@lannguyensi/harness 0.29.0 → 0.30.1

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.30.1] - 2026-05-26
+
+**Headline: hotfix, Risk Gate environment resolver now sees inline `VAR=value` env and leading `cd <path> &&` prefixes in Bash commands, so two common POSIX idioms no longer silently bypass production signals.** Dogfood on 2026-05-26 reproduced the leak: `DATABASE_URL=postgres://prod-host/x terraform destroy` and `cd /repos/prod-infra && terraform destroy` both ran through the gate without firing, even though either signal should have resolved `environment.name: production`. The hook intercept read `process.env` and the hook's starting cwd, neither of which reflects what the operator actually typed. v0.30.1 parses the leading command prefix and merges the result into the resolver's view of env + git context; the rest of the harness (`${REPO}`, `${BRANCH}`, `${CWD}` builtins, audit, the four-way decision matrix) is untouched. **Operator action**: none required; back-compat. Existing manifests, classifiers, and resolvers keep working byte-for-byte. Re-run `npm i -g @lannguyensi/harness` to upgrade.
+
+### Fixed
+
+- **Risk Gate resolver now sees inline `VAR=value` env in Bash commands** (task 1a8a103d). The intercept parses leading `\w+=value` tokens from `tool_input.command` (unquoted, single-quoted, and double-quoted values supported; no `$` interpolation in v1) and merges them over `process.env` for the environment resolver's `env_var_patterns` check. POSIX semantics, inline-env wins over process-env, matching how a real Bash subshell would set them. Closes the leak where `DATABASE_URL=postgres://prod-host/db terraform destroy` smuggled a prod signal past the gate.
+
+- **Risk Gate resolver now sees a leading `cd <path> &&` prefix in Bash commands** (task 1a8a103d). The intercept parses a single leading `cd <path> [&&|;] ...` from `tool_input.command` and re-resolves the git context against the cd target so the branch resolver's `branch_patterns` check evaluates the destination repo, not the hook's starting cwd. Absolute and relative paths are supported, a non-existent or non-git target falls through silently to the hook's cwd. `pushd`, subshell `(cd X && ...)`, and `bash -c "..."` are intentionally out of scope in v1. Closes the leak where `cd /repos/prod-infra && terraform destroy` was evaluated against an unrelated feature branch.
+
+### Added
+
+- **`harness doctor` Risk Gate section names the new resolver behavior** so the next "why didn't the gate fire?" debugging session does not have to grep the source: `ℹ resolver reads inline VAR=value env + leading cd <path> && from Bash commands`.
+
+## [0.30.0] - 2026-05-25
+
+**Headline: `harness approve risk` grows a `--force <reason>` flag so the operator can clear a deny-tier Risk Gate block without ever touching the ledger directly.** Closes the operator-UX leak surfaced during the v0.29.0 release-cut: the built-in `gate-prod-destructive` policy is `deny`-tier and requires the `risk-override:${SESSION_ID}` ledger tag, but no CLI verb wrote that tag. Its `ux.run` instruction told operators to "record a risk-override entry in the evidence ledger", leaking the ledger as an implementation detail. The new flag mirrors the `approve understanding --force` pattern PR #253 shipped: a one-line operator command with an audit-trail suffix. The built-in policy template's `ux.run` now names the verb, not the tag. **Operator action**: none required; back-compat. The default `harness approve risk` (no flag) is byte-for-byte unchanged. Re-run `npm i -g @lannguyensi/harness` to upgrade.
+
+### Added
+
+- **`harness approve risk --force <reason>`** (#258, task a48ccd55). Writes `risk-override:${SESSION_ID}:forced:<sanitised-reason>` to the evidence ledger so the deny-tier `gate-prod-destructive` policy's requires clears. The `:forced:<reason>` suffix is additive metadata so `harness audit` can grep `:forced:` to surface every operator-deliberate override. The TTY guard mirrors `harness pause`: non-TTY stdin refuses with `EX_USAGE` unless `--i-am-the-operator` is passed. Agent-shell (`$CLAUDE_SESSION_ID` set) is intentionally NOT refused; the verb is designed to be runnable from `!`-prefixed Claude Code shells and reads `$CLAUDE_CODE_SESSION_ID` as a session-id resolution tier. Reason sanitisation: lowercase, keeps `[a-z0-9._-]`, collapses other runs to `-`, trims edges, caps at 64 chars; an empty-after-sanitisation result falls back to `operator-override` so the tag is never malformed. The built-in `gate-prod-destructive.ux.run` instruction (and the worked example in `docs/examples/full-manifest.yaml` plus its byte-equivalent golden) is rewritten: no more "record a risk-override entry in the evidence ledger", it now names `harness approve risk --force <reason>` for the per-block override and `harness pause --for <duration>` for the session-wide kill switch. `harness approve risk` without `--force` is byte-for-byte unchanged. Covered by 10 new tests in `tests/cli/approve-risk.test.ts`.
+
 ## [0.29.0] - 2026-05-25
 
 **Headline: Codex hook diagnostics get sharp, `harness approve understanding` actually enforces the Prior Art rule, and read-only Codex shell commands stop tripping the Understanding Gate.** Three feats + three fixes tighten the operator surface around the Codex adapter and the approve verb. The Codex `harness policy intercept` projection now floors at a 2s timeout (PR #255), self-identifies via `--hook <name>` in the projected command + `[hook=<name>]`-prefixed stderr (PR #256), and resolves the per-call workdir for git-context builtins (PR #254). The Understanding Gate now lets read-only Codex shell commands through (PR #252) and `harness approve understanding` validates the persisted report before writing the marker, refusing reports with missing / empty / literal-`- None` `Prior Art` sections (PR #253). The `harness approve` env-var resolution chain is also fixed to read `$CLAUDE_CODE_SESSION_ID` (PR #251). **Operator action**: none required; all changes are back-compat. After upgrade, regenerate Codex config via `harness apply --runtime codex` to pick up the new `--hook` flags and 2s timeout floor in the projected `~/.codex/config.toml`. Re-run `npm i -g @lannguyensi/harness` to upgrade.

package/README.md

@@ -118,6 +118,7 @@ what actually happened.
 - **Operator?** [`docs/for-humans.md`](docs/for-humans.md): install through first `apply`, first real policy, diagnostics cheat sheet.
 - **Agent (or onboarding one)?** [`docs/for-agents.md`](docs/for-agents.md): workflow lifecycle, policy / ledger sequence, CLI cheat sheet by side-effect class, the audit triumvirate.
 - **Writing your own policy?** [`docs/writing-custom-policies.md`](docs/writing-custom-policies.md): three tripwires, four worked recipes (each validated in CI), author loop, field reference.
+- **Looking up a CLI verb?** [`docs/CLI.md`](docs/CLI.md): every command the `harness` binary exposes, grouped by purpose (manifest, runtime, hooks, approvals, gates, preflight).
 
 ## Install
 
@@ -194,8 +195,12 @@ inventory + recommended order in [`docs/uninstall.md`](docs/uninstall.md).
 
 harness ships in phases. All seven are released: read-only inventory →
 managed edits → declarative truth → policy layer → polish and dogfood
-lessons → the Understanding Gate Policy Pack → the Risk Gate. The
-current release is `v0.27.0`.
+lessons → the Understanding Gate Policy Pack → the Risk Gate. Phase 7
+(the Risk Gate) landed in `v0.27.0`; releases since then tighten the
+operator surface around it (`harness pause/resume` in `v0.22.0`,
+`migrate-home` in `v0.24.0`, Codex-runtime adapter polish in `v0.28.x`
+and `v0.29.0`, `approve risk --force` in `v0.30.0`). The current
+release is `v0.30.0`.
 
 The phase-by-phase plan with acceptance criteria lives in
 [`docs/ROADMAP.md`](docs/ROADMAP.md); what shipped in each version is

package/dist/cli/approve/risk.d.ts

@@ -3,6 +3,30 @@ import { type LoaderOptions } from "../loader.js";
 export interface ApproveRiskOptions extends LoaderOptions {
     /** Explicit session id (overrides $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID / $CODEX_SESSION_ID). */
     session?: string;
+    /**
+     * Operator-deliberate override of a Risk Gate `deny` decision. Writes
+     * `risk-override:${SESSION_ID}:forced:<reason-slug>` instead of the
+     * default `risk-approved:${SESSION_ID}` tag, so the built-in
+     * `gate-prod-destructive` policy (which gates on `risk-override:`,
+     * see `src/cli/init/templates.ts`) clears. `deny` is by design not
+     * approvable, so this path is hard-gated behind operator-only checks:
+     * a TTY stdin OR explicit `iAmTheOperator` acknowledgement is
+     * required, mirroring `harness pause`. The reason becomes part of the
+     * audit trail and is sanitised to a tag-safe slug.
+     */
+    force?: {
+        reason: string;
+    };
+    /**
+     * Acknowledge a non-TTY / scripted invocation of `--force`. Without
+     * this flag a non-TTY `--force` refuses with a usage error.
+     */
+    iAmTheOperator?: boolean;
+    /**
+     * Override `process.stdin.isTTY` for tests; mirrors the pause/resume
+     * seam so the non-TTY refusal can be exercised hermetically.
+     */
+    stdinIsTTY?: boolean;
     /** Override the harness.generated/ directory (test injection). */
     generatedDir?: string;
     /** Inject a manifest (test); bypasses `loadManifest`. */
@@ -19,6 +43,13 @@ export interface ApproveRiskResult {
     sessionId: string;
     /** Where `sessionId` came from — surfaced so the operator can sanity-check it. */
     sessionSource: "flag" | "env-claude-code" | "env-claude" | "env-codex" | "pending-approval";
+    /**
+     * True when the verb wrote a `risk-override:` tag via `--force`
+     * instead of the default `risk-approved:`. The CLI surfaces this so
+     * the operator can see at a glance that they exercised the deny-tier
+     * override, not a clean require_approval approval.
+     */
+    forced: boolean;
     ledger: {
         ok: boolean;
         tag: string;
@@ -27,6 +58,16 @@ export interface ApproveRiskResult {
 }
 /** The evidence-ledger tag a Risk Gate `require_approval` policy consults. */
 export declare function riskApprovedTagFor(sessionId: string): string;
+/**
+ * The evidence-ledger tag a Risk Gate `deny`-tier policy with
+ * `requires.ledger_tag: risk-override:${SESSION_ID}` consults. The
+ * `:forced:<reason>` suffix is additive metadata: the built-in
+ * policy's matcher pins the `risk-override:<session>` substring, so the
+ * suffix never affects whether the gate clears. It exists for the
+ * audit trail (`harness audit` can grep `:forced:` to surface every
+ * operator-deliberate override).
+ */
+export declare function riskOverrideTagFor(sessionId: string, reason: string): string;
 /**
  * Resolve the target session id and write its `risk-approved:` ledger
  * tag. Session id precedence mirrors `harness approve understanding`

package/dist/cli/approve/risk.js

@@ -15,13 +15,64 @@
 // needs no change: it already stores arbitrary tags through `ledger_add`.
 import { addLedgerFact } from "../../runtime/ledger-add.js";
 import { readPendingApproval, resolveGeneratedDir, } from "../../runtime/pending-approval.js";
-import { EX_FAIL, HarnessExitError } from "../exit-codes.js";
+import { EX_FAIL, EX_USAGE, HarnessExitError } from "../exit-codes.js";
 import { loadManifest, resolvePaths } from "../loader.js";
 const RISK_APPROVED_PREFIX = "risk-approved";
+const RISK_OVERRIDE_PREFIX = "risk-override";
 /** The evidence-ledger tag a Risk Gate `require_approval` policy consults. */
 export function riskApprovedTagFor(sessionId) {
     return `${RISK_APPROVED_PREFIX}:${sessionId}`;
 }
+/**
+ * The evidence-ledger tag a Risk Gate `deny`-tier policy with
+ * `requires.ledger_tag: risk-override:${SESSION_ID}` consults. The
+ * `:forced:<reason>` suffix is additive metadata: the built-in
+ * policy's matcher pins the `risk-override:<session>` substring, so the
+ * suffix never affects whether the gate clears. It exists for the
+ * audit trail (`harness audit` can grep `:forced:` to surface every
+ * operator-deliberate override).
+ */
+export function riskOverrideTagFor(sessionId, reason) {
+    return `${RISK_OVERRIDE_PREFIX}:${sessionId}:forced:${sanitiseReasonSlug(reason)}`;
+}
+/**
+ * Reduce an operator-supplied free-form reason to a tag-safe slug. Keeps
+ * `[A-Za-z0-9._-]`, collapses any other run to a single `-`, trims
+ * leading / trailing `-`, lowercases, caps at 64 chars. An empty result
+ * (e.g. the operator passed only punctuation) is rejected upstream.
+ */
+function sanitiseReasonSlug(reason) {
+    const slug = reason
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 64);
+    return slug.length > 0 ? slug : "operator-override";
+}
+function refuseForcedIfNonTTY(opts) {
+    if (!opts.force)
+        return;
+    if (opts.iAmTheOperator === true)
+        return;
+    // Deliberate divergence from `harness pause`'s twin guard
+    // (`src/cli/pause/index.ts`'s `refuseIfAgentShell`): this verb is
+    // designed to be runnable from inside `!`-prefixed Claude Code shells
+    // where `$CLAUDE_SESSION_ID` is set (the session-id resolver below
+    // reads it as a fallback tier). Refusing on that env var would gut
+    // the `! ` UX. Operator intent is gated by the non-empty `<reason>`
+    // and the TTY / `--i-am-the-operator` check; that is sufficient.
+    const tty = opts.stdinIsTTY !== undefined ? opts.stdinIsTTY : process.stdin.isTTY === true;
+    if (tty)
+        return;
+    throw new HarnessExitError([
+        "harness approve risk --force refuses to run with non-TTY stdin (looks scripted).",
+        "",
+        "This is the load-bearing guardrail against `--force` becoming an agent-driven",
+        "bypass of a deny-tier Risk Gate decision. Run the verb from your own operator",
+        "shell (in Claude Code: prefix the command with `! `), or pass --i-am-the-operator",
+        "to acknowledge a one-off recovery script.",
+    ].join("\n"), EX_USAGE);
+}
 function findGroundingMcp(manifest) {
     return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
 }
@@ -62,6 +113,12 @@ async function writeLedgerTag(manifest, sessionId, content, opts) {
  * understanding`'s ledger write.
  */
 export async function approveRisk(opts = {}) {
+    // --force is operator-deliberate; guard before any side effect. The
+    // session-id resolution below intentionally still runs the agent-shell
+    // env tier (CLAUDE_CODE_SESSION_ID etc.), since the operator may be
+    // running from `!` with --i-am-the-operator and the session id has to
+    // come from somewhere.
+    refuseForcedIfNonTTY(opts);
     const generatedDir = opts.generatedDir ??
         resolveGeneratedDir({
             ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
@@ -124,13 +181,22 @@ export async function approveRisk(opts = {}) {
     catch {
         /* swallow; ledger write becomes a degraded-ok */
     }
-    const tag = riskApprovedTagFor(sessionId);
+    // Forced override writes a different tag prefix (`risk-override:`)
+    // that the deny-tier `gate-prod-destructive` policy template consults.
+    // The audit-only `:forced:<reason>` suffix lets `harness audit` and
+    // `harness explain --trace` distinguish a clean require_approval
+    // approval from a deliberate deny override.
+    const forced = opts.force !== undefined;
+    const tag = forced
+        ? riskOverrideTagFor(sessionId, opts.force.reason)
+        : riskApprovedTagFor(sessionId);
     const ledgerResult = manifest
         ? await writeLedgerTag(manifest, sessionId, tag, opts)
         : { ok: false, reason: "manifest unreadable; skipped ledger write" };
     return {
         sessionId,
         sessionSource,
+        forced,
         ledger: ledgerResult.ok
             ? { ok: true, tag }
             : { ok: false, tag, reason: ledgerResult.reason },

package/dist/cli/approve/risk.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../../src/cli/approve/risk.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,oEAAoE;AACpE,0EAA0E;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AA4B9E,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,GAAG,oBAAoB,IAAI,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAkB,EAClB,SAAiB,EACjB,OAAe,EACf,IAAwB;IAExB,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;QAC7C,SAAS;QACT,OAAO;QACP,MAAM,EAAE,sBAAsB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAAE;IAE7B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAuC,MAAM,CAAC;IAC/D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QACzB,aAAa,GAAG,MAAM,CAAC;IACzB,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,QAAQ;QACtD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAC7C,CAAC;QACD,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,0DAA0D;QAC1D,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC/C,aAAa,GAAG,iBAAiB,CAAC;IACpC,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EACxC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC1C,aAAa,GAAG,YAAY,CAAC;IAC/B,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EACvC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACzC,aAAa,GAAG,WAAW,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,SAAS,GAAG,MAAM,CAAC;YACnB,aAAa,GAAG,kBAAkB,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB;YACE,6DAA6D;YAC7D,uEAAuE;YACvE,4BAA4B;YAC5B,EAAE;YACF,+EAA+E;YAC/E,iBAAiB,YAAY,oCAAoC;YACjE,4EAA4E;YAC5E,8CAA8C;YAC9C,EAAE;YACF,kEAAkE;YAClE,+EAA+E;SAChF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAEhF,OAAO;QACL,SAAS;QACT,aAAa;QACb,MAAM,EAAE,YAAY,CAAC,EAAE;YACrB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../../src/cli/approve/risk.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,oEAAoE;AACpE,0EAA0E;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAyD9E,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAC7C,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,GAAG,oBAAoB,IAAI,SAAS,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc;IAClE,OAAO,GAAG,oBAAoB,IAAI,SAAS,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,IAAI,GAAG,MAAM;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACtD,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO;IACxB,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO;IACzC,0DAA0D;IAC1D,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IAC3F,IAAI,GAAG;QAAE,OAAO;IAChB,MAAM,IAAI,gBAAgB,CACxB;QACE,kFAAkF;QAClF,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,mFAAmF;QACnF,2CAA2C;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAkB,EAClB,SAAiB,EACjB,OAAe,EACf,IAAwB;IAExB,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;QAC7C,SAAS;QACT,OAAO;QACP,MAAM,EAAE,sBAAsB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAAE;IAE7B,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,uBAAuB;IACvB,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAuC,MAAM,CAAC;IAC/D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QACzB,aAAa,GAAG,MAAM,CAAC;IACzB,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,QAAQ;QACtD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAC7C,CAAC;QACD,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,0DAA0D;QAC1D,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC/C,aAAa,GAAG,iBAAiB,CAAC;IACpC,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EACxC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC1C,aAAa,GAAG,YAAY,CAAC;IAC/B,CAAC;SAAM,IACL,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EACvC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACzC,aAAa,GAAG,WAAW,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,SAAS,GAAG,MAAM,CAAC;YACnB,aAAa,GAAG,kBAAkB,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB;YACE,6DAA6D;YAC7D,uEAAuE;YACvE,4BAA4B;YAC5B,EAAE;YACF,+EAA+E;YAC/E,iBAAiB,YAAY,oCAAoC;YACjE,4EAA4E;YAC5E,8CAA8C;YAC9C,EAAE;YACF,kEAAkE;YAClE,+EAA+E;SAChF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,iEAAiE;IACjE,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM;QAChB,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAM,CAAC,MAAM,CAAC;QACnD,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAEhF,OAAO;QACL,SAAS;QACT,aAAa;QACb,MAAM;QACN,MAAM,EAAE,YAAY,CAAC,EAAE;YACrB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/format.js

@@ -227,6 +227,10 @@ function formatRiskGateSection(report) {
         for (const w of rg.warnings)
             out.push(`  ⚠ ${w}`);
     }
+    // Bash command-prefix parsing is unconditionally on since v0.30.1; the
+    // stat line is informational so the next "why didn't the gate fire?"
+    // debugging session does not have to grep the source for it.
+    out.push(`  ℹ resolver reads inline \`VAR=value\` env + leading \`cd <path> &&\` from Bash commands`);
     out.push(`  ℹ recent Risk Gate decisions: \`harness audit\` (filter with --outcome require_approval / deny)`);
     return out;
 }

package/dist/cli/doctor/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/cli/doctor/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,SAAS,OAAO,CAAC,CAAiB,EAAE,OAAgB;IAClD,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,OAAO;gBACZ,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,iCAAiC;gBAClD,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,GACT,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,OAAO,CAAC;YACzC,OAAO,SAAS,CAAC,CAAC,IAAI,yDAAyD,KAAK,GAAG,CAAC;QAC1F,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,CAAC,IAAI,qCAAqC,CAAC;QAC9D,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,CAAC,IAAI,sBAAsB,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,eAAe,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,QAAQ,CAAC,mBAAmB,+CAA+C,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,gCAAgC;AAChC,SAAS,wBAAwB,CAAC,MAAoB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO;QACL,EAAE;QACF,aAAa;QACb,uBAAuB,GAAG,CAAC,MAAM,kBAAkB;QACnD,uFAAuF;QACvF,2DAA2D,GAAG,CAAC,mBAAmB,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,YAAY,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,aAAa,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,mBAAmB,GAAG,CAC/M,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,wEAAwE,CAClH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM;QACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CACN,OAAO,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,WAAW,CAAC,SAAS,cAAc,CAAC,CAAC,WAAW,CAAC,MAAM,oFAAoF,CACjL,CAAC;YACF,GAAG,CAAC,IAAI,CACN,yMAAyM,CAC1M,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,SAAS,wBAAwB,CAAC,MAAoB;IACpD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IACrE,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CACN,oJAAoJ,CACrJ,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,KAAK,GACT,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,6JAA6J,CAC9J,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,oLAAoL,CACrL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW;YAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,CAAC,CAAC,yBAAyB,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,qBAAqB;AACrB,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,EAAE,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,EAAE,CAAC,WAAW,cAAc,EAAE,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAClE,GAAG,EAAE,CAAC,SAAS,wBAAwB,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACxE,GAAG,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,aAAa,CACnF,CAAC;IACF,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,mGAAmG,CACpG,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,uFAAuF,CACxF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/cli/doctor/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,SAAS,OAAO,CAAC,CAAiB,EAAE,OAAgB;IAClD,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,OAAO;gBACZ,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,iCAAiC;gBAClD,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,GACT,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,OAAO,CAAC;YACzC,OAAO,SAAS,CAAC,CAAC,IAAI,yDAAyD,KAAK,GAAG,CAAC;QAC1F,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,CAAC,IAAI,qCAAqC,CAAC;QAC9D,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,CAAC,IAAI,sBAAsB,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,eAAe,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,QAAQ,CAAC,mBAAmB,+CAA+C,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,gCAAgC;AAChC,SAAS,wBAAwB,CAAC,MAAoB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO;QACL,EAAE;QACF,aAAa;QACb,uBAAuB,GAAG,CAAC,MAAM,kBAAkB;QACnD,uFAAuF;QACvF,2DAA2D,GAAG,CAAC,mBAAmB,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,YAAY,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,aAAa,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,mBAAmB,GAAG,CAC/M,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,wEAAwE,CAClH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM;QACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CACN,OAAO,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,WAAW,CAAC,SAAS,cAAc,CAAC,CAAC,WAAW,CAAC,MAAM,oFAAoF,CACjL,CAAC;YACF,GAAG,CAAC,IAAI,CACN,yMAAyM,CAC1M,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,SAAS,wBAAwB,CAAC,MAAoB;IACpD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IACrE,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CACN,oJAAoJ,CACrJ,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,KAAK,GACT,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,6JAA6J,CAC9J,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,oLAAoL,CACrL,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW;YAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,CAAC,CAAC,yBAAyB,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,qBAAqB;AACrB,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,EAAE,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,EAAE,CAAC,WAAW,cAAc,EAAE,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAClE,GAAG,EAAE,CAAC,SAAS,wBAAwB,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACxE,GAAG,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,aAAa,CACnF,CAAC;IACF,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,6DAA6D;IAC7D,GAAG,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IACtG,GAAG,CAAC,IAAI,CACN,mGAAmG,CACpG,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,uFAAuF,CACxF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cli/index.js

@@ -28,6 +28,7 @@ import { packAdd, packList, packRemove } from "./pack/index.js";
 import { runPackHookPreToolUseCli } from "./pack/hook-pre-tool-use.js";
 import { runPackHookPostToolUseCli } from "./pack/hook-post-tool-use.js";
 import { runPackHookTrackActiveClaimCli } from "./pack/hook-track-active-claim.js";
+import { runPackHookStayInScopeCli } from "./pack/hook-stay-in-scope.js";
 import { runPackHookCodexPreToolUseCli } from "./pack/hook-codex-pre-tool-use.js";
 import { runPackHookCodexStopCli } from "./pack/hook-codex-stop.js";
 import { runPackHookCodexUserPromptSubmitCli } from "./pack/hook-codex-user-prompt-submit.js";
@@ -767,6 +768,19 @@ export function buildProgram(opts = {}) {
             cliOpts.pack = options.pack;
         await runPackHookTrackActiveClaimCli(cliOpts);
     });
+    packHookCmd
+        .command("stay-in-scope")
+        .description("PostToolUse: read tool-event JSON from stdin, emit a one-line stderr reminder and JSONL audit row when an agent-tasks task_create / tasks_create / tasks_update payload looks like a review-derived follow-up. Soft reminder (does not block); enforces user-memory feedback_reviewer_findings_stay_in_scope. Disable via STAY_IN_SCOPE_DISABLED=1; override log path via STAY_IN_SCOPE_LOG.")
+        .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
+        .option("--project <name>", "apply per-project overrides")
+        .action(async (options) => {
+        const cliOpts = {};
+        if (options.config)
+            cliOpts.configPath = options.config;
+        if (options.project)
+            cliOpts.project = options.project;
+        await runPackHookStayInScopeCli(cliOpts);
+    });
     // Phase 6 #6 — Codex adapter sub-commands. Mirror the pre-tool-use
     // shape; UserPromptSubmit equivalent injects the instruction template
     // on stdout for Codex to prepend to additional_instructions.
@@ -1038,12 +1052,16 @@ export function buildProgram(opts = {}) {
     });
     approveCmd
         .command("risk")
-        .description("Grant a Risk Gate require_approval decision: write the " +
-        "risk-approved:${SESSION_ID} evidence-ledger tag the blocked policy's " +
-        "requires consults. Operator action — run it after reviewing the blocked action.")
+        .description("Grant a Risk Gate require_approval decision (default), or deliberately override " +
+        "a deny-tier block with --force <reason>. The default path writes the " +
+        "risk-approved:${SESSION_ID} ledger tag the require_approval policy's requires " +
+        "consults; --force writes risk-override:${SESSION_ID}:forced:<reason> for the " +
+        "deny-tier policy. Operator action.")
         .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
         .option("--project <name>", "apply per-project overrides")
         .option("--session <id>", "explicit session id (default: $CLAUDE_CODE_SESSION_ID, then $CLAUDE_SESSION_ID, then $CODEX_SESSION_ID, then staged .pending-approval)")
+        .option("--force <reason>", "operator-deliberate override of a deny-tier Risk Gate block; writes the risk-override tag with the reason stamped into the audit trail")
+        .option("--i-am-the-operator", "acknowledge a scripted / non-TTY --force invocation (otherwise refused)")
         .action(async (options) => {
         const cliOpts = {};
         if (options.config)
@@ -1052,6 +1070,15 @@ export function buildProgram(opts = {}) {
             cliOpts.project = options.project;
         if (options.session)
             cliOpts.session = options.session;
+        if (typeof options.force === "string") {
+            const reason = options.force.trim();
+            if (reason.length === 0) {
+                throw new HarnessExitError("--force requires a non-empty <reason>; the reason is recorded in the audit trail.", EX_USAGE);
+            }
+            cliOpts.force = { reason };
+        }
+        if (options.iAmTheOperator)
+            cliOpts.iAmTheOperator = true;
         const result = await approveRisk(cliOpts);
         const lines = [];
         const sourceNote = result.sessionSource === "pending-approval"
@@ -1066,11 +1093,21 @@ export function buildProgram(opts = {}) {
         lines.push(`session: ${result.sessionId}${sourceNote}`);
         if (result.ledger.ok) {
             lines.push(`ledger:  ✓ wrote ${result.ledger.tag}`);
-            lines.push("  the Risk Gate require_approval policy now passes for this session.");
+            if (result.forced) {
+                lines.push("  deny-tier override recorded; the deny-tier Risk Gate policy now passes for this session.");
+            }
+            else {
+                lines.push("  the Risk Gate require_approval policy now passes for this session.");
+            }
         }
         else {
             lines.push(`ledger:  ✗ FAILED (${result.ledger.reason ?? "unknown"})`);
-            lines.push("  the require_approval gate stays blocked until the tag is recorded.");
+            if (result.forced) {
+                lines.push("  the deny-tier override stays unrecorded; the gate keeps blocking.");
+            }
+            else {
+                lines.push("  the require_approval gate stays blocked until the tag is recorded.");
+            }
         }
         stdout(`${lines.join("\n")}\n`);
     });