@lannguyensi/harness 0.40.0 → 0.42.0

package/dist/policy-packs/builtin/solution-acceptance-runtime.js

@@ -299,20 +299,35 @@ export function bashReferencesVerdictDir(command, dir) {
         (leaf.length >= 6 && command.includes(leaf))) {
         return true;
     }
-    // Glob-obscured references. bash expands `*?[` against EXISTING paths at
-    // runtime, so a glob like `solution-ver*/<id>.json` reaches the dir
-    // without the literal leaf ever appearing in the command text, and a
+    // Glob- and brace-obscured references. bash expands `*?[` against EXISTING
+    // paths at runtime, so a glob like `solution-ver*/<id>.json` reaches the
+    // dir without the literal leaf ever appearing in the command text, and a
     // matching glob can OVERWRITE an existing marker (flipping ready:false ->
-    // true). We cannot safely expand globs (that is the shell-eval surface
-    // read-only-bash refuses), so when a glob metachar is present we match the
-    // leaf's distinctive sub-words: a single glob can split the hyphenated
-    // leaf but not erase every >=6-char word of it (`solution-ver*` keeps
-    // "solution"; `solu*verdicts` keeps "verdicts"). The leaf words, not the
-    // parent segment, are used on purpose: the parent here is `agent-grounding`,
-    // which is also a repo name and would over-block legitimate work. A command
-    // that globs EVERY path segment is the residual the marker-signing
-    // follow-up closes.
-    if (/[*?[]/.test(command)) {
+    // true). `{...,...}` brace expansion is unconditional (no filesystem
+    // lookup needed) and can split the leaf the same way: `solution-verdict{s,}`
+    // expands to `solution-verdicts` / `solution-verdict`, neither of which
+    // contains the literal leaf as a contiguous substring, so the direct check
+    // above misses it. We cannot safely expand either (that is the shell-eval
+    // surface read-only-bash refuses), so when a glob OR brace metacharacter is
+    // present we match the leaf's distinctive sub-words: a single glob or
+    // brace can split the hyphenated leaf but not erase every >=6-char word of
+    // it (`solution-ver*` and `solution-verdict{s,}` both keep "solution";
+    // `solu*verdicts` keeps "verdicts"). The leaf words, not the parent
+    // segment, are used on purpose: the parent here is `agent-grounding`,
+    // which is also a repo name and would over-block legitimate work. A
+    // command that globs/braces EVERY path segment is the residual the
+    // marker-signing follow-up closes.
+    //
+    // ACCEPTED COST of including `{` here: any brace now enters this
+    // leaf-word fallback, so a command carrying a brace AND one of the
+    // generic words above trips it even when it never reaches the dir.
+    // Measured examples that block today and did not before: `cd
+    // /repo/{solution,notes}`, `cd /repo/{a,b}/solution-docs`, and any
+    // non-read-only command containing a brace plus "solution"/"verdicts".
+    // "solution" is a common word, so this is not rare. It is deliberate:
+    // it fails safe, and the tighter alternative (dropping `{`) reopens
+    // the `solution-verdict{s,}` split-leaf hole, which fails open.
+    if (/[*?[{]/.test(command)) {
         const leafWords = leaf.split(/[^A-Za-z0-9]+/).filter((w) => w.length >= 6);
         if (leafWords.some((w) => command.includes(w)))
             return true;

package/dist/policy-packs/builtin/solution-acceptance-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"solution-acceptance-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/solution-acceptance-runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,2DAA2D;AAC3D,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAEhB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAGhF,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uFAAuF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAgB;IAC9D,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IACnF,IACE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,GAAe,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC;AAeD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAwB,EAAE,CAAC,OAAO;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,IAAI,GACR,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,EAAU;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,EAAU;IACjD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,aAAa;IAC5B,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,IAAI,GAAG,+BAA+B,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAqB,CAAC;QAC5D,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,EACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/D,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACvE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,WAA0B,EAC1B,EAAU;IAEV,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gDAAgD,EAAE,uDAAuD;YACjH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,EAAE,iBAAiB,GAAG,uCAAuC;YACzG,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mEAAmE,EAAE,cAAc;YAC3F,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CAA0C,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8CAA8C;YACrL,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oCAAoC,EAAE,sBAAsB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI;QACnJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,qCAAqC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAW;IACnE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,4DAA4D;IAC5D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,oBAAoB;IACpB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"solution-acceptance-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/solution-acceptance-runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,4EAA4E;AAC5E,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,2DAA2D;AAC3D,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAEhB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAGhF,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uFAAuF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAgB;IAC9D,MAAM,GAAG,GAAI,IAAI,CAAC,MAAkC,CAAC,4BAA4B,CAAC,CAAC;IACnF,IACE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,GAAe,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC;AAeD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAwB,EAAE,CAAC,OAAO;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,IAAI,GACR,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,EAAU;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,EAAU;IACjD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,aAAa;IAC5B,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,IAAI,GAAG,+BAA+B,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAqB,CAAC;QAC5D,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,EACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/D,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACvE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,WAA0B,EAC1B,EAAU;IAEV,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gDAAgD,EAAE,uDAAuD;YACjH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,EAAE,iBAAiB,GAAG,uCAAuC;YACzG,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mEAAmE,EAAE,cAAc;YAC3F,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CAA0C,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8CAA8C;YACrL,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oCAAoC,EAAE,sBAAsB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI;QACnJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,qCAAqC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,GAAY;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAW;IACnE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,4DAA4D;IAC5D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,mCAAmC;IACnC,EAAE;IACF,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,6DAA6D;IAC7D,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,gEAAgE;IAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution-runtime.d.ts

@@ -1,7 +1,7 @@
 import { type LedgerEntry } from "../../policies/index.js";
 export declare const APPROVED_LEDGER_TAG_PREFIX = "understanding-approved:";
 export declare const APPROVAL_MARKER_DIRNAME = ".approvals";
-export type ApprovalSource = "marker" | "ledger" | "persisted-report" | "none";
+export type ApprovalSource = "marker" | "ledger" | "persisted-report" | "none" | "recovery-commit";
 export interface ApprovalCheckResult {
     approved: boolean;
     source: ApprovalSource;
@@ -184,6 +184,14 @@ export declare function approvalMarkerPathFor(generatedDir: string, sessionId: s
 export interface ApprovalMarker {
     approvedAt: string;
     approvedBy: string;
+    /**
+     * sha256 hex of the persisted-report content this approval is bound to
+     * at sign-time (harness/f9485cc7). Optional on write (defaults to
+     * `null` — a marker with no report to bind, e.g. `harness approve
+     * branch-protection`, or a ledger-only approval); always present
+     * (possibly `null`) on a marker `checkApprovalMarker` returns.
+     */
+    reportContentHash?: string | null;
 }
 /**
  * Operator-side: write the marker file the gate consults. Atomic so a
@@ -192,12 +200,50 @@ export interface ApprovalMarker {
  * operator runs from their un-hooked shell; if the agent could call
  * this path the gate's value would collapse, so it lives behind the
  * approve CLI rather than as a generally importable verb.
+ *
+ * The marker is HMAC-signed (harness/f9485cc7) over (sessionId,
+ * approvedAt, approvedBy, reportContentHash) using an operator-side key
+ * lazily generated at `<generatedDir>/.approval-signing.key` — see
+ * `src/runtime/approval-signing.ts` for the key-management contract and
+ * the honest trust model. Mode 0600 on the marker file itself, best-
+ * effort (matches the signing key's own permission convention); this is
+ * defense-in-depth alongside the signature, not a substitute for it.
  */
 export declare function writeApprovalMarker(generatedDir: string, sessionId: string, marker: ApprovalMarker): string;
 export interface MarkerCheck {
     matched: boolean;
     detail: string;
     marker: ApprovalMarker | null;
+    /**
+     * True when `matched` is false SPECIFICALLY because a readable marker
+     * existed but its `approvedAt` exceeded `opts.maxAgeMs`
+     * (agent-tasks/d8ee60ca) — as opposed to the marker being absent
+     * (never approved, or cleared by a task-completion boundary tool via
+     * `clearApprovalMarker`), corrupted, or the session id malformed.
+     * False whenever `matched` is true. This is the signal task 6e888423's
+     * recovery-git-commit exemption keys off: "this session/task DID have
+     * a real operator approval and it merely aged out" is safe to treat
+     * differently from "this session/task was never approved" or "a task
+     * boundary just cleared it for a new task" — see
+     * src/runtime/recovery-git-commit.ts for the full argument.
+     */
+    expired: boolean;
+    /**
+     * True when a marker FILE existed at the expected path but failed
+     * signature verification (harness/f9485cc7): missing `signature`/`alg`
+     * fields (a legacy pre-signing marker, or a marker planted without the
+     * operator-side key), a mismatched `alg`, or a signature that does not
+     * verify against the current key. Distinct from the marker being
+     * simply absent (`forged: false`, `matched: false`) so a caller can
+     * log/alert on an active forgery attempt instead of the routine
+     * "nobody has approved yet" case. `matched` is always false when
+     * `forged` is true — a forged marker never satisfies the gate,
+     * regardless of `approval_lifecycle.max_age`. A transient I/O read
+     * failure (`forged: false`, `matched: false`) is kept distinct from
+     * both: it is neither "no marker" nor evidence of tampering, just a
+     * marker whose integrity cannot be proven right now.
+     */
+    forged: boolean;
 }
 export interface CheckApprovalMarkerOptions {
     /**
@@ -206,35 +252,31 @@ export interface CheckApprovalMarkerOptions {
      * treated as expired and returns `matched:false` with an
      * "expired" detail. When omitted, the marker has no TTL — the
      * legacy contract (one approval per session, no expiry).
-     *
-     * A marker whose body is unreadable (malformed JSON, missing
-     * `approvedAt`) is treated as approved-but-undateable: the
-     * existence-only contract documented above wins, so an operator
-     * who hand-wrote an empty marker file still gets through. This
-     * matters because the legacy DoS-resistance argument still holds.
      */
     maxAgeMs?: number;
     /** Override "now" for deterministic tests. */
     now?: Date;
 }
 /**
- * Gate-side: is the per-session marker file present and readable?
- * Returns `matched: true` even if the marker JSON is malformed: the
- * file's *existence* is the operator's intent. Corrupted contents
- * surface as `marker: null` in the diagnostic but do not invalidate the
- * approval, since invalidating on a parse error would hand a denial-
- * of-service vector to anyone (including the agent) who could append a
- * stray byte to the file. Edit / Write / Bash are gated, so writing
- * stray bytes from inside Claude is not possible today, but the
- * existence-only contract is the defensible boundary regardless.
+ * Gate-side: is the per-session marker file present, readable, AND
+ * validly signed? (harness/f9485cc7 — this replaced the earlier
+ * "existence is enough" contract: a marker's mere presence used to
+ * satisfy the gate even with a malformed or corrupted body, on the
+ * theory that Edit/Write/Bash being gated meant only the operator could
+ * ever create the file. That theory holds only as long as no OTHER
+ * write primitive reaches `harness.generated/` — exactly the invariant
+ * this signing scheme no longer has to trust blindly.) A marker with no
+ * `signature`, a wrong `alg`, or a signature that fails to verify is
+ * REJECTED — see `MarkerCheck.forged` — with the SAME `matched: false`
+ * outcome as no marker at all, but a distinct, forgery-specific detail
+ * string so callers can tell the two apart for audit.
  *
- * `opts.maxAgeMs` (agent-tasks/d8ee60ca): when set, a marker whose
- * `approvedAt` is older than the cutoff returns `matched:false` with
- * an "expired" detail so the agent gets the same "no approval" UX as
- * a never-approved session and must re-approve. A marker with no
- * readable `approvedAt` (body corrupted) skips the freshness check
- * and is treated as approved — same DoS-resistance rationale as the
- * body-unreadable branch below.
+ * `opts.maxAgeMs` (agent-tasks/d8ee60ca): when set, a validly-signed
+ * marker whose `approvedAt` is older than the cutoff returns
+ * `matched:false` with an "expired" detail so the agent gets the same
+ * "no approval" UX as a never-approved session and must re-approve.
+ * Expiry is only evaluated AFTER signature verification succeeds — an
+ * unsigned/forged marker is rejected outright, never "expired".
  */
 export declare function checkApprovalMarker(generatedDir: string, sessionId: string, opts?: CheckApprovalMarkerOptions): MarkerCheck;
 export interface ApprovalLifecycle {
@@ -292,6 +334,12 @@ export declare function taskApprovalMarkerPathFor(generatedDir: string, taskId:
  * Operator-side: write a task-scoped marker file. Atomic. Caller is
  * `harness approve understanding --task <id>`. The session marker is
  * written separately by the same caller for back-compat.
+ *
+ * Signed the same way as `writeApprovalMarker` (harness/f9485cc7), using
+ * `task-<id>` (the exact string `checkActiveClaimApprovalMarker` looks
+ * up) as the signed markerId — so a validly-signed task marker cannot be
+ * copied onto a different task id (or the session marker's id) and still
+ * verify.
  */
 export declare function writeTaskApprovalMarker(generatedDir: string, taskId: string, marker: ApprovalMarker): string;
 /**
@@ -307,7 +355,7 @@ export declare function writeTaskApprovalMarker(generatedDir: string, taskId: st
  * because the scan returned the first existing marker regardless of
  * which task the agent had actually claimed.
  *
- * Same safety filters as `checkApprovalMarker` (existence-is-enough,
+ * Same safety filters as `checkApprovalMarker` (signature verification,
  * symlink rejection, optional freshness via `maxAgeMs`); the only
  * difference is the filename suffix derived from `active-claim`.
  */
@@ -320,6 +368,27 @@ export interface OperatorMarkerApproval {
     detail: string;
     /** Task-scoped check detail, for callers that trace the fall-through. */
     taskCheckDetail: string;
+    /**
+     * True when EITHER the task-scoped or the session-scoped marker
+     * existed but aged past `approval_lifecycle.max_age` (task 6e888423).
+     * False when `matched` is true, and false when a marker was simply
+     * absent (never approved, or cleared by a task-completion boundary
+     * tool) — distinguishing "this identity had a real approval that
+     * merely expired" from "this identity was never approved" / "a new
+     * task just started". PreToolUse hooks use this (never on its own —
+     * always alongside `isRecoveryGitCommit`) to decide whether a bare
+     * recovery `git commit` may proceed without a fresh Understanding
+     * Report; see src/runtime/recovery-git-commit.ts.
+     */
+    expired: boolean;
+    /**
+     * True when EITHER the task-scoped or the session-scoped marker
+     * existed but FAILED signature verification (harness/f9485cc7) —
+     * missing/invalid signature, wrong `alg`, or tampered payload. Distinct
+     * from a marker simply being absent, so a caller can log a forgery
+     * attempt distinctly from the routine "not approved yet" case.
+     */
+    forged: boolean;
 }
 /**
  * Shared marker resolution for the Claude and Codex understanding-gate
@@ -335,6 +404,110 @@ export declare function checkOperatorApprovalMarkers(generatedDir: string, sessi
 } | null): OperatorMarkerApproval;
 /** Clear a specific task-scoped marker. Used by the post-tool-use hook. */
 export declare function clearTaskApprovalMarker(generatedDir: string, taskId: string): void;
+/**
+ * Tool names treated as "the Bash tool" for `expire_on_bash_match`
+ * command-regex matching. Claude Code has exactly one Bash tool name;
+ * a runtime with shell-tool aliases (e.g. Codex's `shell` /
+ * `exec_command` / `functions.exec_command`) passes its own set.
+ */
+export declare const DEFAULT_BASH_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Tool-name membership test against `expire_on_tool_match`. No GLOB
+ * wildcard expansion by design (agent-tasks/d8ee60ca): operators write
+ * the exact tool name they mean.
+ *
+ * It IS alias-aware, though: a tool name is compared against `patterns`
+ * after expanding it through `expandToolNameAliases` (shell-tool
+ * aliases `Bash`/`shell`/`exec_command`/`functions.exec_command`, and
+ * MCP tool-name variants — server hyphen/underscore swap, the
+ * `mcp__server__.tool` dotted form). This mirrors the normalization
+ * `harness policy intercept`'s `policyMatchesEvent` already applies to
+ * the incoming `event.tool_name` (`src/runtime/intercept.ts`, commit
+ * 9aacbcd "Fix Codex hook tool matching") — that fix exists precisely
+ * because Codex can emit an MCP tool name in one of these variant
+ * forms for the identical tool. Before this, a Codex session sending
+ * `mcp__agent-tasks__.task_finish` (dotted) or an underscore-server
+ * variant would silently never expire the marker: the Codex generator
+ * alias-expands the EMITTED TOML `matcher` (`expandCodexHookMatchPattern`
+ * in `generate-codex-config.ts`) so Codex's own dispatcher still
+ * invokes the hook command, but this function's comparison against the
+ * canonical `expire_on_tool_match` config list would reject the
+ * variant `tool_name` once inside the hook body — the boundary would
+ * silently never fire even though the hook ran (review finding on task
+ * a1348c89).
+ */
+export declare function toolNameMatchesAny(toolName: string, patterns: readonly string[]): boolean;
+/** First `expire_on_bash_match` regex the command satisfies, or
+ * undefined. Patterns are pre-compiled by `parseApprovalLifecycle`
+ * (invalid ones already dropped with a warning). Empty command
+ * short-circuits to undefined. */
+export declare function bashCommandMatchesAny(command: string, patterns: readonly RegExp[]): RegExp | undefined;
+/** Pull the Bash command out of a tool_input payload, `""` when absent
+ * or malformed. */
+export declare function extractBashCommandFromToolInput(toolInput: unknown): string;
+/** Pull `taskId` out of an MCP tool_input payload (`""` when absent /
+ * malformed). Task-boundary agent-tasks verbs carry this as a
+ * top-level string field. */
+export declare function extractTaskIdFromToolInput(toolInput: unknown): string;
+/** Pull the legacy v1 `tasks_transition` `status` field out of a
+ * tool_input payload (`""` when absent / malformed). Only `"done"`
+ * releases the work claim; the caller treats any other value as
+ * keep-claim. */
+export declare function extractTasksTransitionStatusFromToolInput(toolInput: unknown): string;
+export interface PostToolUseBoundaryMatch {
+    /** Final match decision: `toolNameMatched || bashRegex !== undefined`. */
+    matched: boolean;
+    /** Tool-name match, refined by the tasks_transition status filter. */
+    toolNameMatched: boolean;
+    /** Tool-name match BEFORE the tasks_transition status filter — lets
+     * the caller distinguish "not in the list" from "in the list, but
+     * status keeps the claim" for its diagnostic. */
+    rawToolNameMatched: boolean;
+    /** The `expire_on_bash_match` regex the command satisfied, if any. */
+    bashRegex: RegExp | undefined;
+}
+/**
+ * Decide whether `toolName` (+ its `tool_input`) crosses one of the
+ * configured `approval_lifecycle` boundaries. Pure — no filesystem
+ * access. Callers branch on `.matched` before touching marker/report
+ * state (see `applyPostToolUseExpiry`).
+ */
+export declare function matchPostToolUseBoundary(toolName: string, toolInput: unknown, lifecycle: Pick<ApprovalLifecycle, "expireOnToolMatch" | "expireOnBashMatch">, bashToolNames?: ReadonlySet<string>): PostToolUseBoundaryMatch;
+export interface ApplyPostToolUseExpiryResult {
+    /** Did the session marker exist before this call cleared it? */
+    wasMarkerPresent: boolean;
+    /** Was a task-scoped marker also cleared? Only possible when
+     * `toolNameMatched` (Bash regex boundaries never carry a taskId). */
+    taskMarkerCleared: boolean;
+    /** The task id whose marker was cleared, `""` when none. */
+    clearedTaskId: string;
+    /** Did the persisted-report expiry succeed? */
+    persistedReportExpired: boolean;
+    /** Full expiry result (success detail or skip reason) for diagnostics. */
+    reportExpiry: ReturnType<typeof expirePersistedReport>;
+}
+/**
+ * Side-effecting: clear the session marker, the task-scoped marker
+ * (when `toolNameMatched` and `tool_input.taskId` names an existing
+ * marker), and expire the persisted report. Call ONLY after
+ * `matchPostToolUseBoundary(...).matched` is true — this function does
+ * not re-check the match itself. Mirrors the Claude hook's original
+ * side effects exactly so both runtimes share one clearing
+ * implementation (task a1348c89).
+ */
+export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date): ApplyPostToolUseExpiryResult;
+/**
+ * Compose the stderr diagnostic line for a matched-and-applied PostToolUse
+ * expiry. Shared by `harness pack hook post-tool-use` (Claude) and
+ * `harness pack hook codex-post-tool-use` (Codex) — before this extraction
+ * the two hooks each built this line by hand from the same four pieces
+ * (`matchSource`/`taskNote`/`reportNote`/the present-vs-absent branch),
+ * which `check:duplication` flagged as new clones the moment the Codex
+ * sibling landed (task a1348c89). `hookLabel` is the caller's own
+ * `harness pack hook ...` command string so the message still names the
+ * right verb.
+ */
+export declare function describePostToolUseExpiry(hookLabel: string, sessionId: string, toolName: string, bashRegex: RegExp | undefined, expiry: ApplyPostToolUseExpiryResult): string;
 export declare const ACTIVE_CLAIM_FILENAME = "active-claim";
 export declare function activeClaimPathFor(generatedDir: string): string;
 /**