@lannguyensi/harness 0.40.0 → 0.42.0

package/dist/cli/pack/hook-post-merge-gate.js

@@ -0,0 +1,244 @@
+// `harness pack hook post-merge-gate` — PreToolUse blocker for the
+// `post-merge-gate` policy pack.
+//
+// Receives Claude Code's PreToolUse event JSON on stdin and emits a
+// `{ decision: "block" }` envelope when a CURATED history-mutating Bash
+// command is about to run on a branch whose current tip exactly matches
+// a merged-tip fact the producer recorded (see hook-post-merge-gate-record.ts).
+//
+// Evaluation order — deliberate, and pinned by the self-lock test suite:
+//
+//   1. Parse stdin. Malformed JSON, a non-Bash tool, or an empty command
+//      all ALLOW immediately (nothing to classify).
+//   2. Pause sentinel (operator kill-switch) — same convention as every
+//      other pack hook.
+//   3. ESCAPE ALLOWLIST — checked BEFORE manifest load, pack lookup, or
+//      any ledger query. `git switch`/`checkout`/`pull`/`fetch`,
+//      `git branch -d`/`-D`, `git stash list`/`show`, and any
+//      `harness ...` command ALWAYS pass, unconditionally, with NO
+//      dependency on whether the manifest or the ledger are reachable.
+//      This is the recovery path the deny message itself recommends; it
+//      must never be starved by an unrelated failure (the incident class
+//      this guards against: a different gate once got blocked alongside
+//      its own recovery command, and only the operator could unstick it).
+//   4. CURATED MUTATION MATCH — commands outside the curated list
+//      (git commit/add/push/merge/rebase/cherry-pick/revert/reset/
+//      stash pop|apply, gh pr create/merge) pass through untouched.
+//   5. Manifest load, pack-enabled check, git-context resolution
+//      (detached HEAD / no-repo ALLOWS — nothing to compare), then the
+//      ledger query.
+//   6. DENY only when the current branch tip exactly matches a recorded
+//      `post-merge-gate:merged:<repo>:<branch>:<sha>` fact.
+//
+// Fail posture: OPEN. A manifest-load failure or a degraded ledger both
+// ALLOW (with a stderr warning) — the inverse of branch-protection's
+// fail-closed contract. Without the ledger, "merged" and "not merged" are
+// indistinguishable, and fail-closed here would block ordinary git
+// history work on every branch whenever grounding-mcp hiccups. See
+// post-merge-gate-runtime.ts's header for the full rationale.
+import { isCuratedMutationCommand, isEscapeCommand, MERGED_TAG_PREFIX, mergedTagMatchKey, PACK_NAME, resolveDefaultBranchName, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
+import { queryLedgerByTag } from "../../policies/index.js";
+import { resolveGitContext } from "../../runtime/git-context.js";
+import { renderAgentFacing } from "../../runtime/agent-facing.js";
+import { POLICY_DECISION_TYPE } from "../../runtime/ledger-record.js";
+import { checkHookPause, loadManifestOrInjected, parseConfigUx, readStdin } from "./hook-bootstrap.js";
+const DEFAULT_BRANCH_PLACEHOLDER = "<default-branch>";
+function bashCommandOf(toolInput) {
+    if (typeof toolInput !== "object" || toolInput === null)
+        return "";
+    const cmd = toolInput["command"];
+    return typeof cmd === "string" ? cmd : "";
+}
+function findGroundingMcp(manifest) {
+    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
+}
+function evaluateEntries(entries, matchKey) {
+    for (const e of entries) {
+        // Skip policy_decision audit rows — a past DENIED decision this very
+        // pack recorded would otherwise incidentally carry the match key in
+        // its serialized payload, falsely satisfying itself. Same two-tier
+        // filter branch-protection's blocker uses (type first, legacy
+        // content-prefix backstop second).
+        if (e.type === POLICY_DECISION_TYPE)
+            continue;
+        if (e.content.startsWith(`${POLICY_DECISION_TYPE}:`))
+            continue;
+        if (e.content.includes(matchKey)) {
+            return { merged: true, matchedContent: e.content, degraded: null };
+        }
+    }
+    return { merged: false, matchedContent: null, degraded: null };
+}
+async function probeLedger(manifest, sessionId, matchKey, opts) {
+    if (opts.ledgerQuery) {
+        const r = await opts.ledgerQuery(sessionId);
+        if ("degraded" in r) {
+            return { merged: false, matchedContent: null, degraded: r.degraded };
+        }
+        return evaluateEntries(r, matchKey);
+    }
+    if (!manifest) {
+        return { merged: false, matchedContent: null, degraded: "manifest unavailable" };
+    }
+    const server = findGroundingMcp(manifest);
+    if (!server) {
+        return { merged: false, matchedContent: null, degraded: "grounding-mcp not declared in manifest" };
+    }
+    const command = Array.isArray(server.command)
+        ? server.command
+        : server.command.trim().split(/\s+/);
+    const env = server.env ?? undefined;
+    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
+    const result = await queryLedgerByTag({
+        mcpCommand: command,
+        ...(env && { mcpEnv: env }),
+        sessionId,
+        timeoutMs,
+    });
+    if (result.kind === "degraded") {
+        return { merged: false, matchedContent: null, degraded: result.reason };
+    }
+    return evaluateEntries(result.entries, matchKey);
+}
+function blockJson(toolName, command, branch, defaultBranch, matchedContent, ux, sessionId) {
+    let reasonText;
+    if (ux) {
+        reasonText = renderAgentFacing(ux, {
+            BRANCH: branch,
+            DEFAULT_BRANCH: defaultBranch,
+            TOOL_NAME: toolName,
+            SESSION_ID: sessionId,
+        });
+    }
+    else {
+        reasonText =
+            `post-merge-gate: refusing ${toolName} ("${command}") on branch "${branch}" — ` +
+                `its current tip was already merged (recorded: ${matchedContent}).\n` +
+                `Further history-mutating commands on an already-merged branch usually mean stale local state.\n` +
+                `\n` +
+                `To proceed:\n` +
+                `  git switch ${defaultBranch}\n` +
+                `  git pull --ff-only\n` +
+                `  git branch -d ${branch}   # optional cleanup\n` +
+                `\n` +
+                `If you have NEW work to continue on this branch (not leftover local state): make a commit first —` +
+                ` this gate only fires while the branch tip still exactly matches the merged commit, so a new commit` +
+                ` moves the tip and this check no longer applies.\n` +
+                `\n` +
+                `Escape hatches (always allowed, independent of this gate): git switch/checkout, git pull/fetch,` +
+                ` git branch -d/-D, git stash list/show, and any \`harness ...\` command.`;
+    }
+    return JSON.stringify({
+        decision: "block",
+        reason: reasonText,
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: reasonText,
+        },
+    });
+}
+export async function runPackHookPostMergeGateCli(opts = {}) {
+    const stdin = opts.stdin ?? process.stdin;
+    const stdout = opts.stdout ?? process.stdout;
+    const stderr = opts.stderr ?? process.stderr;
+    const note = (msg) => {
+        stderr.write(`harness pack hook post-merge-gate: ${msg}\n`);
+    };
+    const raw = await readStdin(stdin);
+    let event = {};
+    try {
+        event = JSON.parse(raw.trim() || "{}");
+    }
+    catch {
+        const diagnostic = "malformed event JSON, cannot classify; allowing";
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // Pause sentinel — even this gate yields to an operator pause.
+    if (checkHookPause(PACK_NAME, stderr, opts).paused) {
+        const diagnostic = "harness paused; post-merge-gate allowing without evaluating.";
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const sessionId = (typeof event.session_id === "string" ? event.session_id : undefined) ??
+        process.env.CLAUDE_CODE_SESSION_ID ??
+        process.env.CLAUDE_SESSION_ID ??
+        "";
+    const toolName = typeof event.tool_name === "string" ? event.tool_name : "(unknown)";
+    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
+        ? opts.cwd
+        : typeof event.cwd === "string" && event.cwd.length > 0
+            ? event.cwd
+            : process.cwd();
+    if (toolName !== "Bash") {
+        const diagnostic = `${toolName} is not Bash; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const command = bashCommandOf(event.tool_input);
+    if (command === "") {
+        const diagnostic = "no resolvable command text; allowing";
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // ESCAPE ALLOWLIST — checked FIRST, unconditionally, before manifest
+    // load, pack lookup, or any ledger query. See module header.
+    if (isEscapeCommand(command)) {
+        const diagnostic = `escape command matched; allowing regardless of ledger/manifest state`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!isCuratedMutationCommand(command)) {
+        const diagnostic = `command is not in the curated v1 deny-scope; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // Fail-open manifest load (opposite of branch-protection's fail-closed):
+    // without the manifest we cannot tell if the pack is even enabled, and
+    // this pack's whole posture is advisory, not a hard security boundary.
+    let manifest;
+    try {
+        ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
+    }
+    catch (err) {
+        const diagnostic = `manifest load failed (${err.message}); post-merge-gate fails open, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const pack = manifest.policy_packs.find((p) => p.name === PACK_NAME);
+    if (!pack) {
+        const diagnostic = `pack "${PACK_NAME}" not declared in manifest, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!pack.enabled) {
+        const diagnostic = `pack "${PACK_NAME}" is enabled:false, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const { repo, branch, sha } = resolveGitContext(cwd);
+    if (branch === "" || sha === "" || repo === "") {
+        const diagnostic = `cannot resolve git context for ${cwd} (detached HEAD, outside a git work tree, or unresolvable sha); allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const configUx = parseConfigUx(pack.config["ux"], stderr, "harness pack hook post-merge-gate");
+    const matchKey = mergedTagMatchKey(repo, branch, sha);
+    const check = await probeLedger(manifest, sessionId, matchKey, opts);
+    if (check.degraded !== null) {
+        const diagnostic = `ledger degraded (${check.degraded}); post-merge-gate fails open, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!check.merged) {
+        const diagnostic = `no recorded ${MERGED_TAG_PREFIX} fact for ${repo}:${branch} at tip ${sha.slice(0, 7)}; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const defaultBranch = resolveDefaultBranchName(cwd) ?? DEFAULT_BRANCH_PLACEHOLDER;
+    const diagnostic = `BLOCK — branch tip ${sha.slice(0, 7)} matches a recorded merged tip (${check.matchedContent ?? matchKey})`;
+    note(diagnostic);
+    stdout.write(`${blockJson(toolName, command, branch, defaultBranch, check.matchedContent ?? matchKey, configUx, sessionId)}\n`);
+    return { exitCode: 0, blocked: true, diagnostic };
+}
+//# sourceMappingURL=hook-post-merge-gate.js.map

package/dist/cli/pack/hook-post-merge-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-post-merge-gate.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,iCAAiC;AACjC,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,oDAAoD;AACpD,wEAAwE;AACxE,wBAAwB;AACxB,wEAAwE;AACxE,iEAAiE;AACjE,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,qBAAqB;AACrB,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,mEAAmE;AACnE,mEAAmE;AACnE,8DAA8D;AAE9D,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEvG,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAiCtD,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAQD,SAAS,eAAe,CAAC,OAAsB,EAAE,QAAgB;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,mCAAmC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyB,EACzB,SAAiB,EACjB,QAAgB,EAChB,IAAkC;IAElC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,wCAAwC,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,EAAwB,EACxB,SAAiB;IAEjB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,UAAU;YACR,6BAA6B,QAAQ,MAAM,OAAO,iBAAiB,MAAM,MAAM;gBAC/E,iDAAiD,cAAc,MAAM;gBACrE,iGAAiG;gBACjG,IAAI;gBACJ,eAAe;gBACf,gBAAgB,aAAa,IAAI;gBACjC,wBAAwB;gBACxB,mBAAmB,MAAM,yBAAyB;gBAClD,IAAI;gBACJ,mGAAmG;gBACnG,qGAAqG;gBACrG,oDAAoD;gBACpD,IAAI;gBACJ,iGAAiG;gBACjG,0EAA0E,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,iDAAiD,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,8DAA8D,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,QAAQ,wBAAwB,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,sCAAsC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,sEAAsE,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,uDAAuD,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,yCAAyC,CAAC;QAC5G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,SAAS,SAAS,sCAAsC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,SAAS,SAAS,8BAA8B,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,kCAAkC,GAAG,0EAA0E,CAAC;QACnI,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAC3B,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,EAC9C,MAAM,EACN,mCAAmC,CACpC,CAAC;IAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,oBAAoB,KAAK,CAAC,QAAQ,yCAAyC,CAAC;QAC/F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,eAAe,iBAAiB,aAAa,IAAI,IAAI,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QACrH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;IAClF,MAAM,UAAU,GAAG,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCAAmC,KAAK,CAAC,cAAc,IAAI,QAAQ,GAAG,CAAC;IAC/H,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAClH,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/cli/pack/hook-post-tool-use.js

@@ -20,71 +20,10 @@
 // is unapproved now" surface would be hostile. Worst case the marker
 // persists past the intended boundary, which degrades to the legacy
 // per-session contract.
-import { existsSync } from "node:fs";
-import { approvalMarkerPathFor, clearApprovalMarker, clearTaskApprovalMarker, defaultReportsDir, expirePersistedReport, parseApprovalLifecycle, taskApprovalMarkerPathFor, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { applyPostToolUseExpiry, defaultReportsDir, describePostToolUseExpiry, matchPostToolUseBoundary, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
 import { checkHookPause, loadManifestOrInjected, readStdin, } from "./hook-bootstrap.js";
 const PACK_NAME = "understanding-before-execution";
-// Match a tool name against one of the patterns. The pattern is a plain
-// tool name like `mcp__agent-tasks__task_finish`; wildcard expansion is
-// deliberately not supported in v1 so operators write what they mean.
-function toolMatches(toolName, patterns) {
-    for (const p of patterns) {
-        if (p === toolName)
-            return true;
-    }
-    return false;
-}
-// Match a Bash tool_input.command against the operator's regex list.
-// Patterns are pre-compiled by parseApprovalLifecycle, so invalid
-// regexes were dropped (with a warning) at parse time and we just
-// iterate here. Empty / missing command short-circuits to false.
-function bashCommandMatches(command, patterns) {
-    if (command === "")
-        return undefined;
-    for (const re of patterns) {
-        if (re.test(command))
-            return re;
-    }
-    return undefined;
-}
-function extractBashCommand(toolInput) {
-    if (typeof toolInput !== "object" ||
-        toolInput === null ||
-        Array.isArray(toolInput)) {
-        return "";
-    }
-    const command = toolInput["command"];
-    return typeof command === "string" ? command : "";
-}
-// Pull `taskId` out of an MCP tool_input payload. agent-tasks verbs that
-// mark a task boundary (`task_finish`, `task_abandon`, etc.) carry the
-// taskId as a top-level string field. When present, the post-tool-use
-// hook also clears the corresponding task-scoped approval marker
-// (harness/1ee26e77). Returns "" when absent / malformed.
-function extractTaskId(toolInput) {
-    if (typeof toolInput !== "object" ||
-        toolInput === null ||
-        Array.isArray(toolInput)) {
-        return "";
-    }
-    const tid = toolInput["taskId"];
-    return typeof tid === "string" ? tid : "";
-}
-// `tasks_transition` (v1) carries `status: "open" | "in_progress" | "review" | "done"`.
-// Only "done" releases the work claim (per task_finish docs); other values
-// keep the marker so the agent's continued work on the same task remains
-// approved. Returns "" for malformed / missing status; the caller treats
-// any non-"done" return as keep-claim.
-function extractTasksTransitionStatus(toolInput) {
-    if (typeof toolInput !== "object" ||
-        toolInput === null ||
-        Array.isArray(toolInput)) {
-        return "";
-    }
-    const s = toolInput["status"];
-    return typeof s === "string" ? s : "";
-}
 function noop(diagnostic, stderr) {
     stderr.write(`${diagnostic}\n`);
     return {
@@ -144,26 +83,13 @@ export async function runPackHookPostToolUseCli(opts = {}) {
     if (noBoundariesConfigured) {
         return noop(`harness pack hook post-tool-use: no expire_on_tool_match or expire_on_bash_match configured, skipping`, stderr);
     }
-    // tool-name match is the first filter; status-based refinement below
-    // catches the legacy v1 `tasks_transition` verb whose terminality
-    // depends on `tool_input.status` rather than on the tool name alone.
-    const rawToolNameMatched = toolMatches(toolName, lifecycle.expireOnToolMatch);
-    // Legacy v1 `tasks_transition`: only `status=done` releases the work
-    // claim (per task_finish docs: "The work claim is cleared when going
-    // to done and kept when going to review"). open / in_progress / review
-    // / missing status keep the marker so subsequent agent work on the
-    // same task continues to satisfy the gate.
-    const tasksTransitionStatusOk = toolName === "mcp__agent-tasks__tasks_transition"
-        ? extractTasksTransitionStatus(event.tool_input) === "done"
-        : true;
-    const toolNameMatched = rawToolNameMatched && tasksTransitionStatusOk;
-    // Bash check only runs when the event is actually a Bash call; an MCP
-    // tool whose name happens to match a regex is not a Bash boundary.
-    const bashRegex = toolName === "Bash"
-        ? bashCommandMatches(extractBashCommand(event.tool_input), lifecycle.expireOnBashMatch)
-        : undefined;
-    if (!toolNameMatched && bashRegex === undefined) {
-        const detail = !rawToolNameMatched
+    // tool-name / bash-command boundary match (shared with the Codex
+    // sibling hook via matchPostToolUseBoundary, task a1348c89). Bash
+    // check only runs when the event is actually a Bash call; an MCP tool
+    // whose name happens to match a regex is not a Bash boundary.
+    const boundary = matchPostToolUseBoundary(toolName, event.tool_input, lifecycle);
+    if (!boundary.matched) {
+        const detail = !boundary.rawToolNameMatched
             ? toolName === "Bash"
                 ? `Bash command did not match any expire_on_bash_match regex`
                 : `tool ${toolName} not in expire_on_tool_match`
@@ -180,60 +106,19 @@ export async function runPackHookPostToolUseCli(opts = {}) {
     if (generatedDir === undefined) {
         return noop("harness pack hook post-tool-use: generatedDir unresolvable, skipping marker expiry", stderr);
     }
-    // The marker may already be absent (operator revoked, prior expiry).
-    // Always log the attempt so the diagnostic trail names the boundary
-    // tool; the markerCleared flag distinguishes the two paths.
-    // clearApprovalMarker swallows errors and uses force:true, so we
-    // probe the marker path first to set markerCleared accurately.
-    const markerPath = approvalMarkerPathFor(generatedDir, sessionId);
-    const wasPresent = existsSync(markerPath);
-    clearApprovalMarker(generatedDir, sessionId);
-    // Task-scoped marker cleanup (harness/1ee26e77). Only when the
-    // matched tool is an MCP task-transition verb whose tool_input.taskId
-    // names a specific task; Bash regex boundaries don't carry a taskId
-    // by design.
-    let taskMarkerCleared = false;
-    let clearedTaskId = "";
-    if (toolNameMatched) {
-        const taskId = extractTaskId(event.tool_input);
-        if (taskId !== "") {
-            const taskMarkerPath = taskApprovalMarkerPathFor(generatedDir, taskId);
-            if (existsSync(taskMarkerPath)) {
-                clearTaskApprovalMarker(generatedDir, taskId);
-                taskMarkerCleared = true;
-                clearedTaskId = taskId;
-            }
-        }
-    }
-    // Persisted-report expiry (harness/1ee26e77 follow-up). Closes the
-    // silent bypass that existed since PR #172: marker-deletion alone
-    // did not invalidate the persisted-report fallback the gate consults
-    // when the marker is absent, so the next Edit/Write/Bash silently
-    // re-approved via the report even though the marker had just been
-    // expired. Best-effort; a missing reports dir or unrelated read
-    // failure is logged but does not break the hook.
+    // Clear the session marker, the task-scoped marker (when applicable),
+    // and expire the persisted report — same side effects the Codex
+    // sibling hook applies via the shared `applyPostToolUseExpiry`.
     const reportsDir = opts.reportsDir ?? defaultReportsDir();
-    const reportExpiry = expirePersistedReport(reportsDir, sessionId, opts.now);
-    const persistedReportExpired = reportExpiry.ok;
-    const matchSource = bashRegex !== undefined
-        ? `bash regex /${bashRegex.source}/`
-        : `tool name`;
-    const taskNote = taskMarkerCleared
-        ? `; also cleared task marker for task ${clearedTaskId}`
-        : "";
-    const reportNote = reportExpiry.ok
-        ? `; expired persisted report ${reportExpiry.filePath}`
-        : `; persisted-report expiry skipped (${reportExpiry.reason})`;
-    const diagnostic = wasPresent
-        ? `harness pack hook post-tool-use: expired approval marker for session ${sessionId} after ${toolName} (${matchSource})${taskNote}${reportNote}`
-        : `harness pack hook post-tool-use: ${toolName} matched ${matchSource} but no marker present for session ${sessionId}${taskNote}${reportNote}`;
+    const expiry = applyPostToolUseExpiry(generatedDir, sessionId, event.tool_input, boundary.toolNameMatched, reportsDir, opts.now);
+    const diagnostic = describePostToolUseExpiry("harness pack hook post-tool-use", sessionId, toolName, boundary.bashRegex, expiry);
     stderr.write(`${diagnostic}\n`);
     return {
         exitCode: 0,
         matchedExpiry: true,
-        markerCleared: wasPresent,
-        taskMarkerCleared,
-        persistedReportExpired,
+        markerCleared: expiry.wasMarkerPresent,
+        taskMarkerCleared: expiry.taskMarkerCleared,
+        persistedReportExpired: expiry.persistedReportExpired,
         diagnostic,
     };
 }

package/dist/cli/pack/hook-post-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAkDnD,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,WAAW,CAAC,QAAgB,EAAE,QAA2B;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAA2B;IACtE,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAkB;IAC5C,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAClE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,iEAAiE;AACjE,0DAA0D;AAC1D,SAAS,aAAa,CAAC,SAAkB;IACvC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAI,SAAqC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,wFAAwF;AACxF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,uCAAuC;AACvC,SAAS,4BAA4B,CAAC,SAAkB;IACtD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAI,SAAqC,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CACT,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,gEAAgE,EAChE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uGAAuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9E,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,oCAAoC;QAC/C,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,MAAM;QAC3D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,eAAe,GAAG,kBAAkB,IAAI,uBAAuB,CAAC;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,SAAS,GACb,QAAQ,KAAK,MAAM;QACjB,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,iBAAiB,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,eAAe,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,kBAAkB;YAChC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACnB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B;YAClD,CAAC,CAAC,oDAAoD,CAAC;QACzD,OAAO,IAAI,CACT,oCAAoC,MAAM,YAAY,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,4DAA4D;IAC5D,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/B,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,sBAAsB,GAAG,YAAY,CAAC,EAAE,CAAC;IAE/C,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,uCAAuC,aAAa,EAAE;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE;QAChC,CAAC,CAAC,8BAA8B,YAAY,CAAC,QAAQ,EAAE;QACvD,CAAC,CAAC,sCAAsC,YAAY,CAAC,MAAM,GAAG,CAAC;IACjE,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,wEAAwE,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAChJ,CAAC,CAAC,oCAAoC,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;IACjJ,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,UAAU;QACzB,iBAAiB;QACjB,sBAAsB;QACtB,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,wBAAwB;AAExB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAkDnD,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CACT,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,gEAAgE,EAChE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uGAAuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB;YACzC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACnB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B;YAClD,CAAC,CAAC,oDAAoD,CAAC;QACzD,OAAO,IAAI,CACT,oCAAoC,MAAM,YAAY,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,sBAAsB,CACnC,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,UAAU,EAChB,QAAQ,CAAC,eAAe,EACxB,UAAU,EACV,IAAI,CAAC,GAAG,CACT,CAAC;IAEF,MAAM,UAAU,GAAG,yBAAyB,CAC1C,iCAAiC,EACjC,SAAS,EACT,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,MAAM,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.js

@@ -25,6 +25,7 @@ import { renderProducers } from "../../policies/producers.js";
 import { checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, matchLedgerEntries, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir, writePendingApproval, } from "../../runtime/pending-approval.js";
 import { isReadOnlyBashPipeline } from "../../runtime/read-only-bash.js";
+import { isRecoveryGitCommit } from "../../runtime/recovery-git-commit.js";
 import { ProducerSchema, } from "../../schema/index.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
 import { z } from "zod";
@@ -296,6 +297,23 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // which Edit / Write / Bash are all gated from writing to. Bail to
     // ledger-as-audit only when generatedDir is unresolvable (injected
     // manifest without a resolved path: only happens in tests).
+    //
+    // `markerExpired` is hoisted out of the block below so the
+    // recovery-git-commit exception (task 6e888423) further down can see
+    // it: it is true only when a REAL marker existed for this
+    // session/task and aged past `approval_lifecycle.max_age` — as
+    // opposed to no marker ever existing, or one cleared by a
+    // task-completion boundary tool. See understanding-before-execution-
+    // runtime.ts's `OperatorMarkerApproval.expired` doc for the full
+    // distinction.
+    let markerExpired = false;
+    // True when checkOperatorApprovalMarkers found a marker FILE that failed
+    // signature verification (harness/f9485cc7) — missing/invalid signature,
+    // wrong alg, or tampered payload — for either the task-scoped or
+    // session-scoped check. Surfaced in the block reason below with a
+    // distinct phrase from "no approval marker" so an operator/auditor can
+    // tell a forgery attempt apart from the routine "never approved" case.
+    let markerForged = false;
     if (generatedDir !== undefined) {
         // Source 1a/1b: task-scoped marker for the currently-claimed task
         // (harness/1ee26e77 + PR #198 correctness fix), then the
@@ -304,6 +322,8 @@ export async function runPackHookPreToolUseCli(opts = {}) {
         // hook (`checkOperatorApprovalMarkers`, task e7c2ec3c) so the two
         // runtimes cannot drift on lifecycle semantics again.
         const markers = checkOperatorApprovalMarkers(generatedDir, sessionId, declared.config, stderr);
+        markerExpired = markers.expired;
+        markerForged = markers.forged;
         if (markers.source !== "task") {
             // Trace the task-marker miss to stderr so an operator chasing
             // "why isn't my approval working?" sees the active-claim vs marker
@@ -343,9 +363,16 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // historic trail. The result intentionally does NOT influence the
     // allow/block decision.
     const ledger = await checkLedger(manifest, sessionId, opts);
-    // Neither operator source approved.
+    // Neither operator source approved. When a marker FILE existed but
+    // failed signature verification, use a distinct reason phrase
+    // ("forged/unsigned marker rejected") instead of the routine "no
+    // approval marker" — audit/operator surfaces can then tell an active
+    // forgery attempt (or a pre-signing legacy marker) apart from a session
+    // that simply never approved (harness/f9485cc7).
     const reason = generatedDir !== undefined
-        ? `no approval marker for session ${sessionId}; ${report.detail}; ${ledger.detail}`
+        ? markerForged
+            ? `forged/unsigned marker rejected for session ${sessionId}; ${report.detail}; ${ledger.detail}`
+            : `no approval marker for session ${sessionId}; ${report.detail}; ${ledger.detail}`
         : `generatedDir not resolvable (test/injection path); ${report.detail}; ${ledger.detail}`;
     // Stage the session id so `harness approve`, run from the operator's
     // shell where $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID is unset, can resolve it without
@@ -380,6 +407,31 @@ export async function runPackHookPreToolUseCli(opts = {}) {
             diagnostic,
         };
     }
+    // Exception: the narrow recovery-git-commit shape (task 6e888423,
+    // agent-grounding frictions #2/#9/#58/#71). `approval_lifecycle.max_age`
+    // can age out the marker mid-task — e.g. during a long reviewer-
+    // amendment loop — leaving the recovery `git commit` that consolidates
+    // ALREADY-approved Edit/Write output into a new HEAD hard-blocked
+    // behind an operator. Gated on BOTH conditions so this cannot become a
+    // generic bypass: `markerExpired` proves a real operator approval
+    // existed for this exact session/task and merely aged out (a marker
+    // that is simply absent, or one a task-completion boundary tool just
+    // cleared for a NEW task, leaves this false and the block below still
+    // applies), and `isRecoveryGitCommit` proves the command is a bare,
+    // unchained `git commit` that cannot smuggle other work or introduce
+    // new file content — see src/runtime/recovery-git-commit.ts for the
+    // full safety argument. Edit / Write / every other Bash shape remain
+    // hard-gated regardless.
+    if (toolName === "Bash" && markerExpired && isRecoveryGitCommit(commandStr)) {
+        const diagnostic = `harness pack hook: recovery-commit exemption — approval for session ${sessionId} had expired, but this session/task WAS previously approved; allowing the bare \`git commit\` to record already-approved work (\`${commandStr.trim()}\`). A fresh Understanding Report is still required for any new Edit/Write/Bash.`;
+        stderr.write(`${diagnostic}\n`);
+        return {
+            exitCode: 0,
+            blocked: false,
+            approvalCheck: { approved: true, source: "recovery-commit", detail: diagnostic },
+            diagnostic,
+        };
+    }
     // Exception: the operator-approval command itself. Hard-denying
     // `harness approve understanding` is a catch-22: it is the very command
     // that records the operator's go, and a Bash `deny` gives no prompt to

package/dist/cli/pack/hook-pre-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-pre-tool-use.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,yDAAyD;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EACL,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAoDnD,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,6DAA6D;AAC7D,8BAA8B;AAC9B,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,KAAK,CAAC,cAAc,CAAC;KACrB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAC1C,8GAA8G,CAC/G,CAAC;AAEJ,SAAS,oBAAoB,CAC3B,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,CAAC,KAAK,CAAC,MAAM;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,2EAA2E;AAC3E,8DAA8D;AAC9D,wEAAwE;AACxE,qEAAqE;AAErE,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,SAAiC,EACjC,EAAwB,EACxB,SAAiB,EACjB,UAA0B;IAE1B,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,sBAAsB;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,qGAAqG,CAAC;QACrH,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,UAAU,GAAG,uBAAuB,MAAM,WAAW,QAAQ,KAAK,MAAM,KAAK,UAAU,GAAG,cAAc,EAAE,CAAC;IAC7G,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,GAAG,GAAG,UAAU,OAAO,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,qBAAqB;AACrB,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,CACL,2FAA2F;QAC3F,gGAAgG;QAChG,kFAAkF;QAClF,+DAA+D;QAC/D,0DAA0D;QAC1D,iGAAiG;QACjG,+EAA+E;QAC/E,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kBAAkB;AAClB,SAAS,OAAO;IACd,MAAM,MAAM,GACV,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B,CAAC;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAA+B;IAE/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,qDACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACtD,CAAC,CAAE,KAAK,CAAC,UAAoC,CAAC,OAAO;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,2DAA2D,CAAC;QAC/E,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,4CAChB,GAAa,CAAC,OACjB,cAAc,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,4BAA4B,QAAQ,uCAAuC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,4BAA4B,QAAQ,+BAA+B,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,iHAAiH,CAAC;QACpH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,6BAA6B;IAC7B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,kEAAkE;QAClE,yDAAyD;QACzD,4DAA4D;QAC5D,oEAAoE;QACpE,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,8DAA8D;YAC9D,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,CAAC,yCAAyC,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,sBAAsB,OAAO,CAAC,MAAM,aAAa,CAAC;YACrE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC3E,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACpF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,oCAAoC;IACpC,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACnF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5F,qEAAqE;IACrE,4FAA4F;IAC5F,kEAAkE;IAClE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,0DAA0D;IAC1D,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,2DAA2D;IAC3D,wDAAwD;IACxD,8DAA8D;IAC9D,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,QAAQ,KAAK,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,qFAAqF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/H,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,QAAQ,KAAK,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,mGAAmG,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAClE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,MAAM,EAAE,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACzC,QAAQ,CAAC,MAAkC,CAAC,WAAW,CAAC,EACzD,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,mBAAmB,CACpB,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,mDAAmD,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAClI,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-pre-tool-use.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,yDAAyD;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EACL,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACL,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAoDnD,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,6DAA6D;AAC7D,8BAA8B;AAC9B,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,KAAK,CAAC,cAAc,CAAC;KACrB,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAC1C,8GAA8G,CAC/G,CAAC;AAEJ,SAAS,oBAAoB,CAC3B,GAAY,EACZ,MAA6B;IAE7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,CAAC,KAAK,CAAC,MAAM;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,2EAA2E;AAC3E,8DAA8D;AAC9D,wEAAwE;AACxE,qEAAqE;AAErE,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,SAAiC,EACjC,EAAwB,EACxB,SAAiB,EACjB,UAA0B;IAE1B,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,sBAAsB;IACtB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,qGAAqG,CAAC;QACrH,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,UAAU,GAAG,uBAAuB,MAAM,WAAW,QAAQ,KAAK,MAAM,KAAK,UAAU,GAAG,cAAc,EAAE,CAAC;IAC7G,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,GAAG,GAAG,UAAU,OAAO,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,qBAAqB;AACrB,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,CACL,2FAA2F;QAC3F,gGAAgG;QAChG,kFAAkF;QAClF,+DAA+D;QAC/D,0DAA0D;QAC1D,iGAAiG;QACjG,+EAA+E;QAC/E,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,kBAAkB;AAClB,SAAS,OAAO;IACd,MAAM,MAAM,GACV,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B,CAAC;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAA+B;IAE/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,qDACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACtD,CAAC,CAAE,KAAK,CAAC,UAAoC,CAAC,OAAO;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,2DAA2D,CAAC;QAC/E,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,4CAChB,GAAa,CAAC,OACjB,cAAc,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,4BAA4B,QAAQ,uCAAuC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,4BAA4B,QAAQ,+BAA+B,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,iHAAiH,CAAC;QACpH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,6BAA6B;IAC7B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,EAAE;IACF,2DAA2D;IAC3D,qEAAqE;IACrE,0DAA0D;IAC1D,+DAA+D;IAC/D,0DAA0D;IAC1D,qEAAqE;IACrE,iEAAiE;IACjE,eAAe;IACf,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,kEAAkE;IAClE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,kEAAkE;QAClE,yDAAyD;QACzD,4DAA4D;QAC5D,oEAAoE;QACpE,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,8DAA8D;YAC9D,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,CAAC,yCAAyC,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,sBAAsB,OAAO,CAAC,MAAM,aAAa,CAAC;YACrE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC3E,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,MAAM,CAAC,MAAM,aAAa,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACpF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,mEAAmE;IACnE,8DAA8D;IAC9D,iEAAiE;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,+CAA+C,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACrF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5F,qEAAqE;IACrE,4FAA4F;IAC5F,kEAAkE;IAClE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,0DAA0D;IAC1D,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,2DAA2D;IAC3D,wDAAwD;IACxD,8DAA8D;IAC9D,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,QAAQ,KAAK,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,qFAAqF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/H,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,yBAAyB;IACzB,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,uEAAuE,SAAS,oIAAoI,UAAU,CAAC,IAAI,EAAE,kFAAkF,CAAC;QAC3U,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;YAChF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,QAAQ,KAAK,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,mGAAmG,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAClE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,MAAM,EAAE,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,oBAAoB,CACzC,QAAQ,CAAC,MAAkC,CAAC,WAAW,CAAC,EACzD,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,mBAAmB,CACpB,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,mDAAmD,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAClI,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}