@lannguyensi/harness 0.40.0 → 0.42.0

package/dist/runtime/recovery-git-commit.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Classify a Bash/shell command string as the narrow "recovery commit"
+ * shape: a bare, unchained `git commit` invocation carrying only
+ * `-a`/`--all`/`--allow-empty` and one or more `-m`/`--message`/`-am`
+ * message flags. `true` means the understanding-gate PreToolUse hooks
+ * may admit this ONE call without a fresh Understanding Report, provided
+ * the caller has already established that this session/task had a real
+ * (now-expired) operator approval — see module header for the full
+ * safety argument and why that precondition is load-bearing.
+ *
+ * A properly single- or double-quoted `-m`/`--message` value may contain
+ * ANY text, including characters like `<`/`>`/`;`/`&`/`|` that would be
+ * dangerous unquoted — that is what lets a real trailer such as
+ * `Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>` through (see
+ * `hasUnsafeMetachar`'s doc for the exact quote-aware rule). Anything
+ * outside this narrow shape — `--amend`, `--no-verify`, `-C <dir>`
+ * (rejected implicitly: it does not appear directly after `git commit`),
+ * a pathspec, UNQUOTED chaining/redirection, command substitution that
+ * is live where it appears, an unrecognised flag — fails closed
+ * (`false`) and the caller falls through to the ordinary hard block.
+ */
+export declare function isRecoveryGitCommit(command: string): boolean;

package/dist/runtime/recovery-git-commit.js

@@ -0,0 +1,284 @@
+// Recovery git-commit exemption for the understanding-gate PreToolUse
+// hooks (task 6e888423).
+//
+// The problem: `approval_lifecycle.max_age` (default 4h, see
+// src/cli/init/templates.ts) expires the operator-approval MARKER
+// independently of any task-completion boundary. That is by design for
+// genuinely new work — a session idle for hours should re-justify itself
+// before its next Edit/Write/Bash. But it also fires mid-task, e.g. while
+// an agent is deep in a reviewer-amendment loop (apply fixes, wait on CI,
+// iterate again) that outlives the window. When the marker ages out at
+// exactly the moment the agent needs to run the recovery `git commit`
+// that consolidates already-approved Edit/Write output into a new HEAD
+// (so `preflight` / solution-acceptance can re-pin their verdict there),
+// the gate hard-blocks that Bash call — including the recovery commit
+// itself — and only the operator can unblock it (agent-grounding
+// frictions #2/#9/#58/#71).
+//
+// The fix is narrow on purpose. A `git commit` records whatever is
+// ALREADY sitting in the working tree; it introduces no new file
+// content. Every byte in that working tree was necessarily produced by
+// an Edit/Write/Bash call that was itself gated at the time it ran, so
+// letting a bare, unchained `git commit` through does not let unreviewed
+// content sneak past the Understanding Gate — it only lets the agent
+// finish recording work that was already approved once. This is
+// deliberately NOT a blanket "any Bash whitelist" or "ignore
+// max_age" fix:
+//   - The caller (hook-pre-tool-use.ts / hook-codex-pre-tool-use.ts)
+//     gates this classifier behind `expired === true` from
+//     `checkOperatorApprovalMarkers` — i.e. a real operator-written
+//     marker for THIS session/task existed and simply aged past
+//     max_age. A session that was NEVER approved (marker absent) gets
+//     no exemption: `isRecoveryGitCommit` alone is not a bypass, it
+//     only matters once the caller has already proven prior approval.
+//   - A marker CLEARED by a task-completion boundary tool
+//     (`task_finish`, `pull_requests_merge`, ...) reads as "missing",
+//     not "expired" (`clearApprovalMarker` deletes the file rather than
+//     leaving a stale one behind). The exemption therefore does not
+//     fire for a fresh task's first commit — the gate still re-arms
+//     exactly as `approval_lifecycle` intends.
+//   - Edit / Write and every other Bash shape stay hard-gated
+//     regardless of this exemption; only the exact `git commit`
+//     invocation classified below is admitted.
+//   - The matcher refuses chaining (`;`, `&`, `|`, `&&`, `||`) and
+//     redirection (`<`, `>`) that appear OUTSIDE a quoted span, and
+//     command substitution (backtick, `$(...)`) that appears outside a
+//     quote OR inside a DOUBLE-quoted span (both are still expanded by
+//     bash there) — so a compound command cannot ride a legitimate
+//     commit past the gate. `;`/`&`/`|`/`<`/`>` are treated as literal
+//     when they appear inside a quoted span (single OR double), exactly
+//     as bash treats them: this is what lets a real commit-message
+//     trailer like `Co-Authored-By: Claude Fable 5
+//     <noreply@anthropic.com>` (this very repo's own commit convention)
+//     through a quoted `-m` value without opening a metachar hole,
+//     because git only ever sees the trailer as inert message text, not
+//     as shell syntax. A backtick or `$(` inside a SINGLE-quoted span is
+//     also literal (single quotes suppress all expansion) and therefore
+//     safe to admit. Newlines are rejected unconditionally regardless of
+//     quoting (see `isRecoveryGitCommit`): multiple `-m` flags are the
+//     supported shape for a multi-paragraph message, so no caller needs
+//     an embedded newline inside one quoted token. The matcher also
+//     fails closed on any flag it does not recognise, in particular
+//     `--amend` (rewrites a commit that may have been approved under an
+//     entirely different, unrelated window) and `--no-verify` (skips
+//     local hooks, which this exemption has no mandate to waive — see
+//     AGENTS.md "no workarounds").
+//   - ANY backslash in the command rejects the whole thing outright, in
+//     `isRecoveryGitCommit` before the quote-aware scan even runs. The
+//     quote-toggling in `hasUnsafeMetachar`/`tokenize` has no concept of
+//     backslash-escaping, so a payload like `git commit -am a\" ; echo
+//     INJECTED ; \"` was, for one commit on this branch, misclassified
+//     as a single safely-quoted message — the classifier "entered" a
+//     phantom quote span at the escaped `"` and read the live `;` inside
+//     it as literal text, while bash itself never entered a quote at all
+//     and executed `echo INJECTED` as a separate command (confirmed
+//     end-to-end for `;`, `||`, and `|`). Rejecting every backslash
+//     up front closes the whole escape-based attack surface: without a
+//     backslash present, naive quote-toggling matches bash's real
+//     quoting exactly. A hand-rolled bash-accurate escape state machine
+//     is deliberately NOT built here — too risky for a security boundary
+//     to get subtly wrong twice.
+/** Flags that take no following value. */
+const FLAG_ONLY_TOKENS = new Set(["-a", "--all", "--allow-empty"]);
+/**
+ * Flags that consume the NEXT token as their value. `-am` is the common
+ * combined `-a -m` shorthand — the LAST flag in a short-option cluster is
+ * the one that takes an argument, so `-am <value>` clusters to `-a` (no
+ * value) followed by `-m <value>` exactly like a real shell/getopt would
+ * parse it. `-ma` is deliberately NOT included: there `-m` is NOT last in
+ * the cluster, so getopt takes the cluster's OWN remainder ("a") as `-m`'s
+ * value and the flag `-a` is never set at all — the next token (the
+ * agent's intended message) would be consumed by git as a pathspec
+ * instead, silently restricting the commit to files matching that
+ * pathspec. Admitting `-ma` here would therefore misclassify a command
+ * whose ACTUAL git semantics differ from what this exemption assumes.
+ * Multiple `-m`/`--message` occurrences are allowed (git concatenates
+ * them as separate paragraphs — the idiomatic way to express a subject
+ * line, a body, and a trailer such as `Co-Authored-By:` without embedding
+ * a literal newline in one token).
+ */
+const MESSAGE_FLAG_TOKENS = new Set(["-m", "--message", "-am"]);
+/**
+ * Quote-aware scan for shell metacharacters that are unsafe given WHERE
+ * they appear. Unlike a flat regex, this walks the string tracking
+ * whether we are inside a single-quoted span, a double-quoted span, or
+ * neither:
+ *   - Outside any quote: `;`, `&`, `|`, `<`, `>`, backtick, and `$(` are
+ *     all live shell syntax — any of them is unsafe.
+ *   - Inside a single-quoted span: everything is inert (bash disables
+ *     ALL expansion inside single quotes, including backtick and `$(`),
+ *     so nothing here is unsafe.
+ *   - Inside a double-quoted span: `;`, `&`, `|`, `<`, `>` are literal
+ *     characters (bash does NOT treat them specially inside double
+ *     quotes) and therefore safe, but backtick and `$(` are STILL
+ *     expanded by bash inside double quotes and therefore still unsafe.
+ * An unterminated quote (the scan ends still "inside" one) is itself
+ * unsafe: the caller's tokenizer performs the authoritative parse and
+ * would also reject it, but this scan must not silently pass through
+ * content it could not fully account for.
+ */
+function hasUnsafeMetachar(command) {
+    let quote = null;
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (quote === "'") {
+            if (ch === "'")
+                quote = null;
+            continue; // single-quoted: fully inert, including ` and $(
+        }
+        if (quote === '"') {
+            if (ch === '"') {
+                quote = null;
+                continue;
+            }
+            if (ch === "`")
+                return true;
+            if (ch === "$" && command[i + 1] === "(")
+                return true;
+            continue; // ; & | < > are literal inside double quotes
+        }
+        // Outside any quote: every metacharacter is live.
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === ";" || ch === "&" || ch === "|" || ch === "<" || ch === ">")
+            return true;
+        if (ch === "`")
+            return true;
+        if (ch === "$" && command[i + 1] === "(")
+            return true;
+    }
+    return quote !== null; // unterminated quote: unsafe/unparseable
+}
+/**
+ * Quote-aware tokenizer for the residual argv after `git commit`, mimicking
+ * plain shell word-splitting: a "word" runs until unquoted whitespace, and a
+ * quoted region (single OR double quotes) within a word contributes its
+ * literal contents to that same word, quotes stripped. This is what lets
+ * both the standalone-token shape (`-m "a message"`) and the glued shape
+ * (`--message="a message"`, where the shell concatenates the flag prefix
+ * and the quoted value into ONE argv word) tokenize the same way a real
+ * shell would. An unterminated quote fails the parse (`null`); the caller
+ * treats that as "not a recognised recovery commit" and falls through to
+ * the ordinary gate block rather than guessing at the intended word.
+ */
+function tokenize(rest) {
+    const tokens = [];
+    const n = rest.length;
+    let i = 0;
+    while (i < n) {
+        while (i < n && /\s/.test(rest[i]))
+            i += 1;
+        if (i >= n)
+            break;
+        let token = "";
+        while (i < n && !/\s/.test(rest[i])) {
+            const ch = rest[i];
+            if (ch === '"' || ch === "'") {
+                const close = rest.indexOf(ch, i + 1);
+                if (close === -1)
+                    return null;
+                token += rest.slice(i + 1, close);
+                i = close + 1;
+                continue;
+            }
+            token += ch;
+            i += 1;
+        }
+        tokens.push(token);
+    }
+    return tokens;
+}
+/**
+ * Classify a Bash/shell command string as the narrow "recovery commit"
+ * shape: a bare, unchained `git commit` invocation carrying only
+ * `-a`/`--all`/`--allow-empty` and one or more `-m`/`--message`/`-am`
+ * message flags. `true` means the understanding-gate PreToolUse hooks
+ * may admit this ONE call without a fresh Understanding Report, provided
+ * the caller has already established that this session/task had a real
+ * (now-expired) operator approval — see module header for the full
+ * safety argument and why that precondition is load-bearing.
+ *
+ * A properly single- or double-quoted `-m`/`--message` value may contain
+ * ANY text, including characters like `<`/`>`/`;`/`&`/`|` that would be
+ * dangerous unquoted — that is what lets a real trailer such as
+ * `Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>` through (see
+ * `hasUnsafeMetachar`'s doc for the exact quote-aware rule). Anything
+ * outside this narrow shape — `--amend`, `--no-verify`, `-C <dir>`
+ * (rejected implicitly: it does not appear directly after `git commit`),
+ * a pathspec, UNQUOTED chaining/redirection, command substitution that
+ * is live where it appears, an unrecognised flag — fails closed
+ * (`false`) and the caller falls through to the ordinary hard block.
+ */
+export function isRecoveryGitCommit(command) {
+    const trimmed = command.trim();
+    if (trimmed === "")
+        return false;
+    if (trimmed.includes("\n") || trimmed.includes("\r"))
+        return false;
+    // CRITICAL (found on re-review of the quote-aware rewrite): reject ANY
+    // backslash before doing anything else. `hasUnsafeMetachar` and
+    // `tokenize` both toggle quote state on every `"`/`'` character with no
+    // concept of backslash-escaping, but bash does: `\"` outside a quote is
+    // a LITERAL `"` that does NOT open a quote context. Without this
+    // check, a payload like `git commit -am a\" ; echo INJECTED ; \"` gets
+    // classified as one big safely-quoted message (the classifier "enters"
+    // a phantom quote span at the escaped `"` and treats the live `;`
+    // inside it as literal), while bash itself never entered a quote at
+    // all and executes `echo INJECTED` as a separate command — confirmed
+    // end-to-end (classifier ADMIT + a live shell actually running the
+    // injected command) for `;`, `||`, and `|` riding this exact shape.
+    // Same bug class the 0.40.0 CHANGELOG already documents once for the
+    // `harness approve` heredoc matcher (a backslash-escaped redirect
+    // smuggled past a quote-blind check there too).
+    //
+    // The fix is deliberately blunt rather than a full escape-aware state
+    // machine: modeling bash's actual backslash rules (live outside
+    // quotes and inside double quotes for a few characters, entirely inert
+    // inside single quotes, `$'...'` ANSI-C quoting has its own escape
+    // grammar again) is exactly the kind of bash-parser-in-miniature this
+    // module's design explicitly avoids building for a security boundary.
+    // Without any backslash present, the naive quote-toggling in
+    // `hasUnsafeMetachar`/`tokenize` matches bash's real quoting exactly,
+    // so rejecting every backslash closes the whole escape-based attack
+    // surface at the cost of not admitting messages that happen to contain
+    // one — an acceptable narrowing (the documented main case, this repo's
+    // own `Co-Authored-By: ... <noreply@anthropic.com>` trailer, has no
+    // backslash) for a fail-closed exemption gate.
+    if (trimmed.includes("\\"))
+        return false;
+    if (hasUnsafeMetachar(trimmed))
+        return false;
+    const m = /^git\s+commit\b/.exec(trimmed);
+    if (!m)
+        return false;
+    const rest = trimmed.slice(m[0].length);
+    const tokens = tokenize(rest);
+    if (tokens === null)
+        return false;
+    let i = 0;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (FLAG_ONLY_TOKENS.has(t)) {
+            i += 1;
+            continue;
+        }
+        if (MESSAGE_FLAG_TOKENS.has(t)) {
+            i += 1;
+            if (i >= tokens.length)
+                return false; // dangling flag, no message value
+            i += 1; // consume the message token (already quote-aware metachar-screened above)
+            continue;
+        }
+        if (/^--message=.+/.test(t)) {
+            i += 1;
+            continue;
+        }
+        // Unrecognised token (e.g. --amend, --no-verify, a pathspec, an
+        // unknown flag): fail closed.
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=recovery-git-commit.js.map

package/dist/runtime/recovery-git-commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-git-commit.js","sourceRoot":"","sources":["../../src/runtime/recovery-git-commit.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,yBAAyB;AACzB,EAAE;AACF,6DAA6D;AAC7D,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,iEAAiE;AACjE,4BAA4B;AAC5B,EAAE;AACF,mEAAmE;AACnE,iEAAiE;AACjE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,gEAAgE;AAChE,6DAA6D;AAC7D,gBAAgB;AAChB,qEAAqE;AACrE,2DAA2D;AAC3D,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,oEAAoE;AACpE,+CAA+C;AAC/C,8DAA8D;AAC9D,gEAAgE;AAChE,+CAA+C;AAC/C,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,oEAAoE;AACpE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,mCAAmC;AACnC,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,oEAAoE;AACpE,oEAAoE;AACpE,uEAAuE;AACvE,kEAAkE;AAClE,wEAAwE;AACxE,yEAAyE;AACzE,iCAAiC;AAEjC,0CAA0C;AAC1C,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC7B,SAAS,CAAC,iDAAiD;QAC7D,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtD,SAAS,CAAC,6CAA6C;QACzD,CAAC;QACD,kDAAkD;QAClD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpF,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,yCAAyC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAClB,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACpB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC9B,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,KAAK,IAAI,EAAE,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,uEAAuE;IACvE,gEAAgE;IAChE,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,gDAAgD;IAChD,EAAE;IACF,sEAAsE;IACtE,gEAAgE;IAChE,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,sEAAsE;IACtE,6DAA6D;IAC7D,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAElC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;YACxE,CAAC,IAAI,CAAC,CAAC,CAAC,0EAA0E;YAClF,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,gEAAgE;QAChE,8BAA8B;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/tool-name-aliases.d.ts

@@ -1,3 +1,4 @@
+export declare const SHELL_ALIASES: readonly ["Bash", "shell", "exec_command", "functions.exec_command"];
 export declare function expandToolNameAliases(toolName: string): string[];
 export declare function expandCodexHookMatchPattern(match: string): string;
 export declare function extractShellCommand(event: {

package/dist/runtime/tool-name-aliases.js

@@ -1,4 +1,10 @@
-const SHELL_ALIASES = [
+// Canonical shell-tool alias set: Claude Code's single "Bash" tool plus
+// the Codex shell-tool names current runtimes emit. Exported so callers
+// elsewhere in the layering (e.g. policy-packs/builtin, which may import
+// from runtime/ but not from cli/) can derive their own shell-alias
+// lists from this one definition instead of hand-copying the literal
+// array (task bea04a03 review finding).
+export const SHELL_ALIASES = [
     "Bash",
     "shell",
     "exec_command",

package/dist/runtime/tool-name-aliases.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-name-aliases.js","sourceRoot":"","sources":["../../src/runtime/tool-name-aliases.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CAChB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAgB,EAAE,QAAgB;IACzD,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,KAAK,MAAM,KAAK,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,QAAgB;IACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB;IAEhB,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/B,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC1D,MAAM,IAAI,GAAG,SAAiD,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"tool-name-aliases.js","sourceRoot":"","sources":["../../src/runtime/tool-name-aliases.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,wCAAwC;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CAChB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAgB,EAAE,QAAgB;IACzD,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,KAAK,MAAM,KAAK,IAAI,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,QAAgB;IACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB;IAEhB,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/B,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC1D,MAAM,IAAI,GAAG,SAAiD,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}