@lannguyensi/harness 0.40.0 → 0.42.0

package/dist/runtime/approval-signing.js

@@ -0,0 +1,275 @@
+// harness/f9485cc7 — HMAC signing for Understanding Gate / branch-protection
+// approval markers.
+//
+// BACKGROUND: the marker at `harness.generated/.approvals/<id>` is the
+// canonical "operator said go" signal (agent-tasks/88ca4bb3). Its integrity
+// has rested entirely on an UNENFORCED invariant: "no configured MCP exposes
+// a filesystem-write primitive" (understanding-before-execution.md
+// "Approval state"). Edit / Write / Bash are gated by the same PreToolUse
+// hook this marker satisfies, so today the agent has no path to WRITE the
+// marker file. But nothing technical stops a future MCP tool with local
+// file-write from silently reopening that hole: its tool name would not
+// match the pack's `Edit|Write|Bash` blocker matcher, so a write through it
+// would land un-gated. Before this module, the marker's contract was
+// "existence is enough" (see the removed `checkApprovalMarker` comment) —
+// exactly the shape a forger only needs a bare filesystem-write for. This
+// module makes forging also require the operator-side HMAC key, so a marker
+// planted through any write-primitive the blocker does not enumerate still
+// fails the gate unless it carries a valid signature.
+//
+// HONEST TRUST MODEL (read this before assuming more than it delivers):
+//
+//   - This does NOT create a read boundary. The `understanding-before-
+//     execution` PreToolUse blocker matches tool names `Edit|Write|Bash`
+//     only — it does not gate `Read`, and no permission profile in this
+//     repo scopes `Read` away from any path (see
+//     `src/policy-packs/permission-translator.ts`: `read` maps to
+//     `["Read", "Glob", "Grep"]` with `allow:true` in every v1 profile).
+//     So ANY file on local disk — including the signing key, wherever it
+//     lives — is readable by the ordinary, always-available `Read` tool,
+//     approved or not. Storing the key outside `harness.generated/` would
+//     not change this; the write barrier is per-tool-name, not per-path.
+//   - The residual this leaves: an agent (or anything running as the same
+//     OS user) that can (a) read arbitrary local files — true today, by
+//     design, via `Read` — AND (b) write to `harness.generated/.approvals/`
+//     through some primitive NOT covered by the `Edit|Write|Bash` blocker
+//     matcher, CAN forge a validly-signed marker: it reads the key with
+//     Read, computes the HMAC itself, and writes the result through the
+//     uncovered write path. Signing does not close this combined case; it
+//     closes the narrower (and, before this, the ONLY defended) case where
+//     the forger has a write primitive but no matching ability to also
+//     recompute a valid signature for it (e.g. a narrow single-purpose
+//     write channel, or a human/script that copies bytes without reading
+//     back the operator's key file), and it makes ANY forgery attempt one
+//     step more expensive and forensically visible (a key read is a
+//     distinguishable event; a bare unsigned-JSON write no longer is).
+//   - Given the agent and operator share one OS user account on this
+//     machine, this is deliberately pragmatic defense-in-depth, not a hard
+//     authorization boundary. It is documented here in full rather than
+//     oversold.
+//
+// KEY STORAGE: `<generatedDir>/.approval-signing.key` — a raw 32-byte
+// secret, mode 0600, generated lazily on first use (by `harness approve
+// understanding` / `harness approve branch-protection`, or by `harness
+// init` — see src/cli/init/index.ts). Colocated with `harness.generated/`
+// (not a separate home-dir path) so:
+//   - it inherits the SAME test-isolation guarantee every marker/report
+//     path already has (every call site here already threads an explicit,
+//     test-injectable `generatedDir` — no new parameter, no new way to
+//     leak into a real `~/.harness/` during a test run);
+//   - it is gitignored by the SAME existing convention as the rest of
+//     `harness.generated/` (docs/ARCHITECTURE.md: "harness.generated/ ...
+//     is .gitignore'd", unlike `harness.yaml` itself, which operators
+//     often check into a dotfiles repo) — a home-dir-anchored path could
+//     land inside a version-controlled directory when the operator
+//     resolves `harness.yaml` via `--config` into a repo tree; this can't;
+//   - `harness apply` never wipes it (apply only ever writes its own known
+//     files under `harness.generated/`; unknown siblings survive
+//     byte-for-byte — the same guarantee `.approvals/` and
+//     `.pending-approval` already rely on).
+//   `harness uninstall` DOES remove it (it rm -rf's the whole
+//   `generatedDir`) — a deliberate, rare, operator-initiated teardown, so
+//   losing the key (and therefore invalidating every marker it signed) is
+//   an acceptable side effect, not a silent regression.
+//
+// ROTATION: delete `<generatedDir>/.approval-signing.key` (or call
+// `rotateSigningKey`). The next `writeApprovalMarker` /
+// `writeBranchProtectionMarker` / any signature check lazily regenerates
+// it. Every marker signed under the OLD key immediately fails verification
+// (forged:true) and the gate demands re-approval — this is the intended,
+// documented blast radius of a rotation, not a bug.
+//
+// BACK-COMPAT: strict, no migration window. A marker written before this
+// feature shipped (or hand-written without the key) carries no `signature`
+// field and is REJECTED (see `verifyMarkerSignature`), exactly like a
+// forgery. Operator impact: upgrading harness on a machine with a live,
+// previously-approved session invalidates that approval; the operator runs
+// `harness approve understanding` (and/or `harness approve
+// branch-protection`) once more. Chosen over a grace-period migration
+// because a migration window is, by construction, a window where the
+// exact vulnerability this task closes (an unsigned marker satisfies the
+// gate) still holds.
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+/** Versioned algorithm tag, so a future re-key scheme can reject mismatches explicitly rather than guess. */
+export const SIGNING_ALG = "hmac-sha256-v1";
+/** Basename of the signing-key file, a sibling of `.approvals/` under `generatedDir`. */
+export const SIGNING_KEY_BASENAME = ".approval-signing.key";
+const KEY_BYTES = 32;
+/** Filesystem path of the signing key for a given `generatedDir`. */
+export function signingKeyPathFor(generatedDir) {
+    return path.join(generatedDir, SIGNING_KEY_BASENAME);
+}
+/**
+ * Read the signing key, generating one (0600, `crypto.randomBytes(32)`) on
+ * first use. Race-safe-ish: a concurrent create loses the `wx` (exclusive
+ * create) race and falls back to reading whatever the winner wrote, rather
+ * than throwing or clobbering it. A key file shorter than `KEY_BYTES`
+ * (truncated / corrupted) is treated as absent and regenerated, since a
+ * short key would only weaken every future signature.
+ */
+export function getOrCreateSigningKey(generatedDir) {
+    const filePath = signingKeyPathFor(generatedDir);
+    fs.mkdirSync(generatedDir, { recursive: true });
+    let fileExisted = false;
+    try {
+        const existing = fs.readFileSync(filePath);
+        fileExisted = true;
+        if (existing.length >= KEY_BYTES) {
+            return { key: existing, filePath, created: false };
+        }
+        // Falls through: truncated/corrupt key file, regenerate below. `flag:
+        // "w"` (not "wx") is used below precisely BECAUSE the file already
+        // exists here — an exclusive create would collide with it and, on
+        // EEXIST, re-read the SAME truncated bytes back, silently failing to
+        // ever repair a corrupt key.
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    const fresh = crypto.randomBytes(KEY_BYTES);
+    if (fileExisted) {
+        // Known-corrupt/truncated file: overwrite unconditionally. No
+        // meaningful create-race to defend against — the file is already
+        // known bad, so unconditionally replacing it can only improve on
+        // the previous (unusable) contents.
+        fs.writeFileSync(filePath, fresh, { mode: 0o600 });
+        try {
+            fs.chmodSync(filePath, 0o600);
+        }
+        catch {
+            /* best-effort */
+        }
+        return { key: fresh, filePath, created: true };
+    }
+    try {
+        fs.writeFileSync(filePath, fresh, { mode: 0o600, flag: "wx" });
+        return { key: fresh, filePath, created: true };
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            // Lost the create race to a concurrent caller; use what they wrote.
+            return { key: fs.readFileSync(filePath), filePath, created: false };
+        }
+        throw err;
+    }
+}
+/**
+ * Force a fresh key, overwriting any existing one. Every marker signed
+ * under the old key stops verifying immediately (see module doc). Not
+ * currently wired to a CLI verb (documented as "delete the file" for v1);
+ * exported so a future `harness approve rotate-key`-style verb, or a test,
+ * can call it directly without re-deriving the path convention.
+ */
+export function rotateSigningKey(generatedDir) {
+    const filePath = signingKeyPathFor(generatedDir);
+    fs.mkdirSync(generatedDir, { recursive: true });
+    const fresh = crypto.randomBytes(KEY_BYTES);
+    fs.writeFileSync(filePath, fresh, { mode: 0o600 });
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        /* best-effort on platforms where chmod is a no-op (e.g. some Windows fs) */
+    }
+    return { key: fresh, filePath, created: true };
+}
+/** sha256 hex digest of a string, used to bind a marker to a persisted report's content. */
+export function sha256Hex(content) {
+    return crypto.createHash("sha256").update(content, "utf8").digest("hex");
+}
+function canonicalPayload(markerId, approvedAt, approvedBy, reportContentHash) {
+    // Fixed key order + JSON string-escaping makes this injective: there is
+    // no (markerId, approvedAt, approvedBy, reportContentHash) tuple that
+    // collides with a different tuple's encoding, unlike naive delimiter
+    // concatenation (e.g. "a"+"bc" vs "ab"+"c").
+    return JSON.stringify({ markerId, approvedAt, approvedBy, reportContentHash });
+}
+/**
+ * Sign a marker's fields for `markerId` (the marker's lookup key — a raw
+ * sessionId for the understanding-gate session marker, `task-<id>` for a
+ * task-scoped marker, `branch-protection-<sessionId>` for the
+ * branch-protection twin). Binding `markerId` into the signed payload is
+ * what stops a validly-signed marker from being copied/renamed onto a
+ * DIFFERENT id and still verifying — verification always recomputes the
+ * HMAC using the id the caller is checking, not one read back out of the
+ * marker body.
+ */
+export function signMarker(generatedDir, markerId, marker) {
+    const { key } = getOrCreateSigningKey(generatedDir);
+    const reportContentHash = marker.reportContentHash ?? null;
+    const signature = crypto
+        .createHmac("sha256", key)
+        .update(canonicalPayload(markerId, marker.approvedAt, marker.approvedBy, reportContentHash))
+        .digest("hex");
+    return {
+        approvedAt: marker.approvedAt,
+        approvedBy: marker.approvedBy,
+        reportContentHash,
+        alg: SIGNING_ALG,
+        signature,
+    };
+}
+/**
+ * Verify a parsed marker JSON body against `markerId`. Never throws: any
+ * failure to obtain the signing key (permission error, disk issue) is
+ * treated as a verification failure, not an exception — the gate-side
+ * caller must fail closed (not approved) rather than crash the hook
+ * process, which the surrounding PreToolUse blocker would otherwise turn
+ * into an uncontrolled failure mode. That specific failure mode is tagged
+ * `kind: "key-unavailable"` so the caller can tell "we couldn't even check"
+ * apart from "we checked and it's invalid".
+ */
+export function verifyMarkerSignature(generatedDir, markerId, payload) {
+    const approvedAt = payload["approvedAt"];
+    const approvedBy = payload["approvedBy"];
+    const signature = payload["signature"];
+    const alg = payload["alg"];
+    if (typeof approvedAt !== "string" || approvedAt.length === 0) {
+        return { ok: false, reason: "missing approvedAt" };
+    }
+    if (typeof approvedBy !== "string" || approvedBy.length === 0) {
+        return { ok: false, reason: "missing approvedBy" };
+    }
+    if (typeof signature !== "string" || signature.length === 0) {
+        return {
+            ok: false,
+            reason: "missing signature (legacy pre-signing marker, or forged file)",
+        };
+    }
+    if (alg !== SIGNING_ALG) {
+        return { ok: false, reason: `unrecognized or missing alg (got ${JSON.stringify(alg)})` };
+    }
+    const reportContentHash = typeof payload["reportContentHash"] === "string"
+        ? payload["reportContentHash"]
+        : null;
+    let key;
+    try {
+        ({ key } = getOrCreateSigningKey(generatedDir));
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: `signing key unavailable (${err instanceof Error ? err.message : String(err)})`,
+            kind: "key-unavailable",
+        };
+    }
+    const expected = crypto
+        .createHmac("sha256", key)
+        .update(canonicalPayload(markerId, approvedAt, approvedBy, reportContentHash))
+        .digest();
+    // No try/catch around Buffer.from(signature, "hex"): unlike JSON.parse,
+    // Buffer.from with a "hex" encoding never throws on malformed input — it
+    // silently stops decoding at the first invalid pair and returns whatever
+    // it managed to decode so far (review LOW 3). The length-mismatch check
+    // below is what actually rejects a truncated/malformed decode; relying on
+    // an exception here would have been dead code.
+    const actual = Buffer.from(signature, "hex");
+    if (actual.length !== expected.length || !crypto.timingSafeEqual(actual, expected)) {
+        return { ok: false, reason: "signature verification failed (tampered or forged)" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=approval-signing.js.map

package/dist/runtime/approval-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-signing.js","sourceRoot":"","sources":["../../src/runtime/approval-signing.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,iDAAiD;AACjD,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,2EAA2E;AAC3E,wEAAwE;AACxE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,qCAAqC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,yDAAyD;AACzD,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,2DAA2D;AAC3D,4CAA4C;AAC5C,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,qBAAqB;AAErB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AACvD,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,6BAA6B;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,oCAAoC;QACpC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,oEAAoE;YACpE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,iBAAgC;IAEhC,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,6CAA6C;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAAgB,EAChB,MAAqF;IAErF,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC3F,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB;QACjB,GAAG,EAAE,WAAW;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAoBD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,iBAAiB,GACrB,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,OAAO,CAAC,mBAAmB,CAAY;QAC1C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YACvF,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC7E,MAAM,EAAE,CAAC;IACZ,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/runtime/git-context.d.ts

@@ -17,6 +17,27 @@ export interface GitRepoContext {
      */
     sha: string;
 }
+export interface GitEntry {
+    /** Directory that contains the `.git` entry (the work-tree root). */
+    worktreeRoot: string;
+    /** Resolved git directory — for a `.git` file, its `gitdir:` target. */
+    gitDir: string;
+}
+/**
+ * Walk up from `startDir` looking for a `.git` entry. Handles both the
+ * common `.git` directory and the `.git` *file* form used by linked
+ * worktrees and submodules. The walk is bounded so a pathologically
+ * deep cwd cannot spin.
+ *
+ * Exported (task T-001, record-verbs) so `cli/record/index.ts` can
+ * locate the same `.git` directory this module resolves `repo`/
+ * `branch`/`sha` from, without re-walking the tree with duplicate
+ * logic — its base-branch resolution needs the raw git directory (to
+ * read `refs/remotes/origin/HEAD` / `packed-refs`), which
+ * `resolveGitContext`'s return shape does not expose. Behavior is
+ * unchanged; this is a visibility-only change.
+ */
+export declare function findGitEntry(startDir: string): GitEntry | null;
 /**
  * Resolve `{ repo, branch, sha }` for a working directory. Returns empty
  * strings (never throws) when `cwd` is not inside a git work tree, or
@@ -24,3 +45,32 @@ export interface GitRepoContext {
  * fall through to their own behaviour.
  */
 export declare function resolveGitContext(cwd: string): GitRepoContext;
+/**
+ * Resolve the remote's default branch name from `<gitDir>/refs/remotes/
+ * origin/HEAD`. Loose symbolic ref first (the normal shape: `ref: refs/
+ * remotes/origin/<name>`, written by `git clone` / `git remote set-head
+ * origin -a`). When that loose file is absent, falls back to
+ * `packed-refs`: some git versions / tooling pack `refs/remotes/origin/
+ * HEAD` as a plain `<sha> <ref>` entry instead of a symref, which loses
+ * the branch NAME directly — recovered here by matching that sha
+ * against another packed `refs/remotes/origin/<name>` entry that shares
+ * it (mirrors the loose-then-packed shape `resolveBranchSha` uses
+ * above, adapted since packed-refs has no symref concept). Returns null
+ * when neither source resolves a name.
+ */
+export declare function resolveOriginHeadBase(gitDir: string): string | null;
+/**
+ * Resolve the actual shared git directory for `gitDir`, following the
+ * `commondir` file linked worktrees write. `git worktree add` gives each
+ * worktree its own private `.git` FILE pointing at `<main>/.git/
+ * worktrees/<name>/` (what `findGitEntry` returns as `gitDir`), but
+ * `refs/remotes/origin/HEAD` and `packed-refs` are NOT duplicated there
+ * — they live only in the shared common dir, reachable via that
+ * per-worktree directory's own `commondir` file (a path, normally
+ * `../..`, relative to the per-worktree directory itself; see
+ * `git-worktree(1)`). Without this indirection, `resolveOriginHeadBase`
+ * would look for those refs in the empty per-worktree directory and
+ * always miss. Returns `gitDir` unchanged when no `commondir` file
+ * exists (the normal, non-worktree case).
+ */
+export declare function resolveCommonDir(gitDir: string): string;

package/dist/runtime/git-context.js

@@ -35,8 +35,16 @@ const SHA_RE = /^[0-9a-f]{40}$/;
  * common `.git` directory and the `.git` *file* form used by linked
  * worktrees and submodules. The walk is bounded so a pathologically
  * deep cwd cannot spin.
+ *
+ * Exported (task T-001, record-verbs) so `cli/record/index.ts` can
+ * locate the same `.git` directory this module resolves `repo`/
+ * `branch`/`sha` from, without re-walking the tree with duplicate
+ * logic — its base-branch resolution needs the raw git directory (to
+ * read `refs/remotes/origin/HEAD` / `packed-refs`), which
+ * `resolveGitContext`'s return shape does not expose. Behavior is
+ * unchanged; this is a visibility-only change.
  */
-function findGitEntry(startDir) {
+export function findGitEntry(startDir) {
     let dir = path.resolve(startDir);
     for (let depth = 0; depth < 128; depth++) {
         const dotGit = path.join(dir, ".git");
@@ -143,4 +151,103 @@ export function resolveGitContext(cwd) {
     }
     return { repo, branch, sha };
 }
+// ---------------------------------------------------------------------------
+// Default-branch resolution (offline, no `gh`/`git` subprocess).
+//
+// Originally written for `harness record review`'s `--base` fallback
+// (task T-001, record-verbs) and lived only in `cli/record/index.ts`.
+// Exported here (task post-merge-gate, T-001) so
+// `policy-packs/builtin/post-merge-gate-runtime.ts` can resolve the same
+// "what's the default branch to switch back to" answer for its deny
+// message without a policy-pack module reaching into `cli/`. Behavior is
+// unchanged; this is a visibility/location move, not a rewrite — see
+// `findGitEntry`'s doc comment above for the identical precedent
+// (record/index.ts reusing this module's git-dir walk instead of
+// duplicating it).
+// ---------------------------------------------------------------------------
+// `.git/refs/remotes/origin/HEAD` on a normal clone: a symbolic ref
+// pointing at the remote's default branch.
+const ORIGIN_HEAD_REF_RE = /^ref:\s*refs\/remotes\/origin\/(.+)$/;
+const ORIGIN_HEAD_REF_PATH = "refs/remotes/origin/HEAD";
+const ORIGIN_REMOTE_PREFIX = "refs/remotes/origin/";
+/**
+ * Resolve the remote's default branch name from `<gitDir>/refs/remotes/
+ * origin/HEAD`. Loose symbolic ref first (the normal shape: `ref: refs/
+ * remotes/origin/<name>`, written by `git clone` / `git remote set-head
+ * origin -a`). When that loose file is absent, falls back to
+ * `packed-refs`: some git versions / tooling pack `refs/remotes/origin/
+ * HEAD` as a plain `<sha> <ref>` entry instead of a symref, which loses
+ * the branch NAME directly — recovered here by matching that sha
+ * against another packed `refs/remotes/origin/<name>` entry that shares
+ * it (mirrors the loose-then-packed shape `resolveBranchSha` uses
+ * above, adapted since packed-refs has no symref concept). Returns null
+ * when neither source resolves a name.
+ */
+export function resolveOriginHeadBase(gitDir) {
+    try {
+        const raw = fs
+            .readFileSync(path.join(gitDir, "refs", "remotes", "origin", "HEAD"), "utf8")
+            .trim();
+        const match = ORIGIN_HEAD_REF_RE.exec(raw);
+        if (match)
+            return match[1].trim();
+    }
+    catch {
+        /* loose symref missing — try packed-refs */
+    }
+    try {
+        const packed = fs.readFileSync(path.join(gitDir, "packed-refs"), "utf8");
+        let headSha = null;
+        const entries = [];
+        for (const rawLine of packed.split("\n")) {
+            const line = rawLine.trim();
+            if (line === "" || line.startsWith("#") || line.startsWith("^"))
+                continue;
+            const parts = line.split(/\s+/);
+            const sha = parts[0];
+            const ref = parts[1];
+            if (!sha || !ref || !SHA_RE.test(sha))
+                continue;
+            if (ref === ORIGIN_HEAD_REF_PATH)
+                headSha = sha;
+            else
+                entries.push({ sha, ref });
+        }
+        if (headSha) {
+            const match = entries.find((e) => e.sha === headSha && e.ref.startsWith(ORIGIN_REMOTE_PREFIX));
+            if (match)
+                return match.ref.slice(ORIGIN_REMOTE_PREFIX.length);
+        }
+    }
+    catch {
+        /* packed-refs missing too — caller treats null as "unresolvable" */
+    }
+    return null;
+}
+/**
+ * Resolve the actual shared git directory for `gitDir`, following the
+ * `commondir` file linked worktrees write. `git worktree add` gives each
+ * worktree its own private `.git` FILE pointing at `<main>/.git/
+ * worktrees/<name>/` (what `findGitEntry` returns as `gitDir`), but
+ * `refs/remotes/origin/HEAD` and `packed-refs` are NOT duplicated there
+ * — they live only in the shared common dir, reachable via that
+ * per-worktree directory's own `commondir` file (a path, normally
+ * `../..`, relative to the per-worktree directory itself; see
+ * `git-worktree(1)`). Without this indirection, `resolveOriginHeadBase`
+ * would look for those refs in the empty per-worktree directory and
+ * always miss. Returns `gitDir` unchanged when no `commondir` file
+ * exists (the normal, non-worktree case).
+ */
+export function resolveCommonDir(gitDir) {
+    try {
+        const raw = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
+        if (raw.length > 0) {
+            return path.isAbsolute(raw) ? raw : path.resolve(gitDir, raw);
+        }
+    }
+    catch {
+        /* no commondir file — gitDir already IS the common dir */
+    }
+    return gitDir;
+}
 //# sourceMappingURL=git-context.js.map

package/dist/runtime/git-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/runtime/git-context.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,mDAAmD;AAEnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBlC,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEhE,uEAAuE;AACvE,yBAAyB;AACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,sEAAsE;AACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC;;;;;GAKG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,KAAK;oBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAChE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;gBAC1B,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/runtime/git-context.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,mDAAmD;AAEnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBlC,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEhE,uEAAuE;AACvE,yBAAyB;AACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,sEAAsE;AACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,KAAK;oBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAChE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;gBAC1B,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,iDAAiD;AACjD,yEAAyE;AACzE,oEAAoE;AACpE,yEAAyE;AACzE,qEAAqE;AACrE,iEAAiE;AACjE,iEAAiE;AACjE,mBAAmB;AACnB,8EAA8E;AAE9E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE;aACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAC5E,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChD,IAAI,GAAG,KAAK,oBAAoB;gBAAE,OAAO,GAAG,GAAG,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACnE,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/hermetic-spawn-guard.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Thrown by {@link assertNoRealSpawnInTests} when a real-spawn code path
+ * runs under vitest without a test-injected fake. Callers whose
+ * surrounding try/catch degrades ordinary runner failures to a warning
+ * MUST re-throw instances of this class past that catch — never let it
+ * be treated as an ordinary (optional, warn-and-continue) failure.
+ */
+export declare class HermeticSpawnViolationError extends Error {
+    constructor(binaryLabel: string, hint: string);
+}
+/**
+ * Guard for a "real spawn" implementation: throws
+ * {@link HermeticSpawnViolationError} when called under vitest, so an
+ * accidental real spawn in a test fails hard instead of silently
+ * running. No-op outside of vitest (production behavior is unchanged),
+ * and no-op when `HARNESS_ALLOW_REAL_SPAWN=1` is set (see module doc) —
+ * the first such no-op under vitest prints a one-time stderr warning so
+ * the disabled guard is visible rather than silent.
+ *
+ * @param binaryLabel human-readable name of what would be spawned (e.g.
+ *   `"npx orchestrator-workflow init"`), used in the error message.
+ * @param hint one line telling the test author what to do instead (e.g.
+ *   "inject a fake `owInitSpawn` runner").
+ */
+export declare function assertNoRealSpawnInTests(binaryLabel: string, hint: string): void;