@lannguyensi/harness 0.41.0 → 0.43.0

package/dist/cli/pack/hook-post-merge-gate-record.js

@@ -0,0 +1,153 @@
+// `harness pack hook post-merge-gate-record` — PostToolUse producer for
+// the `post-merge-gate` policy pack.
+//
+// Receives Claude Code's PostToolUse event JSON on stdin. Fires only when
+// the just-completed tool was Bash AND the command matched `gh pr merge`
+// AND the merge is CONFIRMED by one of two contracts (see
+// `resolveMergeConfirmation` in post-merge-gate-runtime.ts, "PAYLOAD
+// REALITY" follow-up):
+//
+//   Contract A (original, unchanged): `tool_output.exit_code === 0`.
+//   Contract B (2.1.218 payload reality): `tool_response` present with
+//     `interrupted === false` AND `stdout`+`stderr` containing `gh pr
+//     merge`'s own past-tense success sentence (all three merge methods).
+//
+// Contract A wins whenever it resolves to any definite verdict (success
+// OR failure); Contract B is consulted only when Contract A's exit_code
+// is entirely unresolvable. On a confirmed merge, records a
+// `post-merge-gate:merged:<repo>:<branch>:<sha>` fact (plus PR number and
+// timestamp, audit-only) to the evidence ledger via the same
+// Trusted-Writer path `harness session-start branch-check` /
+// `harness record *` use (`resolveManifestLedgerWriter` /
+// `addLedgerFact`) — never an agent-issued `ledger_add`.
+//
+// `<sha>` is the LOCAL branch tip observed right after the tool ran:
+// `gh pr merge` merges the PR on the remote side and does not itself move
+// the local branch pointer, so this IS the exact commit that got merged
+// (see post-merge-gate-runtime.ts's header for the full squash-fest
+// rationale — no ancestry walk, no `git` subprocess).
+//
+// Every non-match / failure path is a no-op: wrong tool, non-matching
+// command, neither contract confirms, an unresolvable git context, no
+// session id, a manifest/ledger failure. `PostToolUse` is `blocking:false`
+// by contract (see the pack's Hook entry) so none of these ever break the
+// session; the only observable effect of a miss is that the blocker has
+// no merged-tip fact to compare against for this particular merge.
+import { buildMergedTagContent, GH_PR_MERGE_BASH_RE, PACK_NAME, resolveMergeConfirmation, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
+import { resolveGitContext } from "../../runtime/git-context.js";
+import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
+import { checkHookPause, loadManifestOrInjected, readStdin } from "./hook-bootstrap.js";
+const LEDGER_SOURCE = "harness-pack-hook-post-merge-gate-record";
+function bashCommandOf(toolInput) {
+    if (typeof toolInput !== "object" || toolInput === null)
+        return "";
+    const cmd = toolInput["command"];
+    return typeof cmd === "string" ? cmd : "";
+}
+export async function runPackHookPostMergeGateRecordCli(opts = {}) {
+    const stdin = opts.stdin ?? process.stdin;
+    const stderr = opts.stderr ?? process.stderr;
+    const note = (msg) => {
+        stderr.write(`harness pack hook post-merge-gate-record: ${msg}\n`);
+    };
+    const raw = await readStdin(stdin);
+    let event = {};
+    try {
+        event = JSON.parse(raw.trim() || "{}");
+    }
+    catch {
+        const diagnostic = "malformed event JSON, skipping";
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    // Pause sentinel — mirrors every other pack hook's operator kill-switch.
+    if (checkHookPause(PACK_NAME, stderr, opts, opts.generatedDir).paused) {
+        const diagnostic = "harness paused; post-merge-gate-record skipping without evaluating.";
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    const toolName = typeof event.tool_name === "string" ? event.tool_name : "";
+    if (toolName !== "Bash") {
+        const diagnostic = `tool ${toolName || "(unknown)"} is not Bash, skipping`;
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    const command = bashCommandOf(event.tool_input);
+    if (!command || !GH_PR_MERGE_BASH_RE.test(command)) {
+        const diagnostic = "command did not match gh pr merge, skipping";
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    // The confirmed-success gate: neither contract confirming — including
+    // any unresolvable / unexpected payload shape on either — writes NO
+    // fact. Fail-safe against a false "merged" record, which would be a
+    // self-lock in the wrong direction (03-decisions.md). See
+    // resolveMergeConfirmation's own doc comment for the dual-contract /
+    // "Contract A wins" ordering decision.
+    const confirmation = resolveMergeConfirmation(event.tool_output, event.tool_response, command);
+    if (!confirmation.confirmed) {
+        const diagnostic = `not a confirmed merge success (${confirmation.reason}); skipping (no fact written)`;
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
+        ? opts.cwd
+        : typeof event.cwd === "string" && event.cwd.length > 0
+            ? event.cwd
+            : process.cwd();
+    const { repo, branch, sha } = resolveGitContext(cwd);
+    if (repo === "" || branch === "" || sha === "") {
+        const diagnostic = `cannot resolve git context for ${cwd} ` +
+            `(repo=${JSON.stringify(repo)} branch=${JSON.stringify(branch)} sha=${JSON.stringify(sha)}); ` +
+            `skipping (no fact written)`;
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    const sessionId = (typeof event.session_id === "string" && event.session_id.length > 0
+        ? event.session_id
+        : undefined) ??
+        process.env.CLAUDE_CODE_SESSION_ID ??
+        process.env.CLAUDE_SESSION_ID ??
+        "";
+    if (sessionId === "") {
+        const diagnostic = "no session_id resolvable from stdin or $CLAUDE_CODE_SESSION_ID/$CLAUDE_SESSION_ID; skipping (no fact written)";
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    // PR number: resolveMergeConfirmation already applied the binding
+    // resolution order (command-first, gh-success-sentence fallback only
+    // for Contract B; Contract A stays command-only, unchanged).
+    const whenIso = (opts.now ?? new Date()).toISOString();
+    const content = buildMergedTagContent({ repo, branch, sha, pr: confirmation.pr, whenIso });
+    let writeLedger = opts.writeLedger;
+    if (!writeLedger) {
+        let manifest;
+        try {
+            ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
+        }
+        catch (err) {
+            const diagnostic = `manifest load failed (${err.message}); skipping (no fact written)`;
+            note(diagnostic);
+            return { exitCode: 0, wrote: false, diagnostic };
+        }
+        const resolved = resolveManifestLedgerWriter(manifest, {
+            ...(opts.ledgerTimeoutMs !== undefined ? { ledgerTimeoutMs: opts.ledgerTimeoutMs } : {}),
+        });
+        if (!resolved.ok) {
+            const diagnostic = `${resolved.reason}; cannot record ${content}`;
+            note(diagnostic);
+            return { exitCode: 0, wrote: false, diagnostic };
+        }
+        writeLedger = resolved.write;
+    }
+    const result = await writeLedger({ sessionId, content, source: LEDGER_SOURCE });
+    if (!result.ok) {
+        const diagnostic = `ledger write failed: ${result.reason ?? "unknown error"}`;
+        note(diagnostic);
+        return { exitCode: 0, wrote: false, diagnostic };
+    }
+    const diagnostic = `recorded ${content} for session ${sessionId}`;
+    note(diagnostic);
+    return { exitCode: 0, wrote: true, diagnostic };
+}
+//# sourceMappingURL=hook-post-merge-gate-record.js.map

package/dist/cli/pack/hook-post-merge-gate-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-post-merge-gate-record.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate-record.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,0DAA0D;AAC1D,qEAAqE;AACrE,uBAAuB;AACvB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,4DAA4D;AAC5D,0EAA0E;AAC1E,6DAA6D;AAC7D,6DAA6D;AAC7D,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AAGjG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExF,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAyCjE,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,gCAAgC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,qEAAqE,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,QAAQ,QAAQ,IAAI,WAAW,wBAAwB,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,kCAAkC,YAAY,CAAC,MAAM,+BAA+B,CAAC;QACxG,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GACd,kCAAkC,GAAG,GAAG;YACxC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;YAC9F,4BAA4B,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,+GAA+G,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3F,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,+BAA+B,CAAC;YAClG,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,mBAAmB,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC"}

package/dist/cli/pack/hook-post-merge-gate.d.ts

@@ -0,0 +1,28 @@
+import { type LedgerEntry } from "../../policies/index.js";
+import { type Manifest } from "../../schema/index.js";
+import { type LoaderOptions } from "../loader.js";
+export interface PackHookPostMergeGateOptions extends LoaderOptions {
+    /** Defaults to process.stdin. */
+    stdin?: NodeJS.ReadableStream;
+    /** Defaults to process.stdout. */
+    stdout?: NodeJS.WritableStream;
+    /** Defaults to process.stderr. */
+    stderr?: NodeJS.WritableStream;
+    /** Override cwd resolution (test injection). Falls back to event.cwd then process.cwd(). */
+    cwd?: string;
+    /** Per-call ledger timeout in ms. */
+    ledgerTimeoutMs?: number;
+    /** Inject a manifest (test). */
+    manifest?: Manifest;
+    /** Inject a fake ledger query (test). */
+    ledgerQuery?: (sessionId: string) => Promise<LedgerEntry[] | {
+        degraded: string;
+    }>;
+}
+export interface PackHookPostMergeGateResult {
+    exitCode: number;
+    blocked: boolean;
+    /** Diagnostic line emitted to stderr (always, even on allow). */
+    diagnostic: string;
+}
+export declare function runPackHookPostMergeGateCli(opts?: PackHookPostMergeGateOptions): Promise<PackHookPostMergeGateResult>;

package/dist/cli/pack/hook-post-merge-gate.js

@@ -0,0 +1,244 @@
+// `harness pack hook post-merge-gate` — PreToolUse blocker for the
+// `post-merge-gate` policy pack.
+//
+// Receives Claude Code's PreToolUse event JSON on stdin and emits a
+// `{ decision: "block" }` envelope when a CURATED history-mutating Bash
+// command is about to run on a branch whose current tip exactly matches
+// a merged-tip fact the producer recorded (see hook-post-merge-gate-record.ts).
+//
+// Evaluation order — deliberate, and pinned by the self-lock test suite:
+//
+//   1. Parse stdin. Malformed JSON, a non-Bash tool, or an empty command
+//      all ALLOW immediately (nothing to classify).
+//   2. Pause sentinel (operator kill-switch) — same convention as every
+//      other pack hook.
+//   3. ESCAPE ALLOWLIST — checked BEFORE manifest load, pack lookup, or
+//      any ledger query. `git switch`/`checkout`/`pull`/`fetch`,
+//      `git branch -d`/`-D`, `git stash list`/`show`, and any
+//      `harness ...` command ALWAYS pass, unconditionally, with NO
+//      dependency on whether the manifest or the ledger are reachable.
+//      This is the recovery path the deny message itself recommends; it
+//      must never be starved by an unrelated failure (the incident class
+//      this guards against: a different gate once got blocked alongside
+//      its own recovery command, and only the operator could unstick it).
+//   4. CURATED MUTATION MATCH — commands outside the curated list
+//      (git commit/add/push/merge/rebase/cherry-pick/revert/reset/
+//      stash pop|apply, gh pr create/merge) pass through untouched.
+//   5. Manifest load, pack-enabled check, git-context resolution
+//      (detached HEAD / no-repo ALLOWS — nothing to compare), then the
+//      ledger query.
+//   6. DENY only when the current branch tip exactly matches a recorded
+//      `post-merge-gate:merged:<repo>:<branch>:<sha>` fact.
+//
+// Fail posture: OPEN. A manifest-load failure or a degraded ledger both
+// ALLOW (with a stderr warning) — the inverse of branch-protection's
+// fail-closed contract. Without the ledger, "merged" and "not merged" are
+// indistinguishable, and fail-closed here would block ordinary git
+// history work on every branch whenever grounding-mcp hiccups. See
+// post-merge-gate-runtime.ts's header for the full rationale.
+import { isCuratedMutationCommand, isEscapeCommand, MERGED_TAG_PREFIX, mergedTagMatchKey, PACK_NAME, resolveDefaultBranchName, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
+import { queryLedgerByTag } from "../../policies/index.js";
+import { resolveGitContext } from "../../runtime/git-context.js";
+import { renderAgentFacing } from "../../runtime/agent-facing.js";
+import { POLICY_DECISION_TYPE } from "../../runtime/ledger-record.js";
+import { checkHookPause, loadManifestOrInjected, parseConfigUx, readStdin } from "./hook-bootstrap.js";
+const DEFAULT_BRANCH_PLACEHOLDER = "<default-branch>";
+function bashCommandOf(toolInput) {
+    if (typeof toolInput !== "object" || toolInput === null)
+        return "";
+    const cmd = toolInput["command"];
+    return typeof cmd === "string" ? cmd : "";
+}
+function findGroundingMcp(manifest) {
+    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
+}
+function evaluateEntries(entries, matchKey) {
+    for (const e of entries) {
+        // Skip policy_decision audit rows — a past DENIED decision this very
+        // pack recorded would otherwise incidentally carry the match key in
+        // its serialized payload, falsely satisfying itself. Same two-tier
+        // filter branch-protection's blocker uses (type first, legacy
+        // content-prefix backstop second).
+        if (e.type === POLICY_DECISION_TYPE)
+            continue;
+        if (e.content.startsWith(`${POLICY_DECISION_TYPE}:`))
+            continue;
+        if (e.content.includes(matchKey)) {
+            return { merged: true, matchedContent: e.content, degraded: null };
+        }
+    }
+    return { merged: false, matchedContent: null, degraded: null };
+}
+async function probeLedger(manifest, sessionId, matchKey, opts) {
+    if (opts.ledgerQuery) {
+        const r = await opts.ledgerQuery(sessionId);
+        if ("degraded" in r) {
+            return { merged: false, matchedContent: null, degraded: r.degraded };
+        }
+        return evaluateEntries(r, matchKey);
+    }
+    if (!manifest) {
+        return { merged: false, matchedContent: null, degraded: "manifest unavailable" };
+    }
+    const server = findGroundingMcp(manifest);
+    if (!server) {
+        return { merged: false, matchedContent: null, degraded: "grounding-mcp not declared in manifest" };
+    }
+    const command = Array.isArray(server.command)
+        ? server.command
+        : server.command.trim().split(/\s+/);
+    const env = server.env ?? undefined;
+    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
+    const result = await queryLedgerByTag({
+        mcpCommand: command,
+        ...(env && { mcpEnv: env }),
+        sessionId,
+        timeoutMs,
+    });
+    if (result.kind === "degraded") {
+        return { merged: false, matchedContent: null, degraded: result.reason };
+    }
+    return evaluateEntries(result.entries, matchKey);
+}
+function blockJson(toolName, command, branch, defaultBranch, matchedContent, ux, sessionId) {
+    let reasonText;
+    if (ux) {
+        reasonText = renderAgentFacing(ux, {
+            BRANCH: branch,
+            DEFAULT_BRANCH: defaultBranch,
+            TOOL_NAME: toolName,
+            SESSION_ID: sessionId,
+        });
+    }
+    else {
+        reasonText =
+            `post-merge-gate: refusing ${toolName} ("${command}") on branch "${branch}" — ` +
+                `its current tip was already merged (recorded: ${matchedContent}).\n` +
+                `Further history-mutating commands on an already-merged branch usually mean stale local state.\n` +
+                `\n` +
+                `To proceed:\n` +
+                `  git switch ${defaultBranch}\n` +
+                `  git pull --ff-only\n` +
+                `  git branch -d ${branch}   # optional cleanup\n` +
+                `\n` +
+                `If you have NEW work to continue on this branch (not leftover local state): make a commit first —` +
+                ` this gate only fires while the branch tip still exactly matches the merged commit, so a new commit` +
+                ` moves the tip and this check no longer applies.\n` +
+                `\n` +
+                `Escape hatches (always allowed, independent of this gate): git switch/checkout, git pull/fetch,` +
+                ` git branch -d/-D, git stash list/show, and any \`harness ...\` command.`;
+    }
+    return JSON.stringify({
+        decision: "block",
+        reason: reasonText,
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: reasonText,
+        },
+    });
+}
+export async function runPackHookPostMergeGateCli(opts = {}) {
+    const stdin = opts.stdin ?? process.stdin;
+    const stdout = opts.stdout ?? process.stdout;
+    const stderr = opts.stderr ?? process.stderr;
+    const note = (msg) => {
+        stderr.write(`harness pack hook post-merge-gate: ${msg}\n`);
+    };
+    const raw = await readStdin(stdin);
+    let event = {};
+    try {
+        event = JSON.parse(raw.trim() || "{}");
+    }
+    catch {
+        const diagnostic = "malformed event JSON, cannot classify; allowing";
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // Pause sentinel — even this gate yields to an operator pause.
+    if (checkHookPause(PACK_NAME, stderr, opts).paused) {
+        const diagnostic = "harness paused; post-merge-gate allowing without evaluating.";
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const sessionId = (typeof event.session_id === "string" ? event.session_id : undefined) ??
+        process.env.CLAUDE_CODE_SESSION_ID ??
+        process.env.CLAUDE_SESSION_ID ??
+        "";
+    const toolName = typeof event.tool_name === "string" ? event.tool_name : "(unknown)";
+    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
+        ? opts.cwd
+        : typeof event.cwd === "string" && event.cwd.length > 0
+            ? event.cwd
+            : process.cwd();
+    if (toolName !== "Bash") {
+        const diagnostic = `${toolName} is not Bash; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const command = bashCommandOf(event.tool_input);
+    if (command === "") {
+        const diagnostic = "no resolvable command text; allowing";
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // ESCAPE ALLOWLIST — checked FIRST, unconditionally, before manifest
+    // load, pack lookup, or any ledger query. See module header.
+    if (isEscapeCommand(command)) {
+        const diagnostic = `escape command matched; allowing regardless of ledger/manifest state`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!isCuratedMutationCommand(command)) {
+        const diagnostic = `command is not in the curated v1 deny-scope; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    // Fail-open manifest load (opposite of branch-protection's fail-closed):
+    // without the manifest we cannot tell if the pack is even enabled, and
+    // this pack's whole posture is advisory, not a hard security boundary.
+    let manifest;
+    try {
+        ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
+    }
+    catch (err) {
+        const diagnostic = `manifest load failed (${err.message}); post-merge-gate fails open, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const pack = manifest.policy_packs.find((p) => p.name === PACK_NAME);
+    if (!pack) {
+        const diagnostic = `pack "${PACK_NAME}" not declared in manifest, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!pack.enabled) {
+        const diagnostic = `pack "${PACK_NAME}" is enabled:false, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const { repo, branch, sha } = resolveGitContext(cwd);
+    if (branch === "" || sha === "" || repo === "") {
+        const diagnostic = `cannot resolve git context for ${cwd} (detached HEAD, outside a git work tree, or unresolvable sha); allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const configUx = parseConfigUx(pack.config["ux"], stderr, "harness pack hook post-merge-gate");
+    const matchKey = mergedTagMatchKey(repo, branch, sha);
+    const check = await probeLedger(manifest, sessionId, matchKey, opts);
+    if (check.degraded !== null) {
+        const diagnostic = `ledger degraded (${check.degraded}); post-merge-gate fails open, allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    if (!check.merged) {
+        const diagnostic = `no recorded ${MERGED_TAG_PREFIX} fact for ${repo}:${branch} at tip ${sha.slice(0, 7)}; allowing`;
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    }
+    const defaultBranch = resolveDefaultBranchName(cwd) ?? DEFAULT_BRANCH_PLACEHOLDER;
+    const diagnostic = `BLOCK — branch tip ${sha.slice(0, 7)} matches a recorded merged tip (${check.matchedContent ?? matchKey})`;
+    note(diagnostic);
+    stdout.write(`${blockJson(toolName, command, branch, defaultBranch, check.matchedContent ?? matchKey, configUx, sessionId)}\n`);
+    return { exitCode: 0, blocked: true, diagnostic };
+}
+//# sourceMappingURL=hook-post-merge-gate.js.map

package/dist/cli/pack/hook-post-merge-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-post-merge-gate.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,iCAAiC;AACjC,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,oDAAoD;AACpD,wEAAwE;AACxE,wBAAwB;AACxB,wEAAwE;AACxE,iEAAiE;AACjE,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,qBAAqB;AACrB,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,mEAAmE;AACnE,mEAAmE;AACnE,8DAA8D;AAE9D,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEvG,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAiCtD,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAQD,SAAS,eAAe,CAAC,OAAsB,EAAE,QAAgB;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,mCAAmC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyB,EACzB,SAAiB,EACjB,QAAgB,EAChB,IAAkC;IAElC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,wCAAwC,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,EAAwB,EACxB,SAAiB;IAEjB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,UAAU;YACR,6BAA6B,QAAQ,MAAM,OAAO,iBAAiB,MAAM,MAAM;gBAC/E,iDAAiD,cAAc,MAAM;gBACrE,iGAAiG;gBACjG,IAAI;gBACJ,eAAe;gBACf,gBAAgB,aAAa,IAAI;gBACjC,wBAAwB;gBACxB,mBAAmB,MAAM,yBAAyB;gBAClD,IAAI;gBACJ,mGAAmG;gBACnG,qGAAqG;gBACrG,oDAAoD;gBACpD,IAAI;gBACJ,iGAAiG;gBACjG,0EAA0E,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,iDAAiD,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,8DAA8D,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,QAAQ,wBAAwB,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,sCAAsC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,sEAAsE,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,uDAAuD,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,yCAAyC,CAAC;QAC5G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,SAAS,SAAS,sCAAsC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,SAAS,SAAS,8BAA8B,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,kCAAkC,GAAG,0EAA0E,CAAC;QACnI,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAC3B,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,EAC9C,MAAM,EACN,mCAAmC,CACpC,CAAC;IAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,oBAAoB,KAAK,CAAC,QAAQ,yCAAyC,CAAC;QAC/F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,eAAe,iBAAiB,aAAa,IAAI,IAAI,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QACrH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;IAClF,MAAM,UAAU,GAAG,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCAAmC,KAAK,CAAC,cAAc,IAAI,QAAQ,GAAG,CAAC;IAC/H,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAClH,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC"}

package/dist/cli/pack/hook-solution-acceptance-writeguard.js

@@ -17,6 +17,40 @@
 //     (covers `echo >`, `$SOLUTION_VERDICT_DIR` spellings, `tee`, `mv`/`cp`/
 //     `ln`/`install`, `python3 -c '...path...'`, and `chmod`/`chattr` that
 //     would loosen perms) — or whose shell cwd is inside the dir.
+//   - Bash `cd` whose RESOLVED target is inside the verdict dir. `cd` itself
+//     is provably read-only (task fb67b402 added it to the shared
+//     read-only-bash floor: it mutates only the invoking shell's own cwd,
+//     never the filesystem), so it no longer reaches the "not read-only"
+//     checks below. But stepping into the dir is the setup half of a
+//     two-call forge (`cd <dir>` then, in a LATER un-chained Bash call,
+//     a bare relative write): this pre-check keeps that first step blocked
+//     as defense-in-depth, ahead of (not instead of) the cwd-inside check
+//     below, which is what actually closes the later relative-write call
+//     once cwd has genuinely moved. A `cd` target that `path.resolve`
+//     cannot literally evaluate does NOT get `cd`'s read-only fast path
+//     either: it falls through to the same reference-based checks as any
+//     other non-read-only Bash. `CD_TARGET_UNRESOLVABLE_CHARS` documents
+//     exactly WHICH expansions this enumerates (quoting, `$`/env-var,
+//     `~`, glob, and `{...}` brace expansion) — that list is what this
+//     check catches, not a claim that every shell-expansion class is
+//     closed. Known-open residual, pre-existing (not introduced by this
+//     branch, since it applies to `bashReferencesVerdictDir`'s textual
+//     match on ANY Bash command, not just `cd`): a backslash-escaped
+//     spelling of the leaf, e.g. `cd <parent>/solution\-verdicts`, still
+//     navigates into the dir under bash (verified against bash 3.2.57)
+//     while `bashReferencesVerdictDir` returns false — the backslash
+//     breaks the literal-leaf substring match and no metacharacter here
+//     triggers the glob/brace fallback either. Closing it needs
+//     shell-unescaping in the textual check itself, which is more than
+//     this task absorbs; do not assume the class is closed.
+//     A SECOND residual of the same class, and on a macOS operator
+//     machine the more reachable of the two: case variance.
+//     `cd <parent>/SOLUTION-VERDICTS` navigates into the dir on a
+//     case-insensitive APFS volume, but `isInsideDir` compares with a
+//     case-sensitive `path.relative` and the textual check uses a
+//     case-sensitive `includes`, so both return false. Also allowed:
+//     a trailing backslash, `cd <DIR>\`. Both pre-existing; closing
+//     them needs case-folding in the textual check.
 //
 // Pure reads (`cat <dir>/x.json`) are allowed so the guard is not over-broad.
 //
@@ -30,7 +64,10 @@
 // write paths above. A path constructed at runtime inside an interpreter
 // with no textual reference is NOT caught; marker signing (a cross-repo
 // follow-up) closes content-authenticity against an unguarded write
-// primitive.
+// primitive. The `cd`-target check added later (task fb67b402) has its own
+// enumerated, not exhaustive, expansion list — see the bullet above and
+// `CD_TARGET_UNRESOLVABLE_CHARS`'s docstring for the backslash-escaping
+// residual specifically.
 import { bashReferencesVerdictDir, isInsideDir, PACK_NAME, verdictDir as resolveVerdictDir, } from "../../policy-packs/builtin/solution-acceptance-runtime.js";
 import { isReadOnlyBashCommand } from "../../runtime/read-only-bash.js";
 import { checkHookPause, readStdin } from "./hook-bootstrap.js";
@@ -60,6 +97,94 @@ function bashCommandOf(toolInput) {
     const cmd = toolInput["command"];
     return typeof cmd === "string" ? cmd : "";
 }
+/**
+ * Extract `cd`'s destination argument from a Bash command string, or null
+ * when the command is not a `cd` invocation or has no statically resolvable
+ * destination. Whitespace-tokenized, same as `read-only-bash.ts`'s own
+ * classifier (this hook does not shell-parse either).
+ *
+ * Deliberately narrow:
+ *   - Only fires when the FIRST token is exactly `cd`. `env cd x` or a
+ *     chained `foo && cd x` do not match here (tokens[0] would be `env` /
+ *     `foo`); those are unaffected by this pre-check and are still governed
+ *     by the existing not-read-only + `bashReferencesVerdictDir` checks
+ *     below, which already close the `cd <parent> && write <relative>`
+ *     descent via the leaf-segment match.
+ *   - `cd`'s own flags (`-L`, `-P`, `-e`, `-@`, and combinations) are
+ *     skipped to find the first positional path argument.
+ *   - `cd -` (switch to `$OLDPWD`) and a bare `cd` (goes to `$HOME`) have no
+ *     destination this function can resolve without ambient shell state;
+ *     both return null (not flagged), the same conservative stance as the
+ *     rest of this module's enumerated-path checks.
+ *   - A single layer of surrounding quotes (`"..."` or `'...'`) is stripped
+ *     from the returned token before the caller does anything with it, so
+ *     `cd "<path>"` and `cd <path>` are treated identically (both the
+ *     resolved-path inside-dir check AND the unresolvable-chars check see
+ *     the same unquoted value). Without this, a quoted literal that merely
+ *     shares a text prefix with the verdict dir (`cd "<dir>-decoy"`) would
+ *     route to the textual leaf match and be wrongly blocked, while the
+ *     unquoted `cd <dir>-decoy` correctly passes via the resolved-path
+ *     check — spelling-dependent behavior for what is the same destination.
+ */
+function cdTargetArgument(command) {
+    const tokens = command.trim().split(/\s+/);
+    if (tokens[0] !== "cd")
+        return null;
+    for (let i = 1; i < tokens.length; i += 1) {
+        const t = tokens[i];
+        if (t === undefined)
+            break;
+        if (t === "-")
+            return null;
+        if (t.startsWith("-"))
+            continue;
+        return stripSurroundingQuotes(t);
+    }
+    return null;
+}
+/**
+ * Strip one layer of surrounding double or single quotes from `token`, or
+ * return it unchanged if it is not fully wrapped in a matching pair. Does
+ * NOT attempt any other shell-quoting semantics (no backslash-escape
+ * handling, no nested-quote handling) — this is a narrow normalization so a
+ * simple quoted literal reads the same as its unquoted form, not a shell
+ * parser.
+ */
+function stripSurroundingQuotes(token) {
+    if (token.length >= 2 &&
+        ((token.startsWith('"') && token.endsWith('"')) ||
+            (token.startsWith("'") && token.endsWith("'")))) {
+        return token.slice(1, -1);
+    }
+    return token;
+}
+/**
+ * Characters/sequences that make a `cd` destination token something
+ * `path.resolve` cannot literally evaluate: quoting (`"`, `'` — the residual
+ * case after `stripSurroundingQuotes` has already removed a clean single
+ * layer, e.g. an unbalanced or embedded quote), env-var expansion (`$`),
+ * home-directory expansion (`~`), shell globbing (`*`, `?`, `[`), and brace
+ * expansion (`{`, `}`, `,`). `path.resolve` treats the raw token as a
+ * literal path segment, so `cd "$SOLUTION_VERDICT_DIR"`, `cd
+ * ~/.../solution-verdicts`, or `cd <parent>/{solution-verdicts,x}` all
+ * resolve to a nonsense path that is never "inside" the dir even though a
+ * real shell would expand each of them TO (or, for the brace form, INTO)
+ * the dir. A `cd` target containing any of these must therefore NOT take
+ * the read-only fast path in `evaluateWriteGuard`: control must fall
+ * through to the same `bashReferencesVerdictDir` text-reference check any
+ * other non-read-only Bash command goes through, which DOES recognize
+ * these spellings (the env-var token, the `agent-grounding/solution-verdicts`
+ * tail, and — after the matching widening in
+ * `solution-acceptance-runtime.ts`'s glob-metacharacter test — glob- and
+ * brace-obscured leaf words).
+ *
+ * This list is enumerated, not exhaustive: it is exactly the expansion
+ * classes this check has been reasoned about, not a claim that every way a
+ * shell can rewrite a `cd` argument is covered. A known-open residual
+ * (pre-existing, not introduced by this check) is backslash escaping — see
+ * the module header's "Known-open residual" note.
+ */
+const CD_TARGET_UNRESOLVABLE_CHARS = /[$~*?[{},"']/;
 /**
  * Pure write-guard decision for a tool event. Exported for direct unit
  * testing of the full forge-attempt matrix without spinning up the CLI.
@@ -100,7 +225,28 @@ export function evaluateWriteGuard(toolName, toolInput, dir, cwd) {
         const command = bashCommandOf(toolInput);
         if (command === "")
             return { blocked: false, reason: "empty Bash command" };
-        if (isReadOnlyBashCommand(command)) {
+        // Defense-in-depth, ahead of the read-only fast path below: `cd` itself
+        // cannot write, but `cd`ing into the verdict dir is the setup half of a
+        // two-call forge (see the module header). Only a RESOLVED-path check
+        // (via the shared `isInsideDir`, not a substring match) so a sibling
+        // that merely shares a text prefix with the dir (`solution-verdicts-decoy`,
+        // or a parent directory of it) is not wrongly flagged.
+        const cdTarget = cdTargetArgument(command);
+        if (cdTarget !== null && isInsideDir(cdTarget, dir, cwd)) {
+            return {
+                blocked: true,
+                reason: `cd targets the harness-protected solution-verdict dir (${dir}); stepping into it would set up a later un-chained relative write to forge the verdict marker`,
+            };
+        }
+        // A `cd` target containing one of the enumerated unresolvable
+        // expansions (see `CD_TARGET_UNRESOLVABLE_CHARS`'s docstring for the
+        // exact list and its non-exhaustive scope) must not take `cd`'s
+        // read-only fast path below: without this, `cd "$SOLUTION_VERDICT_DIR"`
+        // etc. would be waved through by `isReadOnlyBashCommand` (true for ANY
+        // `cd`, per the shared read-only-bash floor) before ever reaching the
+        // reference check that recognizes these exact spellings.
+        const cdTargetUnresolvable = cdTarget !== null && CD_TARGET_UNRESOLVABLE_CHARS.test(cdTarget);
+        if (!cdTargetUnresolvable && isReadOnlyBashCommand(command)) {
             return { blocked: false, reason: "read-only Bash command" };
         }
         if (isInsideDir(".", dir, cwd)) {
@@ -123,7 +269,7 @@ function blockJson(toolName, reason) {
     const text = `solution-acceptance write-guard: refusing ${toolName}. ${reason}.\n` +
         `The solution-acceptance verdict marker is derived by the producer from a ` +
         `real preflight run; hand-writing it would forge a green "done". ` +
-        `Run \`mcp__agent-grounding__solution_evaluate({ id: "<task-id>" })\` instead, ` +
+        `Run \`mcp__grounding-mcp__solution_evaluate({ id: "<task-id>" })\` instead, ` +
         `which writes the marker for you.\n` +
         `Operator override: \`harness pause\`.`;
     return JSON.stringify({