@lannguyensi/harness 0.44.0 → 0.45.0

package/dist/policy-packs/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/policy-packs/runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,uDAAuD;AACvD,EAAE;AACF,wFAAwF;AACxF,iEAAiE;AACjE,iEAAiE;AACjE,qCAAqC;AACrC,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,qEAAqE;AACrE,iEAAiE;AACjE,gCAAgC;AAEhC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,OAAO,CAAU,CAAC;AAEhE,MAAM,CAAC,MAAM,eAAe,GAAY,aAAa,CAAC;AAEtD,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAuB;IAIlD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAC7C,GAAG,CACJ,sBAAsB,eAAe,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAClF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/policy-packs/runtime.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,uDAAuD;AACvD,EAAE;AACF,wFAAwF;AACxF,iEAAiE;AACjE,iEAAiE;AACjE,qCAAqC;AACrC,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,qEAAqE;AACrE,iEAAiE;AACjE,gCAAgC;AAChC,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,yCAAyC;AACzC,oEAAoE;AACpE,sEAAsE;AAEtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAE5E,MAAM,CAAC,MAAM,eAAe,GAAY,aAAa,CAAC;AAEtD,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAuB;IAIlD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAC7C,GAAG,CACJ,sBAAsB,eAAe,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAClF,CAAC;AACJ,CAAC"}

package/dist/runtime/agent-facing.js

@@ -27,7 +27,7 @@
 // the builtins (SESSION_ID / REPO / BRANCH / TOOL_NAME / CWD).
 // Unresolved vars are left literal so the agent can still read what
 // was expected (mirrors renderProducers' best-effort substitution).
-import { substituteTemplate } from "../policies/extract.js";
+import { substituteTemplate } from "../io/extract.js";
 export function buildAgentFacingBlock(ux, values) {
     const sub = (s) => substituteTemplate(s, values).result;
     return {

package/dist/runtime/agent-facing.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-facing.js","sourceRoot":"","sources":["../../src/runtime/agent-facing.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,mEAAmE;AACnE,qCAAqC;AACrC,EAAE;AACF,0BAA0B;AAC1B,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,cAAc;AACd,oCAAoC;AACpC,EAAE;AACF,SAAS;AACT,wBAAwB;AACxB,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,mEAAmE;AACnE,sEAAsE;AACtE,oCAAoC;AACpC,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,+DAA+D;AAC/D,oEAAoE;AACpE,oEAAoE;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAS5D,MAAM,UAAU,qBAAqB,CACnC,EAAY,EACZ,MAA8B;IAE9B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,GAAG,KAAK,CAAC,MAAM,kBAAkB,aAAa,aAAa,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAY,EACZ,MAA8B;IAE9B,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"agent-facing.js","sourceRoot":"","sources":["../../src/runtime/agent-facing.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,mEAAmE;AACnE,qCAAqC;AACrC,EAAE;AACF,0BAA0B;AAC1B,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,cAAc;AACd,oCAAoC;AACpC,EAAE;AACF,SAAS;AACT,wBAAwB;AACxB,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,mEAAmE;AACnE,sEAAsE;AACtE,oCAAoC;AACpC,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,+DAA+D;AAC/D,oEAAoE;AACpE,oEAAoE;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAStD,MAAM,UAAU,qBAAqB,CACnC,EAAY,EACZ,MAA8B;IAE9B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,GAAG,KAAK,CAAC,MAAM,kBAAkB,aAAa,aAAa,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAY,EACZ,MAA8B;IAE9B,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/runtime/bash-match-facts.d.ts

@@ -46,13 +46,15 @@ export interface BashMatchPolicyLike {
  */
 export declare function extractBashMatchFacts(policies: readonly (BashMatchPolicyLike | Policy)[]): BashMatchFacts;
 /**
- * "Is `token` gated by ANY shipped `bash_match` policy?" — the one-call
- * question both incidents got wrong. Real caller (F8, fix round):
- * `bash-match-registry.ts`'s `checkRegisteredSets` covers-purity check,
- * which asks this once per declared `member` of every
- * "covers-gated-head-tokens" registration. Takes only the `gatedHeadTokens`
- * slice of `BashMatchFacts` (not the full shape) so a caller holding the
- * same narrowed `Pick` `checkRegisteredSets` accepts can call this directly
+ * "Is `token` gated by ANY shipped `bash_match` policy?", the one-call
+ * question both incidents got wrong. Real caller (task 209e6dc4 redesign):
+ * `bash-match-registry.ts`'s `checkRegisteredSets`, via its
+ * `isLegitimatelyCoverable` helper, a source-based probe over the live
+ * gated-head-token vocabulary (and `PLAUSIBLE_NON_GATED_HEAD_TOKENS`),
+ * never a per-declared-`member` walk; the registration surface no longer
+ * has a `members` field to walk. Takes only the `gatedHeadTokens` slice of
+ * `BashMatchFacts` (not the full shape) so a caller holding the same
+ * narrowed `Pick` `checkRegisteredSets` accepts can call this directly
  * without widening its own parameter type.
  */
 export declare function isHeadTokenGated(facts: Pick<BashMatchFacts, "gatedHeadTokens">, token: string): boolean;

package/dist/runtime/bash-match-facts.js

@@ -179,13 +179,15 @@ function assertStandaloneWord(pattern, word, policyName) {
     }
 }
 /**
- * "Is `token` gated by ANY shipped `bash_match` policy?" — the one-call
- * question both incidents got wrong. Real caller (F8, fix round):
- * `bash-match-registry.ts`'s `checkRegisteredSets` covers-purity check,
- * which asks this once per declared `member` of every
- * "covers-gated-head-tokens" registration. Takes only the `gatedHeadTokens`
- * slice of `BashMatchFacts` (not the full shape) so a caller holding the
- * same narrowed `Pick` `checkRegisteredSets` accepts can call this directly
+ * "Is `token` gated by ANY shipped `bash_match` policy?", the one-call
+ * question both incidents got wrong. Real caller (task 209e6dc4 redesign):
+ * `bash-match-registry.ts`'s `checkRegisteredSets`, via its
+ * `isLegitimatelyCoverable` helper, a source-based probe over the live
+ * gated-head-token vocabulary (and `PLAUSIBLE_NON_GATED_HEAD_TOKENS`),
+ * never a per-declared-`member` walk; the registration surface no longer
+ * has a `members` field to walk. Takes only the `gatedHeadTokens` slice of
+ * `BashMatchFacts` (not the full shape) so a caller holding the same
+ * narrowed `Pick` `checkRegisteredSets` accepts can call this directly
  * without widening its own parameter type.
  */
 export function isHeadTokenGated(facts, token) {

package/dist/runtime/bash-match-facts.js.map

@@ -1 +1 @@
-{"version":3,"file":"bash-match-facts.js","sourceRoot":"","sources":["../../src/runtime/bash-match-facts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,0EAA0E;AAC1E,uDAAuD;AACvD,sEAAsE;AACtE,wEAAwE;AACxE,oDAAoD;AACpD,yEAAyE;AACzE,qCAAqC;AACrC,mEAAmE;AACnE,yEAAyE;AACzE,gEAAgE;AAChE,yEAAyE;AACzE,wEAAwE;AACxE,qBAAqB;AACrB,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,YAAY;AACZ,EAAE;AACF,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,kDAAkD;AAClD,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,gCAAgC;AAChC,EAAE;AACF,gEAAgE;AAChE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,SAAS;AA0BT;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAgD;IAC5E,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACnD,KAAK,EAAE,CAAC,OAAO,CAAC;KACjB;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE;YACtC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;SAC/B;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;KAC1B;IACD,gCAAgC,EAAE;QAChC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC3C;IACD,uCAAuC,EAAE;QACvC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACnD,KAAK,EAAE,CAAC,QAAQ,CAAC;KAClB;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5C,KAAK,EAAE,CAAC,MAAM,CAAC;KAChB;IACD,yBAAyB,EAAE;QACzB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACxD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;KACxD;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE;YAC/C,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAClD;QACD,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,KAAK,EAAE,EAAE;KACV;IACD,6BAA6B,EAAE;QAC7B,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE;YAC/C,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC/C;QACD,6DAA6D;QAC7D,KAAK,EAAE,EAAE;KACV;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,yBAAyB;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,KAAK,KAAK,sBAAsB;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAwB,yBAAyB,EAAE,CAAC;AA0BjG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmD;IAEnD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAkE,EAAE,CACpE,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gEAAgE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,qHAAqH,CAC1T,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzD,MAAM,WAAW,GAA0B,EAAE,CAAC;IAE9C,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAE1C,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvD,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACjD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,WAAW,CAAC,IAAI,CAAC;YACf,UAAU;YACV,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,WAAW;QACrB,eAAe;QACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,UAAkB;IAC7E,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,uEAAuE,IAAI,oCAAoC,OAAO,oGAAoG,CACxQ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8C,EAC9C,KAAa;IAEb,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"bash-match-facts.js","sourceRoot":"","sources":["../../src/runtime/bash-match-facts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,0EAA0E;AAC1E,uDAAuD;AACvD,sEAAsE;AACtE,wEAAwE;AACxE,oDAAoD;AACpD,yEAAyE;AACzE,qCAAqC;AACrC,mEAAmE;AACnE,yEAAyE;AACzE,gEAAgE;AAChE,yEAAyE;AACzE,wEAAwE;AACxE,qBAAqB;AACrB,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,YAAY;AACZ,EAAE;AACF,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,kDAAkD;AAClD,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,gCAAgC;AAChC,EAAE;AACF,gEAAgE;AAChE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,SAAS;AA0BT;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAgD;IAC5E,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACnD,KAAK,EAAE,CAAC,OAAO,CAAC;KACjB;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE;YACtC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;SAC/B;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;KAC1B;IACD,gCAAgC,EAAE;QAChC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC3C;IACD,uCAAuC,EAAE;QACvC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACnD,KAAK,EAAE,CAAC,QAAQ,CAAC;KAClB;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5C,KAAK,EAAE,CAAC,MAAM,CAAC;KAChB;IACD,yBAAyB,EAAE;QACzB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACxD,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;KACxD;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE;YAC/C,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAClD;QACD,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,KAAK,EAAE,EAAE;KACV;IACD,6BAA6B,EAAE;QAC7B,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE;YAC/C,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC/C;QACD,6DAA6D;QAC7D,KAAK,EAAE,EAAE;KACV;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,yBAAyB;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,KAAK,KAAK,sBAAsB;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAwB,yBAAyB,EAAE,CAAC;AA0BjG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmD;IAEnD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAkE,EAAE,CACpE,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gEAAgE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,qHAAqH,CAC1T,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzD,MAAM,WAAW,GAA0B,EAAE,CAAC;IAE9C,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAE1C,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvD,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACjD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,WAAW,CAAC,IAAI,CAAC;YACf,UAAU;YACV,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,WAAW;QACrB,eAAe;QACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,UAAkB;IAC7E,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,uEAAuE,IAAI,oCAAoC,OAAO,oGAAoG,CACxQ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8C,EAC9C,KAAa;IAEb,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC"}

package/dist/runtime/bash-match-registry.d.ts

@@ -1,56 +1,76 @@
 import type { BashMatchFacts } from "./bash-match-facts.js";
 export type RegisteredSetIntent = "covers-gated-head-tokens" | "must-not-contain-gated-head-token";
+/**
+ * The registration hands the guard the CONSTANT itself, discriminated by
+ * shape (task `209e6dc4` redesign — see the module header). There is no
+ * `has()` closure any more: `sourceHas` below is the ONLY way membership is
+ * ever tested, so a registration cannot assert a predicate that diverges
+ * from what the underlying `Set`/`RegExp` actually does, because there is
+ * only one value, not a value plus a separate self-description of it.
+ */
+export type HeadTokenSource = {
+    readonly kind: "set";
+    readonly set: ReadonlySet<string>;
+} | {
+    readonly kind: "regex";
+    readonly re: RegExp;
+};
+/** Membership test derived FROM `source` — never independently supplied. */
+export declare function sourceHas(source: HeadTokenSource, token: string): boolean;
 interface RegisteredHeadTokenSetCommon {
-    /** Stable identifier, used in failure messages and by the unregistered-set scan's cross-reference. */
+    /**
+     * Stable identifier, used in failure messages and by the unregistered-set
+     * scan's cross-reference. Purely descriptive (task `209e6dc4`): the
+     * checked value is `source`, a direct reference to the real constant, so
+     * a wrong `id` here is a misleading LABEL, never a way to escape a
+     * check — see the module header's point 6.
+     */
     readonly id: string;
-    /** File the set is actually declared in, for failure messages. */
+    /** File the set is actually declared in, for failure messages. Descriptive only, same caveat as `id`. */
     readonly module: string;
-    /** Membership test — `Set.has` or `RegExp.test`, see the module header. */
-    readonly has: (token: string) => boolean;
+    /** The actual constant this registration mirrors — see `HeadTokenSource`. */
+    readonly source: HeadTokenSource;
     readonly description: string;
 }
 /**
  * A "covers-gated-head-tokens" registration — the set exists so the engine
- * RECOGNISES these head tokens. `members` is NON-OPTIONAL (fix round 2,
- * S1): the round-1 shape had this field OPTIONAL, and
- * `checkRegisteredSets`'s covers-purity check (c) simply `continue`d past
- * any registration that omitted it — a new module registered as
- * "covers-gated-head-tokens" WITHOUT `members` measurably passed the full
- * suite (167 files / 3980 tests) even with a gated head token laundered
- * inside its `has()` predicate. Making `members` mandatory on this arm
- * turns that escape into a TYPE ERROR: a covers registration that omits
- * `members` now fails `tsc`, not merely a test. See `checkRegisteredSets`
- * checks (c), (d), (e) below for the three independent things `members`
- * (and `has()`) are cross-checked against.
+ * RECOGNISES these head tokens.
  */
 export interface CoversHeadTokenSet extends RegisteredHeadTokenSetCommon {
     readonly intent: "covers-gated-head-tokens";
-    readonly members: readonly string[];
+    /**
+     * Token(s) this registration KNOWINGLY shares coverage of with another
+     * registered "covers-gated-head-tokens" set — an explicit, conscious
+     * declaration (task `209e6dc4` redesign, resolving the module header's
+     * point 4), never an inference. `checkRegisteredSets`'s covers-redundancy
+     * check only clears a token for which MORE THAN ONE covers-set answers
+     * true when EVERY one of those covering sets lists that token here. A
+     * set that silently overlaps without declaring so still trips the
+     * check — legitimate double coverage requires editing both
+     * registrations, not just adding one next to an untouched other.
+     */
+    readonly intentionalOverlaps?: ReadonlySet<string>;
 }
 /**
  * A "must-not-contain-gated-head-token" registration — the set exists for
  * some OTHER purpose and must never contain a token the manifest itself
- * gates (the dbc6d303 CRITICAL shape). `members` is optional here: no
- * purity/redundancy/predicate-purity semantics apply to this arm — only
- * `has()` is ever asked anything (check (a)).
+ * gates (the dbc6d303 CRITICAL shape). No purity/redundancy semantics apply
+ * to this arm — only `sourceHas` is ever asked anything (check (a)).
  */
 export interface MustNotContainHeadTokenSet extends RegisteredHeadTokenSetCommon {
     readonly intent: "must-not-contain-gated-head-token";
-    readonly members?: readonly string[];
 }
-/**
- * Discriminated union on `intent` (fix round 2, S1) — see
- * `CoversHeadTokenSet`'s doc for why the split exists.
- */
+/** Discriminated union on `intent`. */
 export type RegisteredHeadTokenSet = CoversHeadTokenSet | MustNotContainHeadTokenSet;
 export declare const REGISTERED_HEAD_TOKEN_SETS: readonly RegisteredHeadTokenSet[];
 /**
- * Which of the five independent checks flagged this violation (fix round
- * 2): a fixture test asserting on one check's behaviour must not be
- * silently polluted by another check's unrelated finding on the same
- * (setId, token) pair — see `tests/runtime/bash-match-registry.test.ts`.
+ * Which check flagged this violation. `covers-purity` (task `209e6dc4`
+ * redesign) merges what used to be three separate checks (covers-purity,
+ * covers-predicate-purity, and the documented-uncovered laundering gap
+ * that had no check at all) into one probe over the registration's real
+ * `source` — see the module header's points 1 and 3.
  */
-export type RegistrationCheck = "must-not-contain" | "covers-completeness" | "covers-purity" | "covers-redundancy" | "covers-predicate-purity";
+export type RegistrationCheck = "must-not-contain" | "covers-completeness" | "covers-empty" | "covers-purity" | "covers-redundancy";
 export interface RegistrationViolation {
     readonly setId: string;
     readonly intent: RegisteredSetIntent;
@@ -58,18 +78,35 @@ export interface RegistrationViolation {
     readonly check: RegistrationCheck;
     readonly reason: string;
 }
+/**
+ * Fixed, deliberately small, PER-ENTRY-PINNED vocabulary of plausible
+ * NON-gated head tokens (originally fix round 2 S4/D-004; each entry
+ * individually pinned by a live regression test in
+ * `tests/runtime/bash-match-head-token-drift.test.ts` as of task
+ * `209e6dc4` — see the module header's point 5): commands a reasonable
+ * engine-side set might plausibly mirror or accidentally absorb, but that
+ * no shipped `bash_match` policy gates today. Combined with the live
+ * `facts.gatedHeadTokens` (every token that IS gated, verified fresh — see
+ * `bash-match-facts.ts`) this gives covers-purity a concrete probe domain
+ * to test every registered "covers" source against, instead of trusting a
+ * registration to honestly describe what it covers.
+ *
+ * RESIDUAL, named not hidden: this list cannot be exhaustively DERIVED from
+ * the manifest — the manifest enumerates what IS gated, never the infinite
+ * negative space of what is not. A token entirely outside both this list
+ * and `facts.gatedHeadTokens` (e.g. `yarn`, `pnpm`) is not probed by
+ * covers-purity. Widening this list narrows that residual; it cannot close
+ * it completely for a `RegExp`-backed source, whose true match set is not
+ * enumerable at all.
+ */
+export declare const PLAUSIBLE_NON_GATED_HEAD_TOKENS: readonly string[];
 /**
  * Check every registered set against the live facts. Returns an EMPTY
  * array when clean. `registrations` and `documentedUncovered` default to
- * the real, shipped values (F5 fix-round correction: the
- * `documentedUncovered` default previously silently fell back to an empty
- * set, which raised 4 FALSE violations — tee, cp, env, unset — when called
- * with only `facts`; pinned by
- * `tests/runtime/bash-match-head-token-drift.test.ts`'s
- * "checkRegisteredSets(liveFacts())" defaults test) but accept fixtures —
- * see `tests/runtime/bash-match-registry.test.ts`'s regression tests for
- * the historical incidents, which pass deliberately-broken fixtures to
- * prove this function catches their exact shape.
+ * the real, shipped values but accept fixtures — see
+ * `tests/runtime/bash-match-registry.test.ts`'s regression tests for the
+ * historical incidents, which pass deliberately-broken fixtures to prove
+ * this function catches their exact shape.
  */
 export declare function checkRegisteredSets(facts: Pick<BashMatchFacts, "gatedHeadTokens" | "classify">, registrations?: readonly RegisteredHeadTokenSet[], documentedUncovered?: ReadonlySet<string>): RegistrationViolation[];
 export {};