@lannguyensi/harness 0.40.0 → 0.41.0

package/dist/policy-packs/builtin/understanding-before-execution.js

@@ -16,6 +16,7 @@ import { profileToSettingsPermissions } from "../permission-translator.js";
 import { DEFAULT_RUNTIME } from "../runtime.js";
 import { isKnownProfileName, resolveProfile, KNOWN_PROFILE_NAMES, } from "./permission-profiles.js";
 import { REPORTS_DIR_ENV } from "./understanding-before-execution-runtime.js";
+import { SHELL_ALIASES } from "../../runtime/tool-name-aliases.js";
 export const PACK_NAME = "understanding-before-execution";
 // Canonical version probe for the pack's package-side bin. Consumed by
 // `harness doctor` when the operator declares a pack-level `min_version`
@@ -44,6 +45,53 @@ export function understandingApprovalRequirement(mode) {
         ? "a human-approved Understanding Report for this session"
         : "an approved Understanding Report for this session";
 }
+/**
+ * Shipped default `config.producers` for this pack (agent-tasks/25bced52).
+ * Canonical source for the "golden path" recovery command: both `harness
+ * init` generation surfaces (Solo/Team/Full templates, the Custom
+ * composer) and `harness pack reseed` (task 68b9ad9c) read from here, so
+ * a future wording change to the producer descriptions only has to land
+ * in one place to reach every manifest-generating surface plus the
+ * reseed path used to backfill already-installed manifests.
+ */
+export function defaultProducers() {
+    return [
+        {
+            kind: "ask",
+            command: "harness approve understanding",
+            description: "Bare command, no pipes or chaining. The hook recognises it via isEscapeCommand and emits permissionDecision:ask; the operator's go on that prompt IS the gate approval. Golden path.",
+        },
+        {
+            kind: "bash",
+            command: "harness approve understanding",
+            description: "Same command from any un-hooked terminal (operator only, not reachable from inside the gated session). Writes the canonical marker at harness.generated/.approvals/${SESSION_ID}.",
+        },
+    ];
+}
+/**
+ * Shipped default `config.ux` for this pack, parameterised on the
+ * resolved mode (only the `required` line varies across modes — see
+ * `understandingApprovalRequirement` above). Canonical source consumed
+ * by the same generation surfaces as `defaultProducers()`, plus
+ * `harness doctor`'s divergence warning and `harness pack reseed` (task
+ * 68b9ad9c): the dogfood motivating that task found that a deny-message
+ * wording fix (e.g. the heredoc submission form, agent-tasks/e48e3b45)
+ * only reached NEW `harness init` manifests, because nothing propagated
+ * the improved text into an already-installed operator manifest whose
+ * `config.ux` still taught the old wording. Reading from one function
+ * here means a future wording fix is available to `pack reseed`
+ * automatically, with no separate update needed.
+ */
+export function defaultUx(mode) {
+    return {
+        cannot: "You cannot use write-capable tools yet.",
+        required: [understandingApprovalRequirement(mode)],
+        run: [
+            "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)",
+            "Run `harness approve understanding` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)",
+        ],
+    };
+}
 const HOOK_NAME_PREFIX = `policy-pack:${PACK_NAME}`;
 // Per-runtime hook surface. Claude Code keys on tool name (Edit|Write|Bash);
 // Codex's write surface is `apply_patch` plus shell tool aliases used by
@@ -75,6 +123,13 @@ const PRE_TOOL_USE_COMMAND_CLAUDE = "harness pack hook pre-tool-use";
 //   - Stop-equivalent capture into `.understanding-gate/reports/`
 //     (Phase 6 #6 follow-up).
 //   - PreToolUse blocker on apply_patch plus Codex shell aliases (Phase 6 #6).
+//   - PostToolUse marker-expiry (task a1348c89): Codex's published hooks
+//     reference (developers.openai.com/codex/hooks) documents
+//     `PostToolUse` as a first-class event — `[[hooks.PostToolUse]]`
+//     with a `matcher` on `tool_name`, same allow/exit-0 or
+//     block/exit-2 contract as PreToolUse. Mirrors the Claude
+//     `post-tool-use` hook via the shared matching/clearing core in
+//     understanding-before-execution-runtime.ts.
 //
 // Cross-runtime sessions can still approve from a Claude Code report:
 // the ledger tag is the canonical source for harnessed sessions,
@@ -85,6 +140,7 @@ const PRE_TOOL_USE_COMMAND_CLAUDE = "harness pack hook pre-tool-use";
 const COMMAND_USER_PROMPT_SUBMIT_CODEX = "harness pack hook codex-user-prompt-submit";
 const COMMAND_STOP_CODEX = "harness pack hook codex-stop";
 const COMMAND_PRE_TOOL_USE_CODEX = "harness pack hook codex-pre-tool-use";
+const COMMAND_POST_TOOL_USE_CODEX = "harness pack hook codex-post-tool-use";
 export function isMode(value) {
     return (typeof value === "string" && MODES.includes(value));
 }
@@ -177,31 +233,133 @@ const DEFAULT_EXPIRE_ON_TOOL_MATCH = [
     "mcp__agent-tasks__tasks_transition",
 ];
 const POST_TOOL_USE_COMMAND_CLAUDE = "harness pack hook post-tool-use";
-const TRACK_ACTIVE_CLAIM_COMMAND_CLAUDE = "harness pack hook track-active-claim";
+// Task cf4cdc93 (Codex parity gap #3): unlike stop/pre-tool-use/
+// post-tool-use, the active-claim tracker and stay-in-scope reminder
+// need NO runtime-specific CLI verb — both hook bodies only ever
+// inspect the generic `tool_name` / `tool_input` fields already common
+// to Claude's and Codex's PostToolUse envelope (no session_id, no
+// shell-command extraction, no Codex-only synonym). One shared command
+// constant per hook is therefore reused verbatim on both runtimes below
+// instead of a `codex-track-active-claim` / `codex-stay-in-scope`
+// sibling binary — avoids reintroducing the exact Claude/Codex drift
+// class task e7c2ec3c fixed on the PreToolUse side.
+const TRACK_ACTIVE_CLAIM_COMMAND = "harness pack hook track-active-claim";
 // Hardcoded matcher for the v2 active-claim tracker (harness/494fd1e5).
 // Agent-tasks specific; operators on other tasking systems can ignore
 // this hook (the matcher won't fire for their tools). A config-driven
 // extension can land later if a second tasking system asks for it.
 const TRACK_ACTIVE_CLAIM_MATCH = "^(?:mcp__agent-tasks__task_start|mcp__agent-tasks__task_finish|mcp__agent-tasks__task_abandon|mcp__agent-tasks__tasks_transition)$";
+// Codex sibling of TRACK_ACTIVE_CLAIM_MATCH above (task cf4cdc93): a
+// bare, unescaped `|`-joined list, NOT the anchored `^(?:...)$` form —
+// same rationale as `codexPostToolUseMatchPattern`'s own doc comment
+// (task a1348c89 review finding): `expandCodexHookMatchPattern`'s
+// "simple token" guard (`isSimpleToolPatternToken`, generate-codex-config.ts)
+// only alias-expands a match string whose tokens are ALL "simple"; the
+// anchor characters `^`, `(`, `?` trip that guard and the anchored form
+// is passed through UNCHANGED at TOML-emit time, so a Codex session
+// sending a dotted/underscore-server MCP tool-name variant would never
+// even reach the hook. This bare form lets the emitted `config.toml`
+// matcher — and therefore Codex's own dispatcher — recognize those
+// variants, exactly like `PRE_TOOL_USE_MATCH_CODEX` already does.
+const TRACK_ACTIVE_CLAIM_MATCH_CODEX = "mcp__agent-tasks__task_start|mcp__agent-tasks__task_finish|mcp__agent-tasks__task_abandon|mcp__agent-tasks__tasks_transition";
 // Hardcoded matcher for the stay-in-scope reminder (harness/2ba06030).
 // Fires on the three task-mutation verbs that can carry labels and
 // description fields. tasks_update is included so a label added
 // post-hoc (e.g. `tasks_update { labels: ["from-review"] }`) still
 // surfaces the reminder.
 const STAY_IN_SCOPE_MATCH = "^(?:mcp__agent-tasks__task_create|mcp__agent-tasks__tasks_create|mcp__agent-tasks__tasks_update)$";
-const STAY_IN_SCOPE_COMMAND_CLAUDE = "harness pack hook stay-in-scope";
+// Codex sibling of STAY_IN_SCOPE_MATCH above (task cf4cdc93), same
+// bare-unanchored-list rationale as TRACK_ACTIVE_CLAIM_MATCH_CODEX.
+const STAY_IN_SCOPE_MATCH_CODEX = "mcp__agent-tasks__task_create|mcp__agent-tasks__tasks_create|mcp__agent-tasks__tasks_update";
+const STAY_IN_SCOPE_COMMAND = "harness pack hook stay-in-scope";
+// Bash tool name used to widen the PostToolUse matcher when
+// `expire_on_bash_match` is configured (task bea04a03). Matches the
+// single entry of `DEFAULT_BASH_TOOL_NAMES` in
+// understanding-before-execution-runtime.ts.
+const BASH_TOOL_NAME_CLAUDE = "Bash";
+// Codex shell-tool aliases used for the same widening on the Codex
+// matcher builder below. Derived from the canonical `SHELL_ALIASES` in
+// `src/runtime/tool-name-aliases.ts` (task bea04a03 review finding) —
+// `policy-packs/` IS allowed to depend on `runtime/` (layering rule,
+// `.dependency-cruiser.cjs`; the sibling understanding-before-execution-runtime.ts
+// already imports from there), so this is a shared source of truth
+// rather than a third hand-maintained copy. `CODEX_SHELL_TOOLS` in
+// `src/cli/pack/hook-codex-pre-tool-use.ts` stays a separate literal:
+// `policy-packs/` may not depend on `cli/` (same layering rule), so that
+// one cannot be unified with this without a boundary violation.
+const BASH_TOOL_NAMES_CODEX = SHELL_ALIASES;
 /**
- * Compose the PostToolUse `match` regex from the configured tool list.
+ * Compose the PostToolUse `match` regex from the configured tool list,
+ * widened with the Bash tool name when `includeBash` is true (task
+ * bea04a03: `approval_lifecycle.expire_on_bash_match` carries at least
+ * one pattern). Before this widening, `expire_on_tool_match` alone
+ * gated the matcher, so a real `Bash` call never reached the hook at
+ * all — `matchPostToolUseBoundary`'s bash-regex check (which DOES
+ * correctly evaluate `expire_on_bash_match` once invoked) was
+ * unreachable in practice. Adding "Bash" here only ROUTES the call to
+ * the hook; it does not add "Bash" to `expire_on_tool_match`'s own
+ * semantics — the hook body still classifies a matched Bash call as a
+ * bash-regex match (`toolNameMatched: false`), never a tool-name match.
  * Each tool name is regex-escaped and joined with `|` so settings.json
  * fires the hook only when the just-completed tool is one we care
  * about. When the operator declared `approval_lifecycle: { mode: session }`
- * (or cleared the list), no PostToolUse hook is emitted at all (caller
+ * (or cleared both lists), no PostToolUse hook is emitted at all (caller
  * filters).
  */
-function postToolUseMatchPattern(tools) {
-    const escaped = tools.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+function postToolUseMatchPattern(tools, includeBash) {
+    const widened = includeBash && !tools.includes(BASH_TOOL_NAME_CLAUDE)
+        ? [...tools, BASH_TOOL_NAME_CLAUDE]
+        : tools;
+    const escaped = widened.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
     return `^(?:${escaped.join("|")})$`;
 }
+/**
+ * Compose the CODEX PostToolUse `match` field — deliberately NOT
+ * `postToolUseMatchPattern` above (review finding on task a1348c89,
+ * verified via a direct probe of `expandCodexHookMatchPattern`). The
+ * Claude builder anchors its output in `^(?:...)$` and regex-escapes
+ * every tool name; `expandCodexHookMatchPattern` in
+ * `generate-codex-config.ts` only alias-expands a match string whose
+ * `|`-split tokens are ALL "simple" (`isSimpleToolPatternToken`,
+ * `/^[A-Za-z0-9_.:-]+$/`) — the anchor characters `^`, `(`, `?` on the
+ * first/last token trip that guard, so an anchored match is passed
+ * through UNCHANGED at emit time. Concretely: a Codex session sending
+ * the dotted `mcp__agent-tasks__.task_finish` or an underscore-server
+ * `mcp__agent_tasks__task_finish` variant would never even reach the
+ * hook — Codex's own dispatcher tests `tool_name` against the emitted
+ * `matcher`, and the anchored form only contains the canonical forms.
+ * (`matchPostToolUseBoundary`'s alias-aware body-side fix, same task,
+ * only helps once the hook is actually invoked — it cannot compensate
+ * for a dispatcher that never calls it.)
+ *
+ * This builder instead emits a BARE, unescaped `|`-joined list — same
+ * shape as the existing `PRE_TOOL_USE_MATCH_CODEX` constant above —
+ * so every token stays "simple" and `expandCodexHookMatchPattern`
+ * expands each MCP tool name into its full alias set (server
+ * hyphen/underscore swap, the `mcp__server__.tool` dotted form) at
+ * `harness apply --runtime codex` time, exactly like the Codex
+ * PreToolUse blocker's own matcher already does. No anchoring is
+ * needed here: Codex's own hook dispatch (like the sibling PreToolUse
+ * matcher) is unanchored substring-style matching already, and this
+ * keeps the Codex and Claude builders independently tunable rather
+ * than smuggling a Codex-only branch into the shared Claude helper.
+ *
+ * Like the Claude builder above, `includeBash` (task bea04a03) widens
+ * the emitted list with the Codex shell-tool aliases
+ * (`BASH_TOOL_NAMES_CODEX`: Bash/shell/exec_command/functions.exec_command)
+ * when `approval_lifecycle.expire_on_bash_match` carries at least one
+ * pattern, so a real Codex shell call is actually routed to the hook.
+ * The aliases stay simple tokens (no anchors), so they still pass
+ * through `expandCodexHookMatchPattern` unchanged — they have no MCP-style
+ * variants to expand, but they must not trip the "simple token" guard
+ * either.
+ */
+function codexPostToolUseMatchPattern(tools, includeBash) {
+    const widened = includeBash
+        ? [...tools, ...BASH_TOOL_NAMES_CODEX.filter((t) => !tools.includes(t))]
+        : tools;
+    return widened.join("|");
+}
 function resolveExpireOnToolMatch(pack) {
     const raw = pack.config["approval_lifecycle"];
     // No config block at all: default-on with the agent-tasks tool list.
@@ -225,6 +383,56 @@ function resolveExpireOnToolMatch(pack) {
     }
     return { tools: [...DEFAULT_EXPIRE_ON_TOOL_MATCH], emitHook: true };
 }
+/**
+ * Whether `approval_lifecycle.expire_on_bash_match` carries at least one
+ * non-empty pattern (task bea04a03). Used ONLY to decide whether the
+ * emitted PostToolUse matcher should be widened to route Bash (Claude) /
+ * shell-alias (Codex) calls to the hook at all — the actual regex
+ * compiling and matching against `tool_input.command` happens downstream
+ * in `parseApprovalLifecycle` / `matchPostToolUseBoundary`
+ * (understanding-before-execution-runtime.ts). An entry that turns out to
+ * be an invalid regex is silently dropped there with a warning; that is
+ * harmless here — the matcher merely routes the call to the hook, and a
+ * hook invocation that finds no live bash-regex match just no-ops
+ * (mirrors the existing `noBoundariesConfigured` / `boundary.matched`
+ * no-op paths in hook-post-tool-use.ts / hook-codex-post-tool-use.ts).
+ *
+ * Mirrors `resolveExpireOnToolMatch`'s traversal of the same config
+ * block (undefined/non-object/`mode: session` all resolve to "not
+ * configured"), but returns a bare boolean since the matcher builders
+ * only need presence, not the pattern strings themselves.
+ */
+function resolveExpireOnBashMatchConfigured(pack) {
+    const raw = pack.config["approval_lifecycle"];
+    if (raw === undefined || raw === null)
+        return false;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return false;
+    const obj = raw;
+    if (obj["mode"] === "session")
+        return false;
+    const list = obj["expire_on_bash_match"];
+    if (!Array.isArray(list))
+        return false;
+    return list.some((v) => typeof v === "string" && v.length > 0);
+}
+/**
+ * Shared PostToolUse boundary resolution for BOTH the Claude and Codex
+ * `buildHooks` branches (task bea04a03): combines
+ * `resolveExpireOnToolMatch` and `resolveExpireOnBashMatchConfigured`
+ * into the one decision each branch's IIFE needs. Extracted specifically
+ * to avoid re-introducing the exact clone-avoidance problem
+ * `understanding-before-execution-runtime.ts`'s `matchPostToolUseBoundary`
+ * / `applyPostToolUseExpiry` / `describePostToolUseExpiry` extraction
+ * already solved once for the two runtimes' hook CLIs (`check:duplication`
+ * flagged the inline duplicate when this task first wired the two nearly-
+ * identical IIFEs by hand).
+ */
+function resolvePostToolUseBoundaries(pack) {
+    const { tools, emitHook: toolsEmitHook } = resolveExpireOnToolMatch(pack);
+    const bashConfigured = resolveExpireOnBashMatchConfigured(pack);
+    return { tools, bashConfigured, emit: toolsEmitHook || bashConfigured };
+}
 function buildHooks(runtime, pack, opts = {}) {
     // Per-mode hook commands are identical (the mode is passed via the
     // package's UNDERSTANDING_GATE_MODE env var, set elsewhere — out of
@@ -263,6 +471,71 @@ function buildHooks(runtime, pack, opts = {}) {
                 budget_ms: 5000,
                 description: "Codex adapter: block apply_patch and Codex shell tools until an approved Understanding Report exists for the session. Consults both the evidence-ledger tag and the persisted JSON report.",
             },
+            // PostToolUse marker-expiry (task a1348c89, widened by task
+            // bea04a03). Same boundary-tool list as the Claude hook below
+            // (resolveExpireOnToolMatch) so Codex expires on the identical
+            // default set (agent-tasks task_finish / task_abandon /
+            // pull_requests_merge / tasks_transition) — but a DIFFERENT
+            // `match` builder (`codexPostToolUseMatchPattern`, not
+            // `postToolUseMatchPattern`): see that function's own doc comment
+            // for why the Claude builder's anchored regex form silently
+            // defeats the Codex generator's MCP tool-name alias expansion
+            // (review finding on task a1348c89).
+            // `match` is ALSO widened with the Codex shell-tool aliases
+            // (Bash/shell/exec_command/functions.exec_command) whenever
+            // `approval_lifecycle.expire_on_bash_match` carries at least one
+            // pattern (task bea04a03): before this, `match` was built ONLY
+            // from `expire_on_tool_match`, so a real shell call never reached
+            // the hook body at all on EITHER runtime, even though
+            // `matchPostToolUseBoundary`'s bash-regex check correctly
+            // evaluates `expire_on_bash_match` once invoked. The widened
+            // aliases are NEVER added to `expire_on_tool_match` itself — the
+            // hook body still classifies a matched shell call as a bash-regex
+            // match, not a tool-name match, via `CODEX_SHELL_TOOLS.has(toolName)`
+            // in the caller (hook-codex-post-tool-use.ts).
+            ...(() => {
+                const { tools, bashConfigured, emit } = resolvePostToolUseBoundaries(pack);
+                if (!emit)
+                    return [];
+                const hook = {
+                    name: `${HOOK_NAME_PREFIX}:codex:post-tool-use`,
+                    event: "PostToolUse",
+                    match: codexPostToolUseMatchPattern(tools, bashConfigured),
+                    command: wrap(COMMAND_POST_TOOL_USE_CODEX),
+                    blocking: false,
+                    budget_ms: 2000,
+                    description: "Codex adapter: expire the approval marker AND the persisted report after a task-completion boundary tool or expire_on_bash_match shell command (default tools: agent-tasks task_finish / task_abandon / pull_requests_merge). Forces a fresh Understanding Report on the next task.",
+                };
+                return [hook];
+            })(),
+            // Active-claim tracker (harness/494fd1e5), Codex parity task
+            // cf4cdc93 (parity-gaps doc gap #3). Always emitted alongside the
+            // pack, mirroring the Claude sibling below — the matcher won't
+            // fire for operators on non-agent-tasks tasking systems, so the
+            // file simply never appears for them. Same command as Claude
+            // (see TRACK_ACTIVE_CLAIM_COMMAND's doc comment above): the hook
+            // body needs no Codex-specific handling.
+            {
+                name: `${HOOK_NAME_PREFIX}:codex:track-active-claim`,
+                event: "PostToolUse",
+                match: TRACK_ACTIVE_CLAIM_MATCH_CODEX,
+                command: TRACK_ACTIVE_CLAIM_COMMAND,
+                blocking: false,
+                budget_ms: 2000,
+                description: "Codex adapter: track the active agent-tasks claim by writing/clearing <generatedDir>/active-claim on task_start / task_finish / task_abandon. Lets `harness approve understanding` auto-resolve the task id (harness/494fd1e5, Codex parity task cf4cdc93).",
+            },
+            // Stay-in-scope reminder (harness/2ba06030), Codex parity task
+            // cf4cdc93 (parity-gaps doc gap #3). Same always-on / soft-only
+            // semantics as the Claude sibling below.
+            {
+                name: `${HOOK_NAME_PREFIX}:codex:stay-in-scope`,
+                event: "PostToolUse",
+                match: STAY_IN_SCOPE_MATCH_CODEX,
+                command: STAY_IN_SCOPE_COMMAND,
+                blocking: false,
+                budget_ms: 2000,
+                description: "Codex adapter: emit a soft reminder + audit row when a review-derived follow-up task gets created. Surfaces user-memory feedback_reviewer_findings_stay_in_scope. Disable: STAY_IN_SCOPE_DISABLED=1 (harness/2ba06030, Codex parity task cf4cdc93).",
+            },
         ];
     }
     // `min_version` floor on the npm-backed bins: 0.4.0 ships the
@@ -311,21 +584,33 @@ function buildHooks(runtime, pack, opts = {}) {
             description: "Block Edit/Write/Bash until an approved Understanding Report exists for the session. Consults both the evidence-ledger tag (understanding-approved:${SESSION_ID}) and the persisted JSON report.",
         },
         // PostToolUse marker-expiry hook (agent-tasks/d8ee60ca). Fires on the
-        // configured task-boundary tools and deletes the approval marker so
-        // the next Edit / Write / Bash forces a fresh Understanding Report.
-        // Default tool list expires on agent-tasks task_finish / task_abandon /
-        // pull_requests_merge. Operators on other task systems override the
-        // list via config.approval_lifecycle.expire_on_tool_match; setting
+        // configured task-boundary tools, and (task bea04a03) on a Bash call
+        // when `approval_lifecycle.expire_on_bash_match` carries at least one
+        // pattern, and deletes the approval marker so the next Edit / Write /
+        // Bash forces a fresh Understanding Report. Default tool list expires
+        // on agent-tasks task_finish / task_abandon / pull_requests_merge.
+        // Operators on other task systems override the list via
+        // config.approval_lifecycle.expire_on_tool_match; setting
         // `approval_lifecycle: { mode: session }` opts out entirely and
         // suppresses this hook from being emitted at all.
+        //
+        // Before task bea04a03, `match` was built ONLY from
+        // `expire_on_tool_match`, so a real `Bash` call never invoked this
+        // hook at all — `matchPostToolUseBoundary`'s bash-regex check (which
+        // DOES correctly evaluate `expire_on_bash_match` once invoked)
+        // was unreachable. Widening `match` to include "Bash" does not
+        // change how the hook body classifies the match: a Bash call that
+        // fires the hook is still evaluated as a bash-regex match
+        // (`toolNameMatched: false`), never folded into
+        // `expire_on_tool_match`'s own tool-name semantics.
         ...(() => {
-            const { tools, emitHook } = resolveExpireOnToolMatch(pack);
-            if (!emitHook)
+            const { tools, bashConfigured, emit } = resolvePostToolUseBoundaries(pack);
+            if (!emit)
                 return [];
             const hook = {
                 name: `${HOOK_NAME_PREFIX}:post-tool-use`,
                 event: "PostToolUse",
-                match: postToolUseMatchPattern(tools),
+                match: postToolUseMatchPattern(tools, bashConfigured),
                 // Wrap with UNDERSTANDING_GATE_REPORT_DIR so the post-tool-use
                 // hook resolves the same persisted-reports directory as the
                 // pre-tool-use blocker; otherwise it can't expire the persisted
@@ -333,7 +618,7 @@ function buildHooks(runtime, pack, opts = {}) {
                 command: wrap(POST_TOOL_USE_COMMAND_CLAUDE),
                 blocking: false,
                 budget_ms: 2000,
-                description: "Expire the approval marker AND the persisted report after a task-completion boundary tool (default: agent-tasks task_finish / task_abandon / pull_requests_merge). Forces a fresh Understanding Report on the next task.",
+                description: "Expire the approval marker AND the persisted report after a task-completion boundary tool or expire_on_bash_match Bash command (default tools: agent-tasks task_finish / task_abandon / pull_requests_merge). Forces a fresh Understanding Report on the next task.",
             };
             return [hook];
         })(),
@@ -348,7 +633,7 @@ function buildHooks(runtime, pack, opts = {}) {
             name: `${HOOK_NAME_PREFIX}:track-active-claim`,
             event: "PostToolUse",
             match: TRACK_ACTIVE_CLAIM_MATCH,
-            command: TRACK_ACTIVE_CLAIM_COMMAND_CLAUDE,
+            command: TRACK_ACTIVE_CLAIM_COMMAND,
             blocking: false,
             budget_ms: 2000,
             description: "Track the active agent-tasks claim by writing/clearing <generatedDir>/active-claim on task_start / task_finish / task_abandon. Lets `harness approve understanding` auto-resolve the task id (harness/494fd1e5).",
@@ -367,7 +652,7 @@ function buildHooks(runtime, pack, opts = {}) {
             name: `${HOOK_NAME_PREFIX}:stay-in-scope`,
             event: "PostToolUse",
             match: STAY_IN_SCOPE_MATCH,
-            command: STAY_IN_SCOPE_COMMAND_CLAUDE,
+            command: STAY_IN_SCOPE_COMMAND,
             blocking: false,
             budget_ms: 2000,
             description: "Emit a soft reminder + audit row when a review-derived follow-up task gets created. Surfaces user-memory feedback_reviewer_findings_stay_in_scope. Disable: STAY_IN_SCOPE_DISABLED=1.",

package/dist/policy-packs/builtin/understanding-before-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"understanding-before-execution.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/understanding-before-execution.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,wCAAwC;AAExC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAM9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,MAAM,CAAC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAE1D,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,oBAAoB;IACpB,WAAW;CACZ,CAAC;AAIF,MAAM,KAAK,GAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,YAAY,GAAS,UAAU,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAAU;IACzD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,wDAAwD;QAC1D,CAAC,CAAC,mDAAmD,CAAC;AAC1D,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,UAAU;AACV,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AACpD,MAAM,wBAAwB,GAC5B,4DAA4D,CAAC;AAE/D,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,+BAA+B;AAC/B,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AACvE,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,yEAAyE;AACzE,sEAAsE;AACtE,iEAAiE;AACjE,yEAAyE;AACzE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAErE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,yDAAyD;AACzD,kEAAkE;AAClE,8BAA8B;AAC9B,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,iEAAiE;AACjE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,0DAA0D;AAC1D,MAAM,gCAAgC,GACpC,4CAA4C,CAAC;AAC/C,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAC1D,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAE1E,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,mBAAqD,CAAC;SAC3D,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC;QACN,iEAAiE;QACjE,mDAAmD;QACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;QACrC,4DAA4D;QAC5D,wDAAwD;QACxD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,4DAA4D;IAC5D,kEAAkE;IAClE,2DAA2D;IAC3D,0CAA0C;IAC1C,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AA+BZ;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAe,EACf,UAA8B;IAE9B,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAChC,OAAO,GAAG,eAAe,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB;IAI1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,IAAI,qCAAqC,IAAI,CAAC,SAAS,CAC1F,GAAG,CACJ,sBAAsB,YAAY,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,iDAAiD;AACjD,MAAM,4BAA4B,GAA0B;IAC1D,+BAA+B;IAC/B,gCAAgC;IAChC,uCAAuC;IACvC,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,uDAAuD;IACvD,oCAAoC;CACrC,CAAC;AAEF,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AACvE,MAAM,iCAAiC,GACrC,sCAAsC,CAAC;AAEzC,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,wBAAwB,GAC5B,oIAAoI,CAAC;AAEvI,uEAAuE;AACvE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,yBAAyB;AACzB,MAAM,mBAAmB,GACvB,mGAAmG,CAAC;AAEtG,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,KAA4B;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAIhD,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CAAC;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,4DAA4D;IAC5D,2CAA2C;IAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CACvB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CACjB,OAAgB,EAChB,IAAgB,EAChB,OAA2B,EAAE;IAE7B,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,EAAE;IACF,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CACnC,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,IAAI,EAAE,GAAG,gBAAgB,2BAA2B;gBACpD,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,gCAAgC;gBACzC,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,sGAAsG;aACzG;YACD;gBACE,IAAI,EAAE,GAAG,gBAAgB,aAAa;gBACtC,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC;gBACjC,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,4IAA4I;aAC/I;YACD;gBACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;gBAC9C,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC;gBACzC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,4LAA4L;aAC/L;SACF,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,gBAAgB;IAChB,MAAM,cAAc,GAAG,OAAO,CAAC;IAC/B,MAAM,kBAAkB,GAAqB;QAC3C,oBAAoB;QACpB,WAAW;KACZ,CAAC;IACF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;YAC9C,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,6BAA6B;YACtC,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,kBAAkB;YACnC,WAAW,EACT,oHAAoH;SACvH;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,OAAO;YAChC,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,kBAAkB;YACnC,WAAW,EACT,sHAAsH;SACzH;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,IAAI,CAAC,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EACT,kMAAkM;SACrM;QACD,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,kDAAkD;QAClD,GAAG,CAAC,GAAW,EAAE;YACf,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAS;gBACjB,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;gBACzC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC;gBACrC,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,4DAA4D;gBAC5D,OAAO,EAAE,IAAI,CAAC,4BAA4B,CAAC;gBAC3C,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,0NAA0N;aAC7N,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,EAAE;QACJ,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,6DAA6D;QAC7D,+CAA+C;QAC/C;YACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;YAC9C,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,iCAAiC;YAC1C,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,kNAAkN;SACrN;QACD,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,6DAA6D;QAC7D,kEAAkE;QAClE,sDAAsD;QACtD;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,4BAA4B;YACrC,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,uLAAuL;SAC1L;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,oIAAoI,CAAC;QAC9I,KAAK,UAAU;YACb,OAAO,wNAAwN,CAAC;QAClO,KAAK,QAAQ;YACX,OAAO,8IAA8I,CAAC;IAC1J,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAgB,EAChB,IAAU,EACV,OAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,2BAA2B,CAAC;IAChC,MAAM,YAAY,GAAG,OAAO;QAC1B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,yBAAyB,CAAC;IAC9B,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,UAAU,GAAG,0BAA0B,OAAO;;;CAGrD,CAAC;IACA,MAAM,cAAc,GAAG,GAAG,CAAC;IAC3B,OAAO,kBAAkB,SAAS;;;UAG1B,WAAW;;;;;;;EAOnB,OAAO;;;;EAIP,IAAI;;EAEJ,YAAY,CAAC,IAAI,CAAC;;;;uDAImC,gBAAgB;;sCAEjC,WAAW;;EAE/C,UAAU,GAAG,cAAc,+BAA+B,UAAU;UAC5D,YAAY;;;;;;;;;;;;;;;;;EAiBpB,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;YACT,IAAI;eACD,OAAO;;;;;;CAMrB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAIhD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,uDAAuD,OAAO,GAAG,qCAAqC;SACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,qDAAqD,IAAI,CAAC,SAAS,CACnG,GAAG,CACJ,cAAc,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,EAAE,WAAW,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,mBAAmB;SAC7B;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,aAAa,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,YAAY,GAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACxD,IAAI,aAAa,CAAC,WAAW;QAC3B,YAAY,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;IAEvD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"understanding-before-execution.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/understanding-before-execution.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,wCAAwC;AAExC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAM9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,MAAM,CAAC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAE1D,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,oBAAoB;IACpB,WAAW;CACZ,CAAC;AAIF,MAAM,KAAK,GAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,YAAY,GAAS,UAAU,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAAU;IACzD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,wDAAwD;QAC1D,CAAC,CAAC,mDAAmD,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL;YACE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,+BAA+B;YACxC,WAAW,EACT,sLAAsL;SACzL;QACD;YACE,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,+BAA+B;YACxC,WAAW,EACT,mLAAmL;SACtL;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,OAAO;QACL,MAAM,EAAE,yCAAyC;QACjD,QAAQ,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC;QAClD,GAAG,EAAE;YACH,qTAAqT;YACrT,yUAAyU;SAC1U;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,UAAU;AACV,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AACpD,MAAM,wBAAwB,GAC5B,4DAA4D,CAAC;AAE/D,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,+BAA+B;AAC/B,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AACvE,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,yEAAyE;AACzE,sEAAsE;AACtE,iEAAiE;AACjE,yEAAyE;AACzE,mEAAmE;AACnE,0BAA0B;AAC1B,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAErE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,yDAAyD;AACzD,kEAAkE;AAClE,8BAA8B;AAC9B,+EAA+E;AAC/E,yEAAyE;AACzE,8DAA8D;AAC9D,qEAAqE;AACrE,4DAA4D;AAC5D,8DAA8D;AAC9D,oEAAoE;AACpE,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,iEAAiE;AACjE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,0DAA0D;AAC1D,MAAM,gCAAgC,GACpC,4CAA4C,CAAC;AAC/C,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAC1D,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAC1E,MAAM,2BAA2B,GAAG,uCAAuC,CAAC;AAE5E,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAmC,CAAC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,mBAAqD,CAAC;SAC3D,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC;QACN,iEAAiE;QACjE,mDAAmD;QACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;QACrC,4DAA4D;QAC5D,wDAAwD;QACxD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,4DAA4D;IAC5D,kEAAkE;IAClE,2DAA2D;IAC3D,0CAA0C;IAC1C,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AA+BZ;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAe,EACf,UAA8B;IAE9B,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAChC,OAAO,GAAG,eAAe,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB;IAI1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,IAAI,qCAAqC,IAAI,CAAC,SAAS,CAC1F,GAAG,CACJ,sBAAsB,YAAY,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,iDAAiD;AACjD,MAAM,4BAA4B,GAA0B;IAC1D,+BAA+B;IAC/B,gCAAgC;IAChC,uCAAuC;IACvC,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,uDAAuD;IACvD,oCAAoC;CACrC,CAAC;AAEF,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAEvE,iEAAiE;AACjE,qEAAqE;AACrE,iEAAiE;AACjE,uEAAuE;AACvE,kEAAkE;AAClE,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AAE1E,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,wBAAwB,GAC5B,oIAAoI,CAAC;AAEvI,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,8EAA8E;AAC9E,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,kEAAkE;AAClE,MAAM,8BAA8B,GAClC,8HAA8H,CAAC;AAEjI,uEAAuE;AACvE,mEAAmE;AACnE,gEAAgE;AAChE,mEAAmE;AACnE,yBAAyB;AACzB,MAAM,mBAAmB,GACvB,mGAAmG,CAAC;AAEtG,mEAAmE;AACnE,oEAAoE;AACpE,MAAM,yBAAyB,GAC7B,6FAA6F,CAAC;AAEhG,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEhE,4DAA4D;AAC5D,oEAAoE;AACpE,+CAA+C;AAC/C,6CAA6C;AAC7C,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,mFAAmF;AACnF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,qBAAqB,GAA0B,aAAa,CAAC;AAEnE;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB,CAC9B,KAA4B,EAC5B,WAAoB;IAEpB,MAAM,OAAO,GACX,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnD,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,qBAAqB,CAAC;QACnC,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,SAAS,4BAA4B,CACnC,KAA4B,EAC5B,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC;IACV,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAIhD,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CAAC;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,4DAA4D;IAC5D,2CAA2C;IAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CACvB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,kCAAkC,CAAC,IAAgB;IAC1D,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAeD;;;;;;;;;;;GAWG;AACH,SAAS,4BAA4B,CAAC,IAAgB;IACpD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,IAAI,cAAc,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAgB,EAChB,IAAgB,EAChB,OAA2B,EAAE;IAE7B,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,EAAE;IACF,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CACnC,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,IAAI,EAAE,GAAG,gBAAgB,2BAA2B;gBACpD,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,gCAAgC;gBACzC,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,sGAAsG;aACzG;YACD;gBACE,IAAI,EAAE,GAAG,gBAAgB,aAAa;gBACtC,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC;gBACjC,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,4IAA4I;aAC/I;YACD;gBACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;gBAC9C,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC;gBACzC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,4LAA4L;aAC/L;YACD,4DAA4D;YAC5D,8DAA8D;YAC9D,+DAA+D;YAC/D,wDAAwD;YACxD,4DAA4D;YAC5D,uDAAuD;YACvD,kEAAkE;YAClE,4DAA4D;YAC5D,8DAA8D;YAC9D,qCAAqC;YACrC,4DAA4D;YAC5D,4DAA4D;YAC5D,iEAAiE;YACjE,+DAA+D;YAC/D,kEAAkE;YAClE,sDAAsD;YACtD,0DAA0D;YAC1D,6DAA6D;YAC7D,iEAAiE;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,+CAA+C;YAC/C,GAAG,CAAC,GAAW,EAAE;gBACf,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;gBAC3E,IAAI,CAAC,IAAI;oBAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAS;oBACjB,IAAI,EAAE,GAAG,gBAAgB,sBAAsB;oBAC/C,KAAK,EAAE,aAAa;oBACpB,KAAK,EAAE,4BAA4B,CAAC,KAAK,EAAE,cAAc,CAAC;oBAC1D,OAAO,EAAE,IAAI,CAAC,2BAA2B,CAAC;oBAC1C,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,IAAI;oBACf,WAAW,EACT,qRAAqR;iBACxR,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,EAAE;YACJ,6DAA6D;YAC7D,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,6DAA6D;YAC7D,iEAAiE;YACjE,yCAAyC;YACzC;gBACE,IAAI,EAAE,GAAG,gBAAgB,2BAA2B;gBACpD,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,8BAA8B;gBACrC,OAAO,EAAE,0BAA0B;gBACnC,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,6PAA6P;aAChQ;YACD,+DAA+D;YAC/D,gEAAgE;YAChE,yCAAyC;YACzC;gBACE,IAAI,EAAE,GAAG,gBAAgB,sBAAsB;gBAC/C,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,qBAAqB;gBAC9B,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,qPAAqP;aACxP;SACF,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,gBAAgB;IAChB,MAAM,cAAc,GAAG,OAAO,CAAC;IAC/B,MAAM,kBAAkB,GAAqB;QAC3C,oBAAoB;QACpB,WAAW;KACZ,CAAC;IACF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;YAC9C,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,6BAA6B;YACtC,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,kBAAkB;YACnC,WAAW,EACT,oHAAoH;SACvH;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,OAAO;YAChC,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,cAAc;YAC3B,eAAe,EAAE,kBAAkB;YACnC,WAAW,EACT,sHAAsH;SACzH;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,IAAI,CAAC,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EACT,kMAAkM;SACrM;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,wDAAwD;QACxD,0DAA0D;QAC1D,gEAAgE;QAChE,kDAAkD;QAClD,EAAE;QACF,oDAAoD;QACpD,mEAAmE;QACnE,qEAAqE;QACrE,+DAA+D;QAC/D,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,gDAAgD;QAChD,oDAAoD;QACpD,GAAG,CAAC,GAAW,EAAE;YACf,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,GAAS;gBACjB,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;gBACzC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;gBACrD,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,4DAA4D;gBAC5D,OAAO,EAAE,IAAI,CAAC,4BAA4B,CAAC;gBAC3C,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,IAAI;gBACf,WAAW,EACT,qQAAqQ;aACxQ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,EAAE;QACJ,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,6DAA6D;QAC7D,+CAA+C;QAC/C;YACE,IAAI,EAAE,GAAG,gBAAgB,qBAAqB;YAC9C,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,0BAA0B;YACnC,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,kNAAkN;SACrN;QACD,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,6DAA6D;QAC7D,kEAAkE;QAClE,sDAAsD;QACtD;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,uLAAuL;SAC1L;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,oIAAoI,CAAC;QAC9I,KAAK,UAAU;YACb,OAAO,wNAAwN,CAAC;QAClO,KAAK,QAAQ;YACX,OAAO,8IAA8I,CAAC;IAC1J,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAgB,EAChB,IAAU,EACV,OAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,6BAA6B,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,2BAA2B,CAAC;IAChC,MAAM,YAAY,GAAG,OAAO;QAC1B,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,yBAAyB,CAAC;IAC9B,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,UAAU,GAAG,0BAA0B,OAAO;;;CAGrD,CAAC;IACA,MAAM,cAAc,GAAG,GAAG,CAAC;IAC3B,OAAO,kBAAkB,SAAS;;;UAG1B,WAAW;;;;;;;EAOnB,OAAO;;;;EAIP,IAAI;;EAEJ,YAAY,CAAC,IAAI,CAAC;;;;uDAImC,gBAAgB;;sCAEjC,WAAW;;EAE/C,UAAU,GAAG,cAAc,+BAA+B,UAAU;UAC5D,YAAY;;;;;;;;;;;;;;;;;EAiBpB,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;YACT,IAAI;eACD,OAAO;;;;;;CAMrB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB;IAIhD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,uDAAuD,OAAO,GAAG,qCAAqC;SACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,qDAAqD,IAAI,CAAC,SAAS,CACnG,GAAG,CACJ,cAAc,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,EAAE,WAAW,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,mBAAmB;SAC7B;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,aAAa,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,YAAY,GAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACxD,IAAI,aAAa,CAAC,WAAW;QAC3B,YAAY,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;IAEvD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}

package/dist/policy-packs/registry.d.ts

@@ -1,5 +1,5 @@
 import type { z } from "zod";
-import type { PolicyPack } from "../schema/index.js";
+import type { PolicyPack, PolicyUx, Producer } from "../schema/index.js";
 import { type ResolvePackOptions } from "./builtin/understanding-before-execution.js";
 import { type Runtime } from "./runtime.js";
 import type { PackContribution } from "./types.js";
@@ -30,3 +30,24 @@ export declare function resolveBuiltinConfigSchema(packName: string): z.ZodTypeA
  * `min_version` floor.
  */
 export declare function resolveBuiltinVersionCommand(packName: string): readonly [string, string] | null;
+/**
+ * The shipped-template `config.ux` / `config.producers` for a builtin pack,
+ * as the operator's OWN pack entry would resolve them today (e.g. `ux`'s
+ * `required:` line is derived from the pack's currently-configured `mode`,
+ * not a hardcoded default mode — an operator on `strict` should be
+ * compared against, and reseeded with, the `strict` wording, not
+ * `grill_me`'s).
+ *
+ * Returns `null` when the pack name is not a builtin, or when the pack
+ * has no canonical shipped default to compare/reseed against (e.g.
+ * `solution-acceptance`, which ships `enabled: false` with no `config:`
+ * block in any init template). Consumed by `checkPolicyPackUxDrift`
+ * (`harness doctor`'s divergence warning) and `harness pack reseed`
+ * (task 68b9ad9c) — the single source both read from so the two stay
+ * in lockstep by construction.
+ */
+export interface BuiltinDefaultConfig {
+    ux?: PolicyUx;
+    producers?: Producer[];
+}
+export declare function resolveBuiltinDefaultConfig(pack: PolicyPack): BuiltinDefaultConfig | null;

package/dist/policy-packs/registry.js

@@ -4,8 +4,8 @@
 // builtins are added by appending to `KNOWN_BUILTIN_PACKS` and a case
 // arm in `resolveBuiltin()`. Non-builtin sources (path/npm/git) are
 // out of scope for v1; their resolution lands in a later sub-task.
-import { configSchema as branchProtectionConfigSchema, PACK_NAME as BRANCH_PROTECTION, resolve as resolveBranchProtection, } from "./builtin/branch-protection.js";
-import { configSchema as understandingBeforeExecutionConfigSchema, PACK_NAME as UNDERSTANDING_BEFORE_EXECUTION, resolve as resolveUnderstandingBeforeExecution, VERSION_COMMAND as UNDERSTANDING_BEFORE_EXECUTION_VERSION_COMMAND, } from "./builtin/understanding-before-execution.js";
+import { configSchema as branchProtectionConfigSchema, defaultUx as branchProtectionDefaultUx, PACK_NAME as BRANCH_PROTECTION, resolve as resolveBranchProtection, } from "./builtin/branch-protection.js";
+import { configSchema as understandingBeforeExecutionConfigSchema, defaultProducers as understandingBeforeExecutionDefaultProducers, defaultUx as understandingBeforeExecutionDefaultUx, PACK_NAME as UNDERSTANDING_BEFORE_EXECUTION, resolve as resolveUnderstandingBeforeExecution, resolveMode as resolveUnderstandingBeforeExecutionMode, VERSION_COMMAND as UNDERSTANDING_BEFORE_EXECUTION_VERSION_COMMAND, } from "./builtin/understanding-before-execution.js";
 import { configSchema as solutionAcceptanceConfigSchema, PACK_NAME as SOLUTION_ACCEPTANCE, resolve as resolveSolutionAcceptance, } from "./builtin/solution-acceptance.js";
 import { DEFAULT_RUNTIME } from "./runtime.js";
 export const KNOWN_BUILTIN_PACKS = [
@@ -71,4 +71,21 @@ export function resolveBuiltinVersionCommand(packName) {
             return null;
     }
 }
+export function resolveBuiltinDefaultConfig(pack) {
+    if (!isBuiltinPackName(pack.name))
+        return null;
+    switch (pack.name) {
+        case UNDERSTANDING_BEFORE_EXECUTION: {
+            const { mode } = resolveUnderstandingBeforeExecutionMode(pack);
+            return {
+                ux: understandingBeforeExecutionDefaultUx(mode),
+                producers: understandingBeforeExecutionDefaultProducers(),
+            };
+        }
+        case BRANCH_PROTECTION:
+            return { ux: branchProtectionDefaultUx() };
+        case SOLUTION_ACCEPTANCE:
+            return null;
+    }
+}
 //# sourceMappingURL=registry.js.map

package/dist/policy-packs/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/policy-packs/registry.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AAInE,OAAO,EACL,YAAY,IAAI,4BAA4B,EAC5C,SAAS,IAAI,iBAAiB,EAC9B,OAAO,IAAI,uBAAuB,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,IAAI,wCAAwC,EACxD,SAAS,IAAI,8BAA8B,EAC3C,OAAO,IAAI,mCAAmC,EAC9C,eAAe,IAAI,8CAA8C,GAElE,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,YAAY,IAAI,8BAA8B,EAC9C,SAAS,IAAI,mBAAmB,EAChC,OAAO,IAAI,yBAAyB,GACrC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,8BAA8B;IAC9B,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAGX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,IAAI,CAAC,IAAuB,EAAE,CAAC;QACrC,KAAK,8BAA8B;YACjC,OAAO,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,iBAAiB;YACpB,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,mBAAmB;YACtB,OAAO,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,wCAAwC,CAAC;QAClD,KAAK,iBAAiB;YACpB,OAAO,4BAA4B,CAAC;QACtC,KAAK,mBAAmB;YACtB,OAAO,8BAA8B,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,8CAA8C,CAAC;QACxD,KAAK,iBAAiB;YACpB,OAAO,IAAI,CAAC;QACd,KAAK,mBAAmB;YACtB,oEAAoE;YACpE,sDAAsD;YACtD,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/policy-packs/registry.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AAInE,OAAO,EACL,YAAY,IAAI,4BAA4B,EAC5C,SAAS,IAAI,yBAAyB,EACtC,SAAS,IAAI,iBAAiB,EAC9B,OAAO,IAAI,uBAAuB,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,IAAI,wCAAwC,EACxD,gBAAgB,IAAI,4CAA4C,EAChE,SAAS,IAAI,qCAAqC,EAClD,SAAS,IAAI,8BAA8B,EAC3C,OAAO,IAAI,mCAAmC,EAC9C,WAAW,IAAI,uCAAuC,EACtD,eAAe,IAAI,8CAA8C,GAElE,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,YAAY,IAAI,8BAA8B,EAC9C,SAAS,IAAI,mBAAmB,EAChC,OAAO,IAAI,yBAAyB,GACrC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,8BAA8B;IAC9B,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAGX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,IAAI,CAAC,IAAuB,EAAE,CAAC;QACrC,KAAK,8BAA8B;YACjC,OAAO,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,iBAAiB;YACpB,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,mBAAmB;YACtB,OAAO,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,wCAAwC,CAAC;QAClD,KAAK,iBAAiB;YACpB,OAAO,4BAA4B,CAAC;QACtC,KAAK,mBAAmB;YACtB,OAAO,8BAA8B,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,8CAA8C,CAAC;QACxD,KAAK,iBAAiB;YACpB,OAAO,IAAI,CAAC;QACd,KAAK,mBAAmB;YACtB,oEAAoE;YACpE,sDAAsD;YACtD,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD,MAAM,UAAU,2BAA2B,CACzC,IAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,IAAI,CAAC,IAAuB,EAAE,CAAC;QACrC,KAAK,8BAA8B,CAAC,CAAC,CAAC;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,uCAAuC,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO;gBACL,EAAE,EAAE,qCAAqC,CAAC,IAAI,CAAC;gBAC/C,SAAS,EAAE,4CAA4C,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,KAAK,iBAAiB;YACpB,OAAO,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,CAAC;QAC7C,KAAK,mBAAmB;YACtB,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/policy-packs/ux-compare.d.ts

@@ -0,0 +1,14 @@
+import type { PolicyUx, Producer } from "../schema/index.js";
+export declare function uxEqual(a: PolicyUx, b: PolicyUx): boolean;
+/**
+ * Structural equality over a `producers:` array. Compares each entry
+ * field-by-field per its discriminated `kind` rather than a generic deep
+ * equal — the shape is small and fixed (bash/mcp/ask), and this keeps the
+ * comparison legible instead of round-tripping through JSON.stringify
+ * (which would also be sensitive to incidental key ordering).
+ */
+export declare function producersEqual(a: readonly Producer[], b: readonly Producer[]): boolean;
+/** Parses an unknown `config.ux` value; returns null on any schema rejection. */
+export declare function safeParseUx(raw: unknown): PolicyUx | null;
+/** Parses an unknown `config.producers` value; returns null on any schema rejection. */
+export declare function safeParseProducers(raw: unknown): Producer[] | null;

package/dist/policy-packs/ux-compare.js

@@ -0,0 +1,58 @@
+// Structural comparison + safe-parse helpers for `config.ux` /
+// `config.producers` (task 68b9ad9c). Shared by `checkPolicyPackUxDrift`
+// (the `harness doctor` read-side warning, ux-drift-check.ts) and
+// `harness pack reseed` (the opt-in write-side fix, src/cli/pack/reseed.ts)
+// so the two can never independently drift on what "matches the shipped
+// template" means.
+import { z } from "zod";
+import { PolicyUxSchema, ProducerSchema } from "../schema/policies.js";
+const ProducersArraySchema = z.array(ProducerSchema);
+function stringArrayEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return a.every((v, i) => v === b[i]);
+}
+export function uxEqual(a, b) {
+    return (a.cannot === b.cannot &&
+        stringArrayEqual(a.required, b.required) &&
+        stringArrayEqual(a.run, b.run));
+}
+/**
+ * Structural equality over a `producers:` array. Compares each entry
+ * field-by-field per its discriminated `kind` rather than a generic deep
+ * equal — the shape is small and fixed (bash/mcp/ask), and this keeps the
+ * comparison legible instead of round-tripping through JSON.stringify
+ * (which would also be sensitive to incidental key ordering).
+ */
+export function producersEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return a.every((entryA, i) => {
+        const entryB = b[i];
+        if (!entryB || entryA.kind !== entryB.kind)
+            return false;
+        if (entryA.kind === "bash" && entryB.kind === "bash") {
+            return entryA.command === entryB.command && entryA.description === entryB.description;
+        }
+        if (entryA.kind === "ask" && entryB.kind === "ask") {
+            return entryA.command === entryB.command && entryA.description === entryB.description;
+        }
+        if (entryA.kind === "mcp" && entryB.kind === "mcp") {
+            return (entryA.verb === entryB.verb &&
+                entryA.example === entryB.example &&
+                entryA.description === entryB.description);
+        }
+        return false;
+    });
+}
+/** Parses an unknown `config.ux` value; returns null on any schema rejection. */
+export function safeParseUx(raw) {
+    const result = PolicyUxSchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+/** Parses an unknown `config.producers` value; returns null on any schema rejection. */
+export function safeParseProducers(raw) {
+    const result = ProducersArraySchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+//# sourceMappingURL=ux-compare.js.map