer can audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot push branch ${BRANCH} yet.\"\n      required:\n        - \"a preflight for ${BRANCH} at the current HEAD (any age) OR any preflight within the last 10 minutes. Re-run `harness preflight` if you committed since the last preflight AND it has been more than 10 minutes.\"\n      run:\n        - \"harness preflight\"\n\n  # Phase 7 Risk Gate \u2014 the canonical built-in worked example. These two\n  # policies, with the dangerous-shell classifier and production-signals\n  # resolver below, are the Risk Gate's default stance: a destructive\n  # shell action whose target environment resolves to production is\n  # gated before the runtime fires it. Both fire ONLY when the\n  # environment resolves to production (a main / release branch, a\n  # prod-looking DATABASE_URL, or a prod kube context); on an ordinary\n  # feature branch the environment is unknown and neither fires. Ordered\n  # deny-first so a critical action (which also matches the high\n  # threshold) gets the hard-deny envelope. See docs/risk-gate.md.\n  - name: gate-prod-destructive\n    description: Deny critical-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: critical\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-override:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: block\n    ux:\n      cannot: \"You cannot run this critical destructive action against production.\"\n      required:\n        - \"a deliberate operator override: a critical production mutation has no benign reading\"\n      run:\n        - \"Choose a non-destructive alternative, or run the command yourself outside the agent.\"\n        - \"Operator override (deliberate): record a risk-override:${SESSION_ID} entry in the evidence ledger.\"\n  - name: gate-prod-destructive-approval\n    description: Require operator approval for high-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: high\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-approved:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: require_approval\n    ux:\n      cannot: \"You cannot run this destructive production action yet.\"\n      required:\n        - \"operator approval of this Risk Gate decision\"\n      run:\n        - \"harness approve risk\"\n\n# Full inherits the Solo/Team understanding-gate stack: the Stop hook\n# persists each Understanding Report and the PreToolUse pre-tool-use\n# blocker refuses Edit/Write/Bash until the report is approved. Drop\n# this block if you want the reference policies above without the\n# baseline gate.\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # Producers (agent-tasks/25bced52): rendered into the gate's deny\n      # envelope by the same engine as policy producers. Constraint at\n      # this layer: at-least-one `ask`. Post-v0.14.0 the gate signal\n      # is a filesystem marker and the mcp ledger_add path no longer\n      # satisfies the gate; the canonical unblock surface is the\n      # operator-approval prompt.\n      producers:\n        - kind: ask\n          command: harness approve understanding\n          description: \"Bare command, no pipes or chaining. The hook recognises it via isEscapeCommand and emits permissionDecision:ask; the operator's go on that prompt IS the gate approval. Golden path.\"\n        - kind: bash\n          command: harness approve understanding\n          description: Same command from any un-hooked terminal (operator only, not reachable from inside the gated session). Writes the canonical marker at harness.generated/.approvals/${SESSION_ID}.\n      # ux (agent-tasks/e48e3b45): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details (the BLOCK reason naming session id /\n      # marker / report state) still land in stderr for operator audit;\n      # the agent only sees this.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` and approve the prompt\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries so a multi-task session re-prompts for an\n      # Understanding Report between tasks. Without this the legacy\n      # \"one approval per session\" contract lets a stale interpretation\n      # drive the next task's edits.\n      #\n      # Full ships both boundary kinds: the agent-tasks MCP verbs for\n      # operators on that workflow, plus a Bash regex list for hybrid\n      # operators who also use gh-cli for PR mechanics. `max_age` is\n      # the safety net. Operators who prefer the legacy per-session\n      # behaviour opt out with `approval_lifecycle: { mode: session }`.\n      # Operators on other task systems override the matchers.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n\n  # branch-protection (agent-tasks/2fdc5bbe, default-enabled since v0.17.2):\n  # blocks Write/Edit (claude-code) or apply_patch (codex) on protected\n  # branches (default: master, main, develop). Complements\n  # preflight-before-push, which fires at the LAST reversible step;\n  # branch-protection fires at the FIRST source mutation, catching the\n  # \"forgot to branch off master\" pattern earlier in the cycle.\n  #\n  # Two satisfying signals: a fresh `branch:non-protected:<branch>` tag\n  # from the SessionStart producer (`harness session-start branch-check`),\n  # or a `branch-protection-ack:<reason>` override the operator writes\n  # via mcp__agent-grounding__ledger_add for deliberate protected-branch\n  # edits (version bumps, CI workflow patches, hotfixes).\n  #\n  # Fails closed (any load / parse / ledger error refuses). Disable by\n  # setting `enabled: false` or removing this entry if your workflow\n  # routinely edits master directly. Override the protected list via\n  # `config.protected_branches`. Full reference:\n  # docs/policy-packs/branch-protection.md.\n  - name: branch-protection\n    source: builtin\n    enabled: true\n    description: Block Write/Edit on protected branches (master, main, develop) at the first source mutation.\n    config:\n      # ux (agent-tasks/9806d4f8): replaces the legacy\n      # \"branch-protection: refusing ...\" envelope with the\n      # plain-language { cannot, required, run } shape. Engine details\n      # (the BLOCK reason naming session id / freshness window) stay\n      # on stderr for operator audit.\n      ux:\n        cannot: \"You cannot edit files on protected branch ${BRANCH} yet.\"\n        required:\n          - \"a checkout of a non-protected branch (current `${BRANCH}` is protected)\"\n        run:\n          - \"git checkout -b feat/<your-task>\"\n          - \"harness session-start branch-check\"\n\n# Phase 7 Risk Gate vocabulary. The dangerous-shell classifier and\n# production-signals resolver feed the gate-prod-destructive policies\n# above: `harness policy intercept` builds the Action Envelope,\n# classifies the action against `risk.classifiers[]`, resolves the\n# target environment against `environments.resolvers[]`, and evaluates\n# each policy's `when:` clauses against the result. Full design and the\n# decision model: docs/risk-gate.md.\nrisk:\n  classifiers:\n    - name: dangerous-shell\n      tool: Bash\n      patterns:\n        - pattern: 'rm\\s+-rf\\s+(/|/var|/data|/mnt|~)'\n          categories: [destructive, data_loss]\n          severity: critical\n        - pattern: 'DROP\\s+TABLE|TRUNCATE\\s+TABLE|DELETE\\s+FROM'\n          categories: [destructive, data_loss]\n          severity: high\n        - pattern: 'kubectl\\s+delete\\s+(namespace|deployment|statefulset|pvc)'\n          categories: [destructive, infrastructure_change]\n          severity: high\n        - pattern: 'terraform\\s+destroy'\n          categories: [destructive, infrastructure_change]\n          severity: critical\n\nenvironments:\n  resolvers:\n    - name: production-signals\n      environment: production\n      signals:\n        branch_patterns: [main, \"release/*\"]\n        env_var_patterns:\n          - var: DATABASE_URL\n            patterns: [prod, production]\n        kube_context_patterns: [\".*prod.*\"]\n        kube_namespace_patterns: [prod, production]\n";
 export type TemplateName = "minimal" | "full" | "solo" | "team";
 export declare function getTemplate(name: TemplateName): string;

package/dist/cli/init/templates.js

@@ -534,7 +534,7 @@ policy_packs:
         required:
           - "an approved Understanding Report for this session"
         run:
-          - "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan"
+          - "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)"
           - "Run \`harness approve understanding\` and approve the prompt"
       # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,
       # v0.18.0+): expire the approval marker on task-completion

package/dist/cli/pack/hook-codex-pre-tool-use.js

@@ -105,14 +105,17 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     const stderr = opts.stderr ?? process.stderr;
     const packName = opts.pack ?? PACK_NAME;
     // Read stdin defensively. Bad JSON falls through to allow (matches
-    // Claude blocker's failure mode).
+    // Claude blocker's failure mode) but emits a stderr diagnostic so
+    // the degradation is loud — a silently-allowing gate manufactures
+    // false confidence, which is the worst direction for a governance
+    // hook to fail in.
     const raw = await readStdin(stdin);
     let event = {};
     try {
         event = JSON.parse(raw.trim() || "{}");
     }
-    catch {
-        /* allow on malformed input */
+    catch (err) {
+        stderr.write(`harness pack hook (codex): malformed event JSON on stdin (${err.message}), allowing.\n`);
     }
     const sessionId = pickString(event.session_id) ??
         process.env["CODEX_SESSION_ID"] ??

package/dist/cli/pack/hook-codex-pre-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,4BAA4B;AAC5B,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAgD,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AAyCrB,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,+CAA+C,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,UAAqB;IAC1C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,oBAAoB;YAC/B,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,6EAA6E,EAC7E,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,oEAAoE;IACpE,2DAA2D;IAC3D,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACnF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,CACP,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,4BAA4B;AAC5B,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAgD,MAAM,uBAAuB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AAyCrB,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,+CAA+C,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAG,UAAqB;IAC1C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6DACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,oBAAoB;YAC/B,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,6EAA6E,EAC7E,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,oEAAoE;IACpE,2DAA2D;IAC3D,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACnF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,CACP,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.js

@@ -24,6 +24,7 @@ import { queryLedgerByTag, } from "../../policies/index.js";
 import { renderProducers } from "../../policies/producers.js";
 import { checkActiveClaimApprovalMarker, checkApprovalMarker, checkPersistedReport, defaultReportsDir, matchLedgerEntries, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir, writePendingApproval, } from "../../runtime/pending-approval.js";
+import { isReadOnlyBashCommand } from "./read-only-bash.js";
 import { PolicyUxSchema, ProducerSchema, } from "../../schema/index.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
 import { z } from "zod";
@@ -199,14 +200,17 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     const stderr = opts.stderr ?? process.stderr;
     const packName = opts.pack ?? PACK_NAME;
     // Read stdin defensively. Bad JSON falls through to allow (matches
-    // policy intercept's failure mode).
+    // policy intercept's failure mode) but emits a stderr diagnostic so
+    // the degradation is loud — a silently-allowing gate manufactures
+    // false confidence, which is the worst direction for a governance
+    // hook to fail in.
     const raw = await readStdin(stdin);
     let event = {};
     try {
         event = JSON.parse(raw.trim() || "{}");
     }
-    catch {
-        /* allow on malformed input */
+    catch (err) {
+        stderr.write(`harness pack hook: malformed event JSON on stdin (${err.message}), allowing.\n`);
     }
     const sessionId = (typeof event.session_id === "string" ? event.session_id : undefined) ??
         process.env.CLAUDE_SESSION_ID ??
@@ -397,6 +401,26 @@ export async function runPackHookPreToolUseCli(opts = {}) {
             /* best-effort; the ask / block below proceeds regardless */
         }
     }
+    // Exception: read-only Bash commands. The pack hook matcher
+    // necessarily covers `Bash` as a whole, but commands like
+    // `git status`, `gh pr view`, `ls`, `cat` mutate nothing. Blocking
+    // them behind a full Understanding Report cycle trains the agent
+    // and operator to experience the gate as noise, which erodes its
+    // credibility on the writes that actually matter. Pass the
+    // classifier on Bash commands only; Edit and Write stay
+    // hard-blocked regardless (the matcher's other arms reach the
+    // same final block path below). Unclassifiable Bash falls through
+    // to the block (fail-closed).
+    if (toolName === "Bash" && isReadOnlyBashCommand(commandStr)) {
+        const diagnostic = `harness pack hook: read-only Bash command, allowing without an approved report (\`${commandStr.trim()}\`)`;
+        stderr.write(`${diagnostic}\n`);
+        return {
+            exitCode: 0,
+            blocked: false,
+            approvalCheck: { approved: true, source: "none", detail: diagnostic },
+            diagnostic,
+        };
+    }
     // Exception: the operator-approval command itself. Hard-denying
     // `harness approve understanding` is a catch-22: it is the very command
     // that records the operator's go, and a Bash `deny` gives no prompt to

package/dist/cli/pack/hook-pre-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-pre-tool-use.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,yDAAyD;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,cAAc,EACd,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAoDnD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,6DAA6D;AAC7D,8BAA8B;AAC9B,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,KAAK,CAAC,cAAc,CAAC;KACrB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAC1C,8GAA8G,CAC/G,CAAC;AAEJ,SAAS,oBAAoB,CAC3B,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,CAAC,KAAK,CAAC,MAAM;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,gEAAgE;AAChE,mEAAmE;AACnE,uEAAuE;AACvE,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,yCAAyC,MAAM,CAAC,KAAK,CAAC,MAAM;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,SAAiC,EACjC,EAAwB,EACxB,SAAiB;IAEjB,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,sBAAsB;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,qGAAqG,CAAC;QACrH,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,UAAU,GAAG,uBAAuB,MAAM,WAAW,QAAQ,KAAK,MAAM,KAAK,UAAU,GAAG,cAAc,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kBAAkB;AAClB,SAAS,OAAO;IACd,MAAM,MAAM,GACV,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B,CAAC;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAA+B;IAE/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACtD,CAAC,CAAE,KAAK,CAAC,UAAoC,CAAC,OAAO;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,cAAc;YACzB,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrD,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,2DAA2D,CAAC;YAC/E,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;gBACrE,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,4CAChB,GAAa,CAAC,OACjB,cAAc,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,4BAA4B,QAAQ,uCAAuC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,4BAA4B,QAAQ,+BAA+B,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,yFAAyF,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,6BAA6B;IAC7B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,+DAA+D;QAC/D,wBAAwB;QACxB,MAAM,UAAU,GAAG,8BAA8B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,sBAAsB,UAAU,CAAC,MAAM,aAAa,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;gBAC9E,UAAU;aACX,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,yCAAyC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7E,wDAAwD;QACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC1E,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACpF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,oCAAoC;IACpC,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACnF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5F,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,QAAQ,KAAK,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,mGAAmG,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAClE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,MAAM,EAAE,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACzC,QAAQ,CAAC,MAAkC,CAAC,WAAW,CAAC,EACzD,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,mDAAmD,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CACtH,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-pre-tool-use.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,yDAAyD;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,cAAc,EACd,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAoDnD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,6DAA6D;AAC7D,8BAA8B;AAC9B,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,KAAK,CAAC,cAAc,CAAC;KACrB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAC1C,8GAA8G,CAC/G,CAAC;AAEJ,SAAS,oBAAoB,CAC3B,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,CAAC,KAAK,CAAC,MAAM;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,gEAAgE;AAChE,mEAAmE;AACnE,uEAAuE;AACvE,SAAS,aAAa,CACpB,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,yCAAyC,MAAM,CAAC,KAAK,CAAC,MAAM;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,SAAiC,EACjC,EAAwB,EACxB,SAAiB;IAEjB,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,sBAAsB;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,qGAAqG,CAAC;QACrH,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,UAAU,GAAG,uBAAuB,MAAM,WAAW,QAAQ,KAAK,MAAM,KAAK,UAAU,GAAG,cAAc,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kBAAkB;AAClB,SAAS,OAAO;IACd,MAAM,MAAM,GACV,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B,CAAC;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAA+B;IAE/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,qDACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACtD,CAAC,CAAE,KAAK,CAAC,UAAoC,CAAC,OAAO;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,cAAc;YACzB,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrD,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,2DAA2D,CAAC;YAC/E,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;gBACrE,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,4CAChB,GAAa,CAAC,OACjB,cAAc,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,4BAA4B,QAAQ,uCAAuC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,4BAA4B,QAAQ,+BAA+B,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,yFAAyF,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,6BAA6B;IAC7B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,+DAA+D;QAC/D,wBAAwB;QACxB,MAAM,UAAU,GAAG,8BAA8B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,sBAAsB,UAAU,CAAC,MAAM,aAAa,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;gBAC9E,UAAU;aACX,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,yCAAyC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7E,wDAAwD;QACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC1E,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACpF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,oCAAoC;IACpC,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACnF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5F,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,0DAA0D;IAC1D,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,2DAA2D;IAC3D,wDAAwD;IACxD,8DAA8D;IAC9D,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,QAAQ,KAAK,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,qFAAqF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/H,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,QAAQ,KAAK,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,mGAAmG,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAClE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,MAAM,EAAE,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACzC,QAAQ,CAAC,MAAkC,CAAC,WAAW,CAAC,EACzD,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,mDAAmD,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CACtH,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/read-only-bash.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Classify a Bash command string. `true` means the command is
+ * provably read-only and the understanding-gate can allow it without
+ * an approved report. `false` means the command is either a write or
+ * unclassifiable; the gate must block (fail-closed).
+ *
+ * The classifier inspects the command as a raw shell string. It does
+ * NOT shell-parse or evaluate the command — that would introduce its
+ * own attack surface. Instead it rejects any string that contains
+ * shell metacharacters that could hide a write, then looks at the
+ * first one or two tokens.
+ */
+export declare function isReadOnlyBashCommand(command: string): boolean;

package/dist/cli/pack/read-only-bash.js

@@ -0,0 +1,177 @@
+// Read-only Bash command classifier for the understanding-gate
+// PreToolUse blocker.
+//
+// The pack's hook matcher `Edit|Write|Bash` is too broad on its own:
+// `Bash` covers commands like `git status`, `gh pr view`, `ls`, `cat`
+// that mutate nothing. Hard-blocking them behind a full Understanding
+// Report cycle trains the agent and operator to experience the gate
+// as noise, which erodes its credibility on the writes that actually
+// matter. A gate scoped exactly to what it must stop is a credible
+// gate.
+//
+// Design contract:
+// - The allowlist is intentionally conservative. Anything not on it
+//   is treated as a write (block). Better to occasionally annoy a
+//   read-only command we haven't enumerated than to let a write slip.
+// - Any shell chaining (`;`, `&&`, `||`, `|`), redirection (`>`,
+//   `>>`, `<`), or command substitution (backticks, `$()`) makes the
+//   whole composition unclassifiable. Even if every individual piece
+//   would be read-only, a chained or substituted command can hide
+//   writes inside its construction. Refuse the whole thing.
+// - The classifier never short-circuits write detection: if a command
+//   is on the allowlist but a write indicator is also present, the
+//   write indicator wins. The shell-metachar check above accomplishes
+//   this without a separate write-binary deny list (the meta-chars
+//   are how a write would be smuggled into a "read-only" command in
+//   the first place).
+//
+// This module is the canonical home for the classification. The
+// harness pack hook is the superset blocker today, so the classifier
+// lives here rather than in the @lannguyensi/understanding-gate
+// package. If the package adds a parallel classifier in the future,
+// it should mirror this allowlist verbatim, not diverge.
+/**
+ * Single-token read-only binaries. Each accepts arguments without
+ * changing classification: `ls -la /tmp` is still read-only.
+ */
+const SIMPLE_READ_ONLY_BINS = new Set([
+    "ls", "cat", "pwd", "which", "type", "command",
+    "grep", "rg", "wc",
+    "head", "tail", "file", "stat", "tree", "du", "df",
+    "ps", "whoami", "id", "date", "echo", "env", "printenv",
+    "true", "false", "uptime", "hostname", "uname", "tty",
+    "basename", "dirname", "realpath", "readlink",
+    "less", "more", "cmp", "diff", "comm",
+    "sort", "uniq", "cut", "tr", "tac", "rev",
+]);
+/**
+ * `find` flags that make `find` itself a write tool, regardless of
+ * shell metacharacters. `find` is the one binary in the canonical
+ * read-only set whose own arguments can mutate the filesystem
+ * (`-delete`) or shell out to a write command (`-exec`, `-execdir`,
+ * `-ok`, `-okdir`). It also has output-write flags (`-fprint`,
+ * `-fprintf`, `-fprint0`, `-fls`) that would land outside any
+ * redirection guard. Any of these tokens anywhere in the argv
+ * forfeits the read-only classification, so `find` is treated as a
+ * special case rather than included in `SIMPLE_READ_ONLY_BINS`.
+ */
+const FIND_WRITE_FLAGS = new Set([
+    "-delete",
+    "-exec", "-execdir", "-ok", "-okdir",
+    "-fprint", "-fprintf", "-fprint0", "-fls",
+]);
+/**
+ * `less` and `more` can shell out via interactive `!cmd`. The agent
+ * shell is non-interactive, so the escape is not reachable in
+ * practice today; the entry stays in the simple-read-only set with
+ * a documented caveat in case a future runtime PTYs the agent.
+ */
+/**
+ * `git` subcommands that do not mutate the working tree, index, or
+ * any ref. `git fetch` is included because it only writes to the
+ * remote-tracking branches, never touches local refs or the working
+ * tree; same for `git ls-remote`. `git config` is excluded: with
+ * arguments it can set values.
+ */
+const GIT_READ_ONLY_SUBS = new Set([
+    "status", "log", "diff", "show", "branch", "tag",
+    "fetch", "remote", "ls-files", "ls-remote", "ls-tree",
+    "rev-parse", "rev-list", "describe", "blame", "shortlog",
+    "reflog", "cat-file", "check-ref-format", "for-each-ref",
+    "name-rev", "merge-base", "show-ref",
+]);
+/**
+ * `gh` (GitHub CLI) noun + verb pairs that read state without writing.
+ * `gh pr view`, `gh pr checks`, `gh run view`, `gh workflow list`, etc.
+ */
+const GH_READ_ONLY_VERBS = new Set([
+    "view", "list", "diff", "checks", "status",
+]);
+const GH_READ_ONLY_NOUNS = new Set([
+    "pr", "issue", "run", "workflow", "release",
+    "repo", "label", "secret", "variable",
+]);
+/**
+ * `harness` subcommands that only inspect manifest or harness state.
+ * `harness preflight` and `harness approve` are excluded: preflight
+ * writes a ledger row, approve writes the approval marker. Both are
+ * legitimate, but if the gate is currently blocking, classifying them
+ * as read-only would let them bypass it silently. Operator-approval
+ * commands have their own escape path in `isEscapeCommand`.
+ */
+const HARNESS_READ_ONLY_SUBS = new Set([
+    "doctor", "validate", "audit", "diff", "list", "version",
+    "show", "status", "pause",
+]);
+/**
+ * Common single-flag read-only invocations: `<bin> --version`,
+ * `<bin> -v`, `<bin> --help`, `<bin> -h`. Token count must be 2 and
+ * the second token must be one of these flags. Restricts to a
+ * known-safe shape so a binary like `rm` cannot be smuggled past as
+ * `rm --version`.
+ */
+const VERSION_OR_HELP_FLAGS = new Set([
+    "--version", "-V", "-v", "--help", "-h",
+]);
+/**
+ * Classify a Bash command string. `true` means the command is
+ * provably read-only and the understanding-gate can allow it without
+ * an approved report. `false` means the command is either a write or
+ * unclassifiable; the gate must block (fail-closed).
+ *
+ * The classifier inspects the command as a raw shell string. It does
+ * NOT shell-parse or evaluate the command — that would introduce its
+ * own attack surface. Instead it rejects any string that contains
+ * shell metacharacters that could hide a write, then looks at the
+ * first one or two tokens.
+ */
+export function isReadOnlyBashCommand(command) {
+    const trimmed = command.trim();
+    if (trimmed === "")
+        return false;
+    // Reject any shell chaining, redirection, or command substitution.
+    // These make the command unclassifiable even when every visible
+    // piece would otherwise be read-only.
+    if (/[;&|<>]/.test(trimmed))
+        return false;
+    if (trimmed.includes("\n"))
+        return false;
+    if (trimmed.includes("`"))
+        return false;
+    if (trimmed.includes("$("))
+        return false;
+    const tokens = trimmed.split(/\s+/);
+    const bin = tokens[0] ?? "";
+    const sub = tokens[1] ?? "";
+    if (SIMPLE_READ_ONLY_BINS.has(bin))
+        return true;
+    // `find` is read-only ONLY when none of its argv tokens are write
+    // flags. Scan the whole argv: `-delete` / `-exec` / `-execdir` /
+    // `-ok` / `-okdir` mutate the filesystem; `-fprint*` and `-fls`
+    // write to operator-supplied paths without going through shell
+    // redirection. If any such flag appears, fall through to block.
+    if (bin === "find") {
+        return !tokens.slice(1).some((t) => FIND_WRITE_FLAGS.has(t));
+    }
+    // `<bin> --version` / `<bin> --help` shape. Checked BEFORE the
+    // per-binary branches so that `git --version`, `gh --version`,
+    // `harness --version` all pass through this shape rather than
+    // falling into the per-binary subcommand allowlists (which
+    // intentionally don't list `--version` since it's not a
+    // subcommand). Must be exactly two tokens to keep the surface
+    // tight: `<bin> --version <thing>` could exfiltrate or mis-route.
+    if (tokens.length === 2 && VERSION_OR_HELP_FLAGS.has(sub))
+        return true;
+    if (bin === "git")
+        return GIT_READ_ONLY_SUBS.has(sub);
+    if (bin === "gh") {
+        if (!GH_READ_ONLY_NOUNS.has(sub))
+            return false;
+        const verb = tokens[2] ?? "";
+        return GH_READ_ONLY_VERBS.has(verb);
+    }
+    if (bin === "harness")
+        return HARNESS_READ_ONLY_SUBS.has(sub);
+    return false;
+}
+//# sourceMappingURL=read-only-bash.js.map

package/dist/cli/pack/read-only-bash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-bash.js","sourceRoot":"","sources":["../../../src/cli/pack/read-only-bash.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,sBAAsB;AACtB,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,QAAQ;AACR,EAAE;AACF,mBAAmB;AACnB,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,4DAA4D;AAC5D,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,gEAAgE;AAChE,oEAAoE;AACpE,yDAAyD;AAEzD;;;GAGG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;IAC9C,MAAM,EAAE,IAAI,EAAE,IAAI;IAClB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;IAClD,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK;IACrD,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IAC7C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACrC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK;CAC1C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,SAAS;IACT,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ;IACpC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;IAChD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS;IACrD,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;IACxD,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc;IACxD,UAAU,EAAE,YAAY,EAAE,UAAU;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;CAC3C,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS;IAC3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;CACtC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IACxD,MAAM,EAAE,QAAQ,EAAE,OAAO;CAC1B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAEjC,mEAAmE;IACnE,gEAAgE;IAChE,sCAAsC;IACtC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,kEAAkE;IAClE,iEAAiE;IACjE,gEAAgE;IAChE,+DAA+D;IAC/D,gEAAgE;IAChE,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,+DAA+D;IAC/D,+DAA+D;IAC/D,8DAA8D;IAC9D,2DAA2D;IAC3D,wDAAwD;IACxD,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE9D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/pack/understanding-report-schema-hint.d.ts

@@ -1,4 +1,4 @@
-export declare const UNDERSTANDING_REPORT_REQUIRED_SECTIONS: readonly ["Current Understanding (paragraph)", "Intended Outcome (paragraph)", "Derived Todos (list)", "Acceptance Criteria (list)", "Assumptions (list)", "Open Questions (list)", "Out Of Scope (list)", "Risks (list)", "Verification Plan (list)"];
+export declare const UNDERSTANDING_REPORT_REQUIRED_SECTIONS: readonly ["Current Understanding (paragraph)", "Intended Outcome (paragraph)", "Derived Todos (list)", "Acceptance Criteria (list)", "Assumptions (list)", "Open Questions (list)", "Out Of Scope (list)", "Risks (list)", "Verification Plan (list)", "Prior Art (list)"];
 /**
  * Render a compact, agent-readable hint listing the canonical sections
  * the `@lannguyensi/understanding-gate` parser expects. Suitable for

package/dist/cli/pack/understanding-report-schema-hint.js

@@ -26,6 +26,12 @@ export const UNDERSTANDING_REPORT_REQUIRED_SECTIONS = [
     "Out Of Scope (list)",
     "Risks (list)",
     "Verification Plan (list)",
+    // Section 10 (agent-grounding 0.4.0): state what was searched for an
+    // existing solution and what was found, with an explicit
+    // adopt-or-build judgment. Required by the Stop-capture parser in
+    // grill_me / full mode; relaxed in fast_confirm. See harness task
+    // 798d7173 / agent-grounding PR #85.
+    "Prior Art (list)",
 ];
 /**
  * Render a compact, agent-readable hint listing the canonical sections
@@ -47,7 +53,7 @@ export function renderReportSchemaHint() {
     // one pair implied exhaustiveness. The bullets below show the canonical
     // names; the parser's alias-tolerance is a quiet bonus, not something
     // the agent needs to choose between.
-    const intro = "Report format (parsed by `@lannguyensi/understanding-gate`): markdown with these nine sections, any heading level (#, ##, ###), names case-insensitive. Missing any section produces a parse-error under `.understanding-gate/parse-errors/` and the audit trail is empty even though the gate-approval marker still gets written.";
+    const intro = "Report format (parsed by `@lannguyensi/understanding-gate`): markdown with these ten sections, any heading level (#, ##, ###), names case-insensitive. Missing any section produces a parse-error under `.understanding-gate/parse-errors/` and the audit trail is empty even though the gate-approval marker still gets written.";
     const bullets = UNDERSTANDING_REPORT_REQUIRED_SECTIONS.map((s) => `  - ${s}`).join("\n");
     return `${intro}\n${bullets}`;
 }

package/dist/cli/pack/understanding-report-schema-hint.js.map

@@ -1 +1 @@
-{"version":3,"file":"understanding-report-schema-hint.js","sourceRoot":"","sources":["../../../src/cli/pack/understanding-report-schema-hint.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,wDAAwD;AACxD,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,mEAAmE;AAEnE,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,mCAAmC;IACnC,8BAA8B;IAC9B,sBAAsB;IACtB,4BAA4B;IAC5B,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,0BAA0B;CAClB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,uEAAuE;IACvE,wEAAwE;IACxE,+DAA+D;IAC/D,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,KAAK,GACT,oUAAoU,CAAC;IACvU,MAAM,OAAO,GAAG,sCAAsC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"understanding-report-schema-hint.js","sourceRoot":"","sources":["../../../src/cli/pack/understanding-report-schema-hint.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,wDAAwD;AACxD,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,mEAAmE;AAEnE,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,mCAAmC;IACnC,8BAA8B;IAC9B,sBAAsB;IACtB,4BAA4B;IAC5B,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,0BAA0B;IAC1B,qEAAqE;IACrE,yDAAyD;IACzD,kEAAkE;IAClE,kEAAkE;IAClE,qCAAqC;IACrC,kBAAkB;CACV,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,uEAAuE;IACvE,wEAAwE;IACxE,+DAA+D;IAC/D,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,KAAK,GACT,mUAAmU,CAAC;IACtU,MAAM,OAAO,GAAG,sCAAsC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/validate/checks.d.ts

@@ -5,7 +5,7 @@ export interface CheckOptions {
     homeDir?: string;
     pathEnv?: string;
     builtinRuntimeProbe?: () => string[];
-    versionProbe?: (cmd: string[]) => string | null;
+    versionProbe?: (cmd: readonly string[]) => string | null;
 }
 declare function isRootedPath(p: string): boolean;
 declare function firstToken(command: string): string;