@lannguyensi/harness 0.40.0 → 0.42.0

package/dist/policy-packs/ux-compare.js

@@ -0,0 +1,58 @@
+// Structural comparison + safe-parse helpers for `config.ux` /
+// `config.producers` (task 68b9ad9c). Shared by `checkPolicyPackUxDrift`
+// (the `harness doctor` read-side warning, ux-drift-check.ts) and
+// `harness pack reseed` (the opt-in write-side fix, src/cli/pack/reseed.ts)
+// so the two can never independently drift on what "matches the shipped
+// template" means.
+import { z } from "zod";
+import { PolicyUxSchema, ProducerSchema } from "../schema/policies.js";
+const ProducersArraySchema = z.array(ProducerSchema);
+function stringArrayEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return a.every((v, i) => v === b[i]);
+}
+export function uxEqual(a, b) {
+    return (a.cannot === b.cannot &&
+        stringArrayEqual(a.required, b.required) &&
+        stringArrayEqual(a.run, b.run));
+}
+/**
+ * Structural equality over a `producers:` array. Compares each entry
+ * field-by-field per its discriminated `kind` rather than a generic deep
+ * equal — the shape is small and fixed (bash/mcp/ask), and this keeps the
+ * comparison legible instead of round-tripping through JSON.stringify
+ * (which would also be sensitive to incidental key ordering).
+ */
+export function producersEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return a.every((entryA, i) => {
+        const entryB = b[i];
+        if (!entryB || entryA.kind !== entryB.kind)
+            return false;
+        if (entryA.kind === "bash" && entryB.kind === "bash") {
+            return entryA.command === entryB.command && entryA.description === entryB.description;
+        }
+        if (entryA.kind === "ask" && entryB.kind === "ask") {
+            return entryA.command === entryB.command && entryA.description === entryB.description;
+        }
+        if (entryA.kind === "mcp" && entryB.kind === "mcp") {
+            return (entryA.verb === entryB.verb &&
+                entryA.example === entryB.example &&
+                entryA.description === entryB.description);
+        }
+        return false;
+    });
+}
+/** Parses an unknown `config.ux` value; returns null on any schema rejection. */
+export function safeParseUx(raw) {
+    const result = PolicyUxSchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+/** Parses an unknown `config.producers` value; returns null on any schema rejection. */
+export function safeParseProducers(raw) {
+    const result = ProducersArraySchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+//# sourceMappingURL=ux-compare.js.map

package/dist/policy-packs/ux-compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ux-compare.js","sourceRoot":"","sources":["../../src/policy-packs/ux-compare.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,yEAAyE;AACzE,kEAAkE;AAClE,4EAA4E;AAC5E,wEAAwE;AACxE,mBAAmB;AAEnB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvE,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAErD,SAAS,gBAAgB,CAAC,CAAoB,EAAE,CAAoB;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAW,EAAE,CAAW;IAC9C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;QACxC,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,CAAsB,EAAE,CAAsB;IAC3E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACnD,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAC3B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACjC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/policy-packs/ux-drift-check.d.ts

@@ -0,0 +1,27 @@
+import type { Manifest } from "../schema/index.js";
+export type PolicyPackUxDriftField = "ux" | "producers";
+export interface PolicyPackUxDrift {
+    packIndex: number;
+    packName: string;
+    /** Which sub-field(s) diverge from the shipped template. */
+    fields: PolicyPackUxDriftField[];
+    message: string;
+}
+/**
+ * Walks `manifest.policy_packs` in declared order. For each enabled
+ * builtin pack that has a registered shipped default (see
+ * `resolveBuiltinDefaultConfig`), compares the operator's declared
+ * `config.ux` / `config.producers` (when present) against that default
+ * and reports a divergence for each sub-field that differs.
+ *
+ * A pack that never declared `config.ux` (or `config.producers`) at all
+ * is NOT flagged here: that is a distinct, pre-existing gap (the pack
+ * falls back to its legacy engine-vocabulary deny text) rather than a
+ * stale COPY of the shipped text, and is out of scope for this check —
+ * see task 68b9ad9c's framing (an operator whose manifest predates a
+ * wording fix has a STALE `ux.run`, not a MISSING one). A malformed
+ * `config.ux` / `config.producers` (already reported separately by
+ * `checkPolicyPackConfigs`) is treated as diverging here too, rather
+ * than being silently skipped.
+ */
+export declare function checkPolicyPackUxDrift(manifest: Manifest): PolicyPackUxDrift[];

package/dist/policy-packs/ux-drift-check.js

@@ -0,0 +1,78 @@
+// Per-pack `config.ux` / `config.producers` divergence check (task
+// 68b9ad9c). Used by `harness doctor` to warn when an enabled builtin
+// pack's agent-facing deny-message text no longer matches the shipped
+// template for that pack.
+//
+// Motivation (dogfood 2026-07-10, harness 0.40.0): the understanding-gate
+// deny message is entirely driven by `config.ux` when the operator has
+// declared one — the init templates (Solo/Team/Full/Custom) were fixed to
+// teach a new submission form, but that fix only reaches manifests
+// generated AFTER the fix landed. An operator who installed before the fix
+// has an on-disk `config.ux` that still teaches the old wording, and
+// nothing short of a hand-edit ever updated it: `harness apply` projects
+// the manifest OUT to settings.json, it never re-seeds pack config FROM
+// the shipped template back INTO the manifest.
+//
+// This check is the read side of that gap (the warning); `harness pack
+// reseed <name>` (src/cli/pack/reseed.ts) is the opt-in write side. Both
+// consume the same canonical default via `resolveBuiltinDefaultConfig`,
+// and the same comparison helpers (ux-compare.ts), so they can never
+// independently drift on what "the shipped template" means.
+//
+// Deliberately doctor-only (not `harness validate`), mirroring
+// `checkPolicyPackVersions`: this is an informational nudge about
+// wording that still functions, not a schema violation.
+import { resolveBuiltinDefaultConfig } from "./registry.js";
+import { producersEqual, safeParseProducers, safeParseUx, uxEqual } from "./ux-compare.js";
+/**
+ * Walks `manifest.policy_packs` in declared order. For each enabled
+ * builtin pack that has a registered shipped default (see
+ * `resolveBuiltinDefaultConfig`), compares the operator's declared
+ * `config.ux` / `config.producers` (when present) against that default
+ * and reports a divergence for each sub-field that differs.
+ *
+ * A pack that never declared `config.ux` (or `config.producers`) at all
+ * is NOT flagged here: that is a distinct, pre-existing gap (the pack
+ * falls back to its legacy engine-vocabulary deny text) rather than a
+ * stale COPY of the shipped text, and is out of scope for this check —
+ * see task 68b9ad9c's framing (an operator whose manifest predates a
+ * wording fix has a STALE `ux.run`, not a MISSING one). A malformed
+ * `config.ux` / `config.producers` (already reported separately by
+ * `checkPolicyPackConfigs`) is treated as diverging here too, rather
+ * than being silently skipped.
+ */
+export function checkPolicyPackUxDrift(manifest) {
+    const out = [];
+    manifest.policy_packs.forEach((pack, packIndex) => {
+        if (!pack.enabled)
+            return;
+        const canonical = resolveBuiltinDefaultConfig(pack);
+        if (!canonical)
+            return;
+        const fields = [];
+        const currentUx = pack.config["ux"];
+        if (canonical.ux && currentUx !== undefined) {
+            const parsed = safeParseUx(currentUx);
+            if (!parsed || !uxEqual(parsed, canonical.ux))
+                fields.push("ux");
+        }
+        const currentProducers = pack.config["producers"];
+        if (canonical.producers && currentProducers !== undefined) {
+            const parsed = safeParseProducers(currentProducers);
+            if (!parsed || !producersEqual(parsed, canonical.producers))
+                fields.push("producers");
+        }
+        if (fields.length === 0)
+            return;
+        out.push({
+            packIndex,
+            packName: pack.name,
+            fields,
+            message: `pack "${pack.name}" config.${fields.join(" / config.")} diverges from the shipped ` +
+                `builtin template; a supported update exists. Review with ` +
+                `\`harness pack reseed ${pack.name} --dry-run\` and apply with \`harness pack reseed ${pack.name}\`.`,
+        });
+    });
+    return out;
+}
+//# sourceMappingURL=ux-drift-check.js.map

package/dist/policy-packs/ux-drift-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ux-drift-check.js","sourceRoot":"","sources":["../../src/policy-packs/ux-drift-check.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AACtE,0BAA0B;AAC1B,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AACrE,4DAA4D;AAC5D,EAAE;AACF,+DAA+D;AAC/D,kEAAkE;AAClE,wDAAwD;AAExD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAa3F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,SAAS,CAAC,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEhC,GAAG,CAAC,IAAI,CAAC;YACP,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM;YACN,OAAO,EACL,SAAS,IAAI,CAAC,IAAI,YAAY,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,6BAA6B;gBACpF,2DAA2D;gBAC3D,yBAAyB,IAAI,CAAC,IAAI,qDAAqD,IAAI,CAAC,IAAI,KAAK;SACxG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/probes/mcp.d.ts

@@ -6,6 +6,19 @@ export type McpProbeOutcome = {
     kind: "error";
     latencyMs: number;
     message: string;
+    /**
+     * Set when the failure is a `spawn` `ENOENT` (the declared binary
+     * could not be resolved at all, as opposed to the process starting
+     * and then misbehaving). Doctor uses this to decide whether a
+     * PATH-shadow remediation hint applies (harness/7f8fb4bc).
+     */
+    enoent?: boolean;
+    /**
+     * One-line PATH-shadow remediation, populated by the doctor layer
+     * (which knows the resolved npm global bin dir) when an `enoent`
+     * binary is found to actually exist there, just not on PATH.
+     */
+    pathHint?: string;
 }
 /**
  * Server exited with code 0 BEFORE the doctor received a JSON-RPC

package/dist/probes/mcp.js

@@ -15,6 +15,29 @@ function commandToArgs(server) {
     const args = list.slice(1).map(expandHomePath);
     return { exe, args };
 }
+/**
+ * Build the `error` outcome for a spawn-time failure (as opposed to a
+ * failure after the process started). `ENOENT` — the binary is not
+ * resolvable at all — gets the "not found on PATH" wording the doctor
+ * summary and PATH-shadow hint (added by the doctor layer) key off of;
+ * any other errno (e.g. `EACCES`) still reports gracefully but without
+ * implying a PATH problem.
+ */
+function spawnErrorOutcome(exe, err, latencyMs) {
+    if (err?.code === "ENOENT") {
+        return {
+            kind: "error",
+            latencyMs,
+            message: `${exe} not found on PATH (spawn ENOENT)`,
+            enoent: true,
+        };
+    }
+    return {
+        kind: "error",
+        latencyMs,
+        message: `spawn ${exe} failed: ${err?.message ?? "unknown spawn error"}`,
+    };
+}
 async function runRealProbe(server, opts) {
     if (server.enabled === false) {
         return { name: server.name, outcome: { kind: "disabled" } };
@@ -49,6 +72,18 @@ async function runRealProbe(server, opts) {
     let processExited = false;
     let exitCode = null;
     let exitSignal = null;
+    // A declared MCP whose binary cannot be resolved (spawn ENOENT, or any
+    // other spawn-time failure such as EACCES) emits an 'error' event on
+    // `child` ASYNCHRONOUSLY, not a synchronous throw from `spawn()` above.
+    // Node's EventEmitter treats an 'error' event with zero listeners as an
+    // unhandled exception that crashes the whole process — this is exactly
+    // the "spawn grounding-mcp ENOENT ... emitted 'error' event on
+    // ChildProcess" dogfood crash (harness/7f8fb4bc). Listening here turns
+    // it into a normal, per-server doctor outcome instead.
+    let spawnErr = null;
+    child.on("error", (err) => {
+        spawnErr = err;
+    });
     child.stderr.on("data", (chunk) => {
         stderrBuf += chunk.toString("utf8");
     });
@@ -105,6 +140,14 @@ async function runRealProbe(server, opts) {
                 child.once("exit", () => resolve("exit"));
         });
     }
+    function waitForSpawnError() {
+        return new Promise((resolve) => {
+            if (spawnErr)
+                resolve("spawn-error");
+            else
+                child.once("error", () => resolve("spawn-error"));
+        });
+    }
     const timers = new Set();
     function timeoutPromise() {
         return new Promise((resolve) => {
@@ -130,7 +173,14 @@ async function runRealProbe(server, opts) {
             }),
             waitForExit(),
             timeoutPromise(),
+            waitForSpawnError(),
         ]);
+        if (initResult === "spawn-error") {
+            return {
+                name: server.name,
+                outcome: spawnErrorOutcome(exe, spawnErr, Date.now() - start),
+            };
+        }
         if (initResult === "exit") {
             const latencyMs = Date.now() - start;
             // Clean exit (code 0) before responding looks like a config issue
@@ -179,7 +229,14 @@ async function runRealProbe(server, opts) {
             }),
             waitForExit(),
             timeoutPromise(),
+            waitForSpawnError(),
         ]);
+        if (verbResult === "spawn-error") {
+            return {
+                name: server.name,
+                outcome: spawnErrorOutcome(exe, spawnErr, Date.now() - start),
+            };
+        }
         if (verbResult === "exit") {
             const latencyMs = Date.now() - start;
             if (exitCode === 0) {

package/dist/probes/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/probes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAkCxC,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAiB,EACjB,IAAyB;IAEzB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAC9C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;aACnD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAE7C,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,iFAAiF;IACnF,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,aAAa,GAAG,IAAI,CAAC;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;oBAChD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACpC,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YACD,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,IAAI,CAAC,EAAU,EAAE,MAAc,EAAE,MAA+B;QACvE,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,WAAW;QAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,aAAa;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;gBAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,SAAS,cAAc;QACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,WAAW;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;gBACpB,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;aACzD,CAAC;YACF,WAAW,EAAE;YACb,cAAc,EAAE;SACjB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,kEAAkE;YAClE,+DAA+D;YAC/D,4DAA4D;YAC5D,oBAAoB;YACpB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE;iBACjE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;YAC5E,MAAM,MAAM,GACV,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1F,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS;oBACT,OAAO,EAAE,WAAW,MAAM,KAAK,OAAO,EAAE;iBACzC;aACF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,8BAA8B,SAAS,IAAI;iBACrD;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,IAAI,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;gBACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBACxB,SAAS,EAAE,EAAE;aACd,CAAC;YACF,WAAW,EAAE;YACb,cAAc,EAAE;SACjB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,aAAa;wBACnB,SAAS;wBACT,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;qBACzB;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS;oBACT,OAAO,EAAE,yBAAyB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;iBACnE;aACF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,oBAAoB,SAAS,IAAI;iBAChE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAgE,CAAC;QAClF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,mBAAmB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,OAA4B,EAAE;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAC/D,IAAI,CAAC,MAAiB;QACpB,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAoB,EACpB,KAAe;IAEf,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/probes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAmDxC,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,GAAiC,EACjC,SAAiB;IAEjB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,OAAO;YACb,SAAS;YACT,OAAO,EAAE,GAAG,GAAG,mCAAmC;YAClD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS;QACT,OAAO,EAAE,SAAS,GAAG,YAAY,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE;KACzE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAiB,EACjB,IAAyB;IAEzB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAC9C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;aACnD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,+DAA+D;IAC/D,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,QAAQ,GAAiC,IAAI,CAAC;IAClD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,QAAQ,GAAG,GAA4B,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,iFAAiF;IACnF,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,aAAa,GAAG,IAAI,CAAC;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;oBAChD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACpC,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YACD,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,IAAI,CAAC,EAAU,EAAE,MAAc,EAAE,MAA+B;QACvE,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,WAAW;QAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,aAAa;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;gBAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,iBAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,QAAQ;gBAAE,OAAO,CAAC,aAAa,CAAC,CAAC;;gBAChC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,SAAS,cAAc;QACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,SAAS,WAAW;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;gBACpB,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;aACzD,CAAC;YACF,WAAW,EAAE;YACb,cAAc,EAAE;YAChB,iBAAiB,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,kEAAkE;YAClE,+DAA+D;YAC/D,4DAA4D;YAC5D,oBAAoB;YACpB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE;iBACjE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;YAC5E,MAAM,MAAM,GACV,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1F,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS;oBACT,OAAO,EAAE,WAAW,MAAM,KAAK,OAAO,EAAE;iBACzC;aACF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,8BAA8B,SAAS,IAAI;iBACrD;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,IAAI,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;gBACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBACxB,SAAS,EAAE,EAAE;aACd,CAAC;YACF,WAAW,EAAE;YACb,cAAc,EAAE;YAChB,iBAAiB,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,aAAa;wBACnB,SAAS;wBACT,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;qBACzB;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS;oBACT,OAAO,EAAE,yBAAyB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;iBACnE;aACF,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,oBAAoB,SAAS,IAAI;iBAChE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAgE,CAAC;QAClF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC7B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,mBAAmB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,OAA4B,EAAE;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAC/D,IAAI,CAAC,MAAiB;QACpB,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAoB,EACpB,KAAe;IAEf,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/runtime/approval-signing.d.ts

@@ -0,0 +1,82 @@
+/** Versioned algorithm tag, so a future re-key scheme can reject mismatches explicitly rather than guess. */
+export declare const SIGNING_ALG = "hmac-sha256-v1";
+/** Basename of the signing-key file, a sibling of `.approvals/` under `generatedDir`. */
+export declare const SIGNING_KEY_BASENAME = ".approval-signing.key";
+/** Filesystem path of the signing key for a given `generatedDir`. */
+export declare function signingKeyPathFor(generatedDir: string): string;
+export interface SigningKeyHandle {
+    key: Buffer;
+    filePath: string;
+    /** True when this call generated a fresh key (first use / post-rotation). */
+    created: boolean;
+}
+/**
+ * Read the signing key, generating one (0600, `crypto.randomBytes(32)`) on
+ * first use. Race-safe-ish: a concurrent create loses the `wx` (exclusive
+ * create) race and falls back to reading whatever the winner wrote, rather
+ * than throwing or clobbering it. A key file shorter than `KEY_BYTES`
+ * (truncated / corrupted) is treated as absent and regenerated, since a
+ * short key would only weaken every future signature.
+ */
+export declare function getOrCreateSigningKey(generatedDir: string): SigningKeyHandle;
+/**
+ * Force a fresh key, overwriting any existing one. Every marker signed
+ * under the old key stops verifying immediately (see module doc). Not
+ * currently wired to a CLI verb (documented as "delete the file" for v1);
+ * exported so a future `harness approve rotate-key`-style verb, or a test,
+ * can call it directly without re-deriving the path convention.
+ */
+export declare function rotateSigningKey(generatedDir: string): SigningKeyHandle;
+/** sha256 hex digest of a string, used to bind a marker to a persisted report's content. */
+export declare function sha256Hex(content: string): string;
+export interface SignedMarkerFields {
+    approvedAt: string;
+    approvedBy: string;
+    /** sha256 hex of the persisted-report content this approval is bound to; null when no report exists to bind (e.g. branch-protection, or a ledger-only approval). */
+    reportContentHash: string | null;
+    alg: string;
+    signature: string;
+}
+/**
+ * Sign a marker's fields for `markerId` (the marker's lookup key — a raw
+ * sessionId for the understanding-gate session marker, `task-<id>` for a
+ * task-scoped marker, `branch-protection-<sessionId>` for the
+ * branch-protection twin). Binding `markerId` into the signed payload is
+ * what stops a validly-signed marker from being copied/renamed onto a
+ * DIFFERENT id and still verifying — verification always recomputes the
+ * HMAC using the id the caller is checking, not one read back out of the
+ * marker body.
+ */
+export declare function signMarker(generatedDir: string, markerId: string, marker: {
+    approvedAt: string;
+    approvedBy: string;
+    reportContentHash?: string | null;
+}): SignedMarkerFields;
+export type SignatureVerification = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    /**
+     * `"key-unavailable"` when verification could not even run because
+     * obtaining the signing key itself failed (permission error, disk
+     * issue) — a fail-closed I/O problem, not evidence of tampering.
+     * Callers (`checkApprovalMarker`) use this to classify the outcome
+     * distinctly from an actual forged/invalid signature (review LOW 1,
+     * harness/f9485cc7): a broken key file must not read as an active
+     * forgery attempt in audit output. Omitted for every other failure
+     * (missing field, wrong alg, bad signature).
+     */
+    kind?: "key-unavailable";
+};
+/**
+ * Verify a parsed marker JSON body against `markerId`. Never throws: any
+ * failure to obtain the signing key (permission error, disk issue) is
+ * treated as a verification failure, not an exception — the gate-side
+ * caller must fail closed (not approved) rather than crash the hook
+ * process, which the surrounding PreToolUse blocker would otherwise turn
+ * into an uncontrolled failure mode. That specific failure mode is tagged
+ * `kind: "key-unavailable"` so the caller can tell "we couldn't even check"
+ * apart from "we checked and it's invalid".
+ */
+export declare function verifyMarkerSignature(generatedDir: string, markerId: string, payload: Record<string, unknown>): SignatureVerification;