@lannguyensi/harness 0.47.0 → 0.49.0

package/dist/cli/init/templates.js

@@ -987,10 +987,22 @@ risk:
         - pattern: 'DROP\\s+TABLE|TRUNCATE\\s+TABLE|DELETE\\s+FROM'
           categories: [destructive, data_loss]
           severity: high
-        - pattern: 'kubectl\\s+delete\\s+(namespace|deployment|statefulset|pvc)'
+        # Token-based, flag-tolerant: a flag between \`kubectl\` and
+        # \`delete\` (e.g. \`kubectl --context=x delete namespace payments\`)
+        # must not defeat the match, without matching \`kubectl
+        # get\`/\`describe\` and without exponential-backtracking on a long
+        # flag run. \`(?:\\s+-\\S+(?:\\s+(?!delete\\b)(?!-)\\S+)?)*\` consumes
+        # zero or more \`-\`/\`--\` flag tokens (each optionally taking one
+        # following, non-flag, non-"delete" value token), linear in
+        # command length. See docs/risk-gate.md for the full rationale
+        # and the earlier quadratic-alternation form this replaced.
+        - pattern: 'kubectl(?:\\s+-\\S+(?:\\s+(?!delete\\b)(?!-)\\S+)?)*\\s+delete\\s+(namespace|deployment|statefulset|pvc)'
           categories: [destructive, infrastructure_change]
           severity: high
-        - pattern: 'terraform\\s+destroy'
+        # Same flag-tolerance treatment for terraform's own \`-chdir=DIR\`
+        # global flag, which sits between the tool name and the
+        # subcommand (\`terraform -chdir=infra destroy\`).
+        - pattern: 'terraform(?:\\s+-\\S+(?:\\s+(?!destroy\\b)(?!-)\\S+)?)*\\s+destroy'
           categories: [destructive, infrastructure_change]
           severity: critical
 
@@ -1047,4 +1059,62 @@ export function shippedOperatorOnlyPolicyNames() {
     }
     return shippedOperatorOnlyCache;
 }
+// Matches the leading `(...)` group of a bash_match regex source string.
+// Every shipped bash_match opens with the boundary-alternation group and
+// none of its branches contain a literal `)` (parens inside are always
+// escaped as `\(`), so a non-greedy scan to the first `)` is exact for
+// every entry in FULL_TEMPLATE.
+const BOUNDARY_GROUP_RE = /^\(([^)]*)\)/;
+/**
+ * Extracts the leading boundary-alternation group from a `bash_match`
+ * regex source string (e.g. `"(^|\\n|;|\\||&|\\()..."` -> `"^|\\n|;|\\||&|\\("`).
+ * Returns `undefined` when the string does not open with a parenthesized
+ * group; defensive only, every shipped template entry does.
+ *
+ * Known limitation: the scan is not escape-aware, so an escaped closing
+ * paren (`\\)`) inside the group would truncate the match early at that
+ * `)` character instead of continuing past it. No shipped FULL_TEMPLATE
+ * boundary contains one today; a future boundary that needs a literal
+ * `)` inside the alternation would need this scan widened first.
+ */
+export function extractBashMatchBoundary(bashMatch) {
+    return BOUNDARY_GROUP_RE.exec(bashMatch)?.[1];
+}
+/**
+ * Every FULL_TEMPLATE `hooks[]` / `policies[].trigger` entry that
+ * declares a `bash_match`, paired with its boundary-alternation group
+ * (task 037cfb7c). Parsed from FULL_TEMPLATE itself, the same
+ * single-source-of-truth pattern as `shippedOperatorOnlyPolicyNames`
+ * immediately above, so this list can never drift from what
+ * `harness init --template full` actually writes; unlike
+ * `shippedOperatorOnlyPolicyNames`, this one is pinned by its own
+ * fixed-point test in tests/cli/doctor-trigger-boundary-drift.test.ts
+ * (entry count and the literal shipped boundary), not by
+ * tests/cli/init-full-template-parity.test.ts, which does not reference
+ * it. Memoized: the parse is pure and FULL_TEMPLATE is a build constant.
+ */
+let shippedBashMatchBoundariesCache;
+export function shippedBashMatchBoundaries() {
+    if (shippedBashMatchBoundariesCache === undefined) {
+        const manifest = parseManifest(parseYaml(FULL_TEMPLATE));
+        const entries = [];
+        for (const hook of manifest.hooks) {
+            if (!hook.bash_match)
+                continue;
+            const boundary = extractBashMatchBoundary(hook.bash_match);
+            if (boundary !== undefined)
+                entries.push({ level: "hook", name: hook.name, boundary });
+        }
+        for (const policy of manifest.policies) {
+            const bashMatch = policy.trigger.bash_match;
+            if (!bashMatch)
+                continue;
+            const boundary = extractBashMatchBoundary(bashMatch);
+            if (boundary !== undefined)
+                entries.push({ level: "policy", name: policy.name, boundary });
+        }
+        shippedBashMatchBoundariesCache = entries;
+    }
+    return shippedBashMatchBoundariesCache;
+}
 //# sourceMappingURL=templates.js.map

package/dist/cli/init/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAy9B5B,CAAC;AAEF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,wBAAuD,CAAC;AAC5D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,wBAAwB,GAAG,QAAQ,CAAC,QAAQ;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAq+B5B,CAAC;AAEF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,wBAAuD,CAAC;AAC5D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,wBAAwB,GAAG,QAAQ,CAAC,QAAQ;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAsBD,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,IAAI,+BAA8E,CAAC;AACnF,MAAM,UAAU,0BAA0B;IACxC,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,+BAA+B,GAAG,OAAO,CAAC;IAC5C,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC"}

package/dist/cli/pack/hook-bootstrap.js

@@ -26,7 +26,12 @@
 //     isTTY guard, which is a legitimately different contract.
 //   - hook-solution-acceptance-writeguard.ts: loads no manifest.
 //   - hook-stay-in-scope.ts: loads no manifest.
-//   - hook-codex-stop.ts / hook-codex-user-prompt-submit.ts: no pause check.
+//
+// hook-codex-stop.ts and hook-codex-user-prompt-submit.ts now also call
+// the pause check (2, `checkHookPause`), on top of the stdin reader (1) and
+// manifest loader (3) they already used (tasks 63fefe3a, 1432e053); they
+// used to be listed here as "no pause check" exceptions. Neither one pulls
+// in 4-6, so "use all of the above" would overstate it.
 //
 // Per-hook decision logic, error envelopes, and early-return shapes stay local
 // to each hook. This module covers structural boilerplate only, not semantics.

package/dist/cli/pack/hook-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-bootstrap.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-bootstrap.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,gEAAgE;AAChE,+BAA+B;AAC/B,EAAE;AACF,8DAA8D;AAC9D,6EAA6E;AAC7E,6DAA6D;AAC7D,2EAA2E;AAC3E,0EAA0E;AAC1E,iDAAiD;AACjD,oEAAoE;AACpE,8CAA8C;AAC9C,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,6DAA6D;AAC7D,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,yBAAyB;AACzB,EAAE;AACF,eAAe;AACf,0EAA0E;AAC1E,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,cAAc,EAAgC,MAAM,uBAAuB,CAAC;AAErF,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA6B;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,MAA6B,EAC7B,UAA0B,EAC1B,YAAqB,EACrB,GAAU;IAEV,OAAO,oBAAoB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;AACpF,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyB,EACzB,QAA8B;IAE9B,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG,UAAqB;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAGhC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAC5D,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,MAA6B,EAC7B,SAAiB;IAEjB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM;aACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"hook-bootstrap.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-bootstrap.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,gEAAgE;AAChE,+BAA+B;AAC/B,EAAE;AACF,8DAA8D;AAC9D,6EAA6E;AAC7E,6DAA6D;AAC7D,2EAA2E;AAC3E,0EAA0E;AAC1E,iDAAiD;AACjD,oEAAoE;AACpE,8CAA8C;AAC9C,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,6DAA6D;AAC7D,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,yBAAyB;AACzB,EAAE;AACF,eAAe;AACf,0EAA0E;AAC1E,+DAA+D;AAC/D,iEAAiE;AACjE,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,cAAc,EAAgC,MAAM,uBAAuB,CAAC;AAErF,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA6B;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,MAA6B,EAC7B,UAA0B,EAC1B,YAAqB,EACrB,GAAU;IAEV,OAAO,oBAAoB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;AACpF,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyB,EACzB,QAA8B;IAE9B,4EAA4E;IAC5E,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG,UAAqB;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAGhC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAC5D,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,MAA6B,EAC7B,SAAiB;IAEjB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM;aACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/cli/pack/hook-codex-stop.d.ts

@@ -9,6 +9,10 @@ export interface PackHookCodexStopOptions extends LoaderOptions {
     manifest?: Manifest;
     /** Test-injectable clock; defaults to new Date(). */
     now?: Date;
+    /** Test-injected generatedDir for the pause-sentinel check; bypasses
+     *  path resolution when supplied (mirrors `hook-codex-pre-tool-use.ts`
+     *  / `hook-codex-post-tool-use.ts`). */
+    generatedDir?: string;
 }
 export interface ParsedReport {
     interpretation: string;

package/dist/cli/pack/hook-codex-stop.js

@@ -31,7 +31,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { atomicWriteFile } from "../../io/atomic-write.js";
 import { defaultReportsDir } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { loadManifestOrInjected, pickString, readStdin } from "./hook-bootstrap.js";
+import { checkHookPause, loadManifestOrInjected, pickString, readStdin } from "./hook-bootstrap.js";
 const PACK_NAME = "understanding-before-execution";
 const RUNTIME_TAG = "codex";
 function extractLastAssistantText(env) {
@@ -257,6 +257,20 @@ export async function runPackHookCodexStopCli(opts = {}) {
     catch (err) {
         return allowResult(`harness pack hook codex-stop: stdin read failed (${err.message}), skipping capture.`, stderr);
     }
+    // Pause sentinel (task 1432e053, parity with pre-tool-use / post-tool-use /
+    // user-prompt-submit), honoured BEFORE stdin JSON parsing (and before
+    // manifest load), so an active `harness pause` is honoured and announced
+    // even when the stdin payload cannot be parsed at all. This deliberately
+    // diverges from `hook-codex-pre-tool-use.ts`, which parses stdin first
+    // and checks the pause afterward: pre-tool-use's malformed-JSON path
+    // still needs to run (it emits a diagnostic and falls through to allow),
+    // while here checking the pause first means an unparsable payload during
+    // an active pause never reaches the parse step at all, so the
+    // malformed-JSON diagnostic below is intentionally not emitted in that
+    // case.
+    if (checkHookPause("codex-stop", stderr, opts, opts.generatedDir, opts.now).paused) {
+        return allowResult("harness pack hook codex-stop: harness paused, skipping capture.", stderr);
+    }
     let envelope = {};
     try {
         envelope = JSON.parse(raw.trim() || "{}");

package/dist/cli/pack/hook-codex-stop.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-codex-stop.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-stop.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,iEAAiE;AACjE,oEAAoE;AACpE,mEAAmE;AACnE,wDAAwD;AACxD,EAAE;AACF,8DAA8D;AAC9D,uDAAuD;AACvD,EAAE;AACF,4DAA4D;AAC5D,4DAA4D;AAC5D,EAAE;AACF,oEAAoE;AACpE,2DAA2D;AAC3D,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,sDAAsD;AACtD,qCAAqC;AACrC,sEAAsE;AACtE,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sEAAsE,CAAC;AAGzG,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,WAAW,GAAG,OAAO,CAAC;AA0C5B,SAAS,wBAAwB,CAAC,GAAiB;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;QAC1C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,qEAAqE;AACrE,YAAY;AACZ,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,YAAY;IACZ,OAAO;IACP,kBAAkB;CACV,CAAC;AAGX,MAAM,aAAa,GAA0B,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE7F,SAAS,iBAAiB,CAAC,GAAW;IACpC,kEAAkE;IAClE,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,OAAO,GAAG,GAAG;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,eAAe,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,iBAAiB,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc;YACjB,OAAO,kBAAkB,CAAC;QAC5B;YACE,IAAK,MAA4B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAmB,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,mDAAmD;AACnD,6CAA6C;AAC7C,6DAA6D;AAC7D,mEAAmE;AACnE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhC,iEAAiE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,GAAG,GAAiB;QACxB,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,EAAE;QACT,gBAAgB,EAAE,EAAE;KACrB,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,EAAE,CAAC;YACd,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;YACtB,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,gEAAgE;gBAChE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;oBAAE,WAAW,EAAE,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,8CAA8C;QAChD,CAAC;IACH,CAAC;IACD,WAAW,EAAE,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAiB,EAAE,KAAe,EAAE,KAAa;IACpE,IAAI,KAAK,KAAK,gBAAgB;QAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;SACtD,IAAI,KAAK,KAAK,kBAAkB;QAAE,GAAG,CAAC,gBAAgB,GAAG,KAAK,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAiB,EAAE,KAAe,EAAE,KAAa;IACnE,IAAI,KAAK,KAAK,aAAa;QAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACpD,IAAI,KAAK,KAAK,eAAe;QAAE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC7D,IAAI,KAAK,KAAK,YAAY;QAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACvD,IAAI,KAAK,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAe;IAC9C,OAAO,CACL,CAAC,CAAC,cAAc,KAAK,EAAE;QACvB,CAAC,CAAC,gBAAgB,KAAK,EAAE;QACzB,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAS;IACjC,kDAAkD;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,GAAS;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,IAAI,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACtB,UAAkB,EAClB,QAAgB,EAChB,IAA6B;IAE7B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,MAA6B;IACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEnC,oEAAoE;IACpE,iEAAiE;IACjE,oDAAoD;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,oDAAqD,GAAa,CAAC,OAAO,sBAAsB,EAChG,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAiB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAChB,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,uDAAwD,GAAa,CAAC,OAAO,sBAAsB,EACnG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAChB,uCAAuC,QAAQ,kCAAkC,EACjF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,2EAA2E,EAC3E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,WAAW,CAChB,qFAAqF,EACrF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAChB,mJAAmJ,EACnJ,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,IAAI,GAA4B;QACpC,SAAS;QACT,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,cAAc,EAAE,SAAS;QACzB,MAAM;QACN,UAAU,EAAE,WAAW;KACxB,CAAC;IACF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yDAA0D,GAAa,CAAC,OAAO,sBAAsB,EACrG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kEAAkE,MAAM,6BAA6B,CAAC;IACzH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"hook-codex-stop.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-stop.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,iEAAiE;AACjE,oEAAoE;AACpE,mEAAmE;AACnE,wDAAwD;AACxD,EAAE;AACF,8DAA8D;AAC9D,uDAAuD;AACvD,EAAE;AACF,4DAA4D;AAC5D,4DAA4D;AAC5D,EAAE;AACF,oEAAoE;AACpE,2DAA2D;AAC3D,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,sDAAsD;AACtD,qCAAqC;AACrC,sEAAsE;AACtE,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sEAAsE,CAAC;AAGzG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpG,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,WAAW,GAAG,OAAO,CAAC;AA8C5B,SAAS,wBAAwB,CAAC,GAAiB;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;QAC1C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,qEAAqE;AACrE,YAAY;AACZ,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,YAAY;IACZ,OAAO;IACP,kBAAkB;CACV,CAAC;AAGX,MAAM,aAAa,GAA0B,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE7F,SAAS,iBAAiB,CAAC,GAAW;IACpC,kEAAkE;IAClE,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,OAAO,GAAG,GAAG;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,eAAe,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,iBAAiB,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc;YACjB,OAAO,kBAAkB,CAAC;QAC5B;YACE,IAAK,MAA4B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAmB,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,mDAAmD;AACnD,6CAA6C;AAC7C,6DAA6D;AAC7D,mEAAmE;AACnE,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhC,iEAAiE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,GAAG,GAAiB;QACxB,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,EAAE;QACT,gBAAgB,EAAE,EAAE;KACrB,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,EAAE,CAAC;YACd,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;YACtB,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,gEAAgE;gBAChE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;oBAAE,WAAW,EAAE,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,8CAA8C;QAChD,CAAC;IACH,CAAC;IACD,WAAW,EAAE,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAiB,EAAE,KAAe,EAAE,KAAa;IACpE,IAAI,KAAK,KAAK,gBAAgB;QAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;SACtD,IAAI,KAAK,KAAK,kBAAkB;QAAE,GAAG,CAAC,gBAAgB,GAAG,KAAK,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAiB,EAAE,KAAe,EAAE,KAAa;IACnE,IAAI,KAAK,KAAK,aAAa;QAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACpD,IAAI,KAAK,KAAK,eAAe;QAAE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC7D,IAAI,KAAK,KAAK,YAAY;QAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACvD,IAAI,KAAK,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAe;IAC9C,OAAO,CACL,CAAC,CAAC,cAAc,KAAK,EAAE;QACvB,CAAC,CAAC,gBAAgB,KAAK,EAAE;QACzB,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAS;IACjC,kDAAkD;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,GAAS;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,IAAI,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACtB,UAAkB,EAClB,QAAgB,EAChB,IAA6B;IAE7B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,MAA6B;IACpE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEnC,oEAAoE;IACpE,iEAAiE;IACjE,oDAAoD;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,oDAAqD,GAAa,CAAC,OAAO,sBAAsB,EAChG,MAAM,CACP,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,uEAAuE;IACvE,QAAQ;IACR,IAAI,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,OAAO,WAAW,CAChB,iEAAiE,EACjE,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAiB,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAiB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAChB,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,uDAAwD,GAAa,CAAC,OAAO,sBAAsB,EACnG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAChB,uCAAuC,QAAQ,kCAAkC,EACjF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,2EAA2E,EAC3E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,WAAW,CAChB,qFAAqF,EACrF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAChB,mJAAmJ,EACnJ,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,IAAI,GAA4B;QACpC,SAAS;QACT,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,cAAc,EAAE,SAAS;QACzB,MAAM;QACN,UAAU,EAAE,WAAW;KACxB,CAAC;IACF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yDAA0D,GAAa,CAAC,OAAO,sBAAsB,EACrG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kEAAkE,MAAM,6BAA6B,CAAC;IACzH,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}

package/dist/cli/pack/hook-codex-user-prompt-submit.d.ts

@@ -7,6 +7,12 @@ export interface PackHookCodexUserPromptSubmitOptions extends LoaderOptions {
     stdout?: NodeJS.WritableStream;
     stderr?: NodeJS.WritableStream;
     manifest?: Manifest;
+    /** Test-injected generatedDir for the pause-sentinel check; bypasses
+     *  path resolution when supplied (mirrors `hook-pre-tool-use.ts`). */
+    generatedDir?: string;
+    /** Override "now" for deterministic pause-expiry tests. Forwarded to
+     *  `checkHookPause` / `checkPauseFromLoader`. */
+    now?: Date;
 }
 export interface PackHookCodexUserPromptSubmitResult {
     exitCode: number;
@@ -15,4 +21,36 @@ export interface PackHookCodexUserPromptSubmitResult {
     text: string;
 }
 export declare function buildInstructionBlock(mode: Mode): string;
+/**
+ * True when the UserPromptSubmit envelope should trigger injection.
+ *
+ * FAIL-OPEN TO INJECT: this only returns `false` (suppress) when at
+ * least one recognized prompt-carrying field (see
+ * `REAL_PROMPT_FIELD_ALIASES`) is POSITIVELY present on the parsed
+ * envelope with a string value, and every string-valued alias present
+ * is empty or whitespace-only, a real signal that the sender
+ * explicitly marked this turn as carrying no operator text. The
+ * decision considers every alias present, not just the first match in
+ * list order: a single non-empty string alias anywhere in the envelope
+ * (for example `{"prompt":"","text":"real operator text"}`) is real
+ * user input and must inject, even when an earlier-listed alias on the
+ * same envelope is empty. Everything else defaults to `true` (inject,
+ * i.e. the pre-task-63fefe3a behavior):
+ *
+ *   - unparsable / non-JSON stdin,
+ *   - a parsed value that is not an object,
+ *   - an object that carries none of the known aliases as a string
+ *     value at all (this is the documented `{ session_id?, tool_name?,
+ *     raw_input?, event? }` shape from the generated config.toml
+ *     header, no prompt field by design, not evidence of a
+ *     notification turn, and a non-string alias value is ignored the
+ *     same way),
+ *
+ * An envelope harness cannot parse, or cannot recognize, is not
+ * evidence that there was no real user input; it is evidence this
+ * module's assumption about the wire format was wrong, and the correct
+ * failure direction for a governance-adjacent injector is to keep
+ * injecting, not to go silently dark.
+ */
+export declare function hasRealUserPrompt(raw: string): boolean;
 export declare function runPackHookCodexUserPromptSubmitCli(opts?: PackHookCodexUserPromptSubmitOptions): Promise<PackHookCodexUserPromptSubmitResult>;

package/dist/cli/pack/hook-codex-user-prompt-submit.js

@@ -8,10 +8,16 @@
 // instruction block on stdout that Codex will prepend to its system
 // prompt before the agent runs.
 //
-// Wire format on stdin (envelope harness publishes; Codex CLI
-// integration wraps its native event into this shape):
-//
-//   { session_id?: string, prompt?: string }
+// Wire format on stdin: UNVERIFIED against a real Codex payload. This
+// module does not trust a single field name; it alias-tolerates any of
+// `REAL_PROMPT_FIELD_ALIASES` below (`prompt`, `text`, `input`,
+// `message`, `user_prompt`, `user_input`) as the carrier of the
+// operator's actual prompt text, the same way the sibling Codex hooks
+// alias-tolerate `tool`/`tool_name` and `raw_input`/`tool_input`. The
+// generated `config.toml` header for other Codex hooks documents the
+// wire shape as `{ session_id?, tool_name?, raw_input?, event? }`, with
+// no prompt field at all, so an envelope carrying none of the known
+// aliases is expected, not an error.
 //
 // stdout: a plain-text instruction block (no JSON wrapper) that Codex
 // concatenates into `additional_instructions`. The block is identical
@@ -20,8 +26,39 @@
 //
 // Failure mode: any error → exit 0, no stdout, diagnostic on stderr.
 // A missing injector text must never fail the agent's prompt path.
+//
+// Two short-circuits happen before any manifest/mode logic runs, both
+// producing the same "no stdout, no injection" outcome:
+//
+//   1. Pause sentinel (task 63fefe3a): honoured the same way every other
+//      pack hook honours it (`checkHookPause`, mirrored from
+//      `hook-pre-tool-use.ts`), an active, unexpired
+//      `harness pause` must silence this injector exactly like it silences
+//      the PreToolUse/PostToolUse gates. Checked BEFORE manifest load so a
+//      broken install still respects an active pause.
+//   2. No real user input (task 63fefe3a, corrected same task after an
+//      advisor review caught the first cut fail-closed): a notification
+//      turn, subagent completion, a Monitor event, a background-bash
+//      finishing, carries no operator text, and injecting the full
+//      instruction block on it is pure noise (and, per the pack's own
+//      contract, prompts the agent to write a fresh Understanding Report
+//      against nothing). BUT the module's own documented envelope
+//      (`{ session_id?, prompt? }` above) is unverified against a real
+//      Codex payload: the generated `config.toml` header for every other
+//      Codex hook documents the wire shape as `{ session_id?, tool_name?,
+//      raw_input?, event? }`, no `prompt` field at all, and the sibling
+//      hooks (`hook-codex-pre-tool-use.ts` etc.) never trust a single
+//      field name, they alias-tolerate (`tool`/`tool_name`,
+//      `raw_input`/`tool_input`) via `pickString`. So this check is
+//      FAIL-OPEN-TO-INJECT: it only suppresses when a recognized
+//      prompt-carrying field is POSITIVELY present and empty. A missing
+//      field, an unrecognized envelope shape, or unparsable stdin is not
+//      evidence of "no user input", it is evidence the real Codex wire
+//      format is not what this module assumed, and the safe default in
+//      that case is the pre-task-63fefe3a behavior: inject. See
+//      `hasRealUserPrompt` below.
 import { resolveMode } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { loadManifestOrInjected, readStdin } from "./hook-bootstrap.js";
+import { checkHookPause, loadManifestOrInjected, readStdin } from "./hook-bootstrap.js";
 const PACK_NAME = "understanding-before-execution";
 export function buildInstructionBlock(mode) {
     // Self-contained instruction text. The richer template owned by
@@ -50,14 +87,96 @@ export function buildInstructionBlock(mode) {
     ].join("\n");
     return base + "\n";
 }
+/**
+ * Field names that could plausibly carry the operator's actual prompt
+ * text on a Codex UserPromptSubmit envelope. `prompt` is this module's
+ * own documented guess; the others are tolerated the same way the
+ * sibling Codex hooks tolerate `tool`/`tool_name` and
+ * `raw_input`/`tool_input`, a real integration may use a different
+ * name than the one this package assumed. None of this is confirmed
+ * against a real Codex payload (see module header); the alias list only
+ * WIDENS which fields can prove a real prompt, it never narrows what
+ * counts as "unknown, so inject".
+ */
+const REAL_PROMPT_FIELD_ALIASES = [
+    "prompt",
+    "text",
+    "input",
+    "message",
+    "user_prompt",
+    "user_input",
+];
+/**
+ * True when the UserPromptSubmit envelope should trigger injection.
+ *
+ * FAIL-OPEN TO INJECT: this only returns `false` (suppress) when at
+ * least one recognized prompt-carrying field (see
+ * `REAL_PROMPT_FIELD_ALIASES`) is POSITIVELY present on the parsed
+ * envelope with a string value, and every string-valued alias present
+ * is empty or whitespace-only, a real signal that the sender
+ * explicitly marked this turn as carrying no operator text. The
+ * decision considers every alias present, not just the first match in
+ * list order: a single non-empty string alias anywhere in the envelope
+ * (for example `{"prompt":"","text":"real operator text"}`) is real
+ * user input and must inject, even when an earlier-listed alias on the
+ * same envelope is empty. Everything else defaults to `true` (inject,
+ * i.e. the pre-task-63fefe3a behavior):
+ *
+ *   - unparsable / non-JSON stdin,
+ *   - a parsed value that is not an object,
+ *   - an object that carries none of the known aliases as a string
+ *     value at all (this is the documented `{ session_id?, tool_name?,
+ *     raw_input?, event? }` shape from the generated config.toml
+ *     header, no prompt field by design, not evidence of a
+ *     notification turn, and a non-string alias value is ignored the
+ *     same way),
+ *
+ * An envelope harness cannot parse, or cannot recognize, is not
+ * evidence that there was no real user input; it is evidence this
+ * module's assumption about the wire format was wrong, and the correct
+ * failure direction for a governance-adjacent injector is to keep
+ * injecting, not to go silently dark.
+ */
+export function hasRealUserPrompt(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return true;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return true;
+    const obj = parsed;
+    let sawStringAlias = false;
+    for (const key of REAL_PROMPT_FIELD_ALIASES) {
+        const value = obj[key];
+        if (typeof value !== "string")
+            continue;
+        sawStringAlias = true;
+        if (value.trim().length > 0)
+            return true;
+    }
+    return !sawStringAlias;
+}
 export async function runPackHookCodexUserPromptSubmitCli(opts = {}) {
     const stdin = opts.stdin ?? process.stdin;
     const stdout = opts.stdout ?? process.stdout;
     const stderr = opts.stderr ?? process.stderr;
     const packName = opts.pack ?? PACK_NAME;
-    // Drain stdin so the parent isn't blocked. We don't actually need any
-    // field from it for v1 — the instruction block is prompt-independent.
-    await readStdin(stdin).catch(() => "");
+    const raw = await readStdin(stdin).catch(() => "");
+    // Pause sentinel, operator-only kill switch. Honoured BEFORE manifest
+    // load, same ordering as every other pack hook (see module header).
+    if (checkHookPause("codex-user-prompt-submit", stderr, opts, opts.generatedDir, opts.now).paused) {
+        stderr.write("harness pack hook codex-user-prompt-submit: harness paused, skipping injection.\n");
+        return { exitCode: 0, emitted: false, text: "" };
+    }
+    // No real user input on this turn: nothing to react to, so nothing to
+    // inject. See `hasRealUserPrompt` above.
+    if (!hasRealUserPrompt(raw)) {
+        stderr.write("harness pack hook codex-user-prompt-submit: no real user prompt on this turn, suppressing injection.\n");
+        return { exitCode: 0, emitted: false, text: "" };
+    }
     let manifest;
     try {
         ({ manifest } = loadManifestOrInjected(opts, opts.manifest));

package/dist/cli/pack/hook-codex-user-prompt-submit.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-codex-user-prompt-submit.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-user-prompt-submit.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,iEAAiE;AACjE,uEAAuE;AACvE,iEAAiE;AACjE,oEAAoE;AACpE,gCAAgC;AAChC,EAAE;AACF,8DAA8D;AAC9D,uDAAuD;AACvD,EAAE;AACF,6CAA6C;AAC7C,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,+DAA+D;AAC/D,4BAA4B;AAC5B,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AAEnE,OAAO,EAAa,WAAW,EAAE,MAAM,8DAA8D,CAAC;AAGtG,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAiBnD,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,IAAI,GAAG;QACX,+BAA+B,GAAG,IAAI,GAAG,GAAG;QAC5C,EAAE;QACF,+EAA+E;QAC/E,sDAAsD;QACtD,EAAE;QACF,oFAAoF;QACpF,gGAAgG;QAChG,6EAA6E;QAC7E,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,EAAE;QACF,qFAAqF;QACrF,+EAA+E;QAC/E,EAAE;QACF,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAA6C,EAAE;IAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,qEACG,GAAa,CAAC,OACjB,6BAA6B,CAC9B,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,qDAAqD,QAAQ,yCAAyC,CACvG,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"hook-codex-user-prompt-submit.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-user-prompt-submit.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,iEAAiE;AACjE,uEAAuE;AACvE,iEAAiE;AACjE,oEAAoE;AACpE,gCAAgC;AAChC,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,gEAAgE;AAChE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,qCAAqC;AACrC,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,+DAA+D;AAC/D,4BAA4B;AAC5B,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,sEAAsE;AACtE,wDAAwD;AACxD,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAC7D,qDAAqD;AACrD,2EAA2E;AAC3E,2EAA2E;AAC3E,sDAAsD;AACtD,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,yEAAyE;AACzE,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,oEAAoE;AACpE,iEAAiE;AACjE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,kCAAkC;AAElC,OAAO,EAAa,WAAW,EAAE,MAAM,8DAA8D,CAAC;AAGtG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExF,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAuBnD,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,IAAI,GAAG;QACX,+BAA+B,GAAG,IAAI,GAAG,GAAG;QAC5C,EAAE;QACF,+EAA+E;QAC/E,sDAAsD;QACtD,EAAE;QACF,oFAAoF;QACpF,gGAAgG;QAChG,6EAA6E;QAC7E,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,EAAE;QACF,qFAAqF;QACrF,+EAA+E;QAC/E,EAAE;QACF,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG;IAChC,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,aAAa;IACb,YAAY;CACJ,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,cAAc,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,cAAc,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,OAA6C,EAAE;IAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAEnD,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,cAAc,CAAC,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACjG,MAAM,CAAC,KAAK,CACV,mFAAmF,CACpF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,yCAAyC;IACzC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CACV,wGAAwG,CACzG,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,qEACG,GAAa,CAAC,OACjB,6BAA6B,CAC9B,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,qDAAqD,QAAQ,yCAAyC,CACvG,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC"}

package/dist/cli/policy/intercept.js

@@ -10,6 +10,7 @@ import * as path from "node:path";
 import { buildActionEnvelope, intercept, isBlockingDecision, recordPolicyDecisionOnSession, resolveEnvironment, resolveGitContext, resolveKubeContext, sanitizeEnvelopeReason, } from "../../runtime/index.js";
 import { resolveGeneratedDir, writePendingApproval } from "../../runtime/pending-approval.js";
 import { parseBashPrefix } from "../../runtime/bash-prefix-parse.js";
+import { parseKubectlTarget } from "../../runtime/kubectl-target-parse.js";
 import { MAX_NORMALIZE_LENGTH, normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, segmentViewOf, } from "../../runtime/command-normalize.js";
 import { extractShellCommand, SHELL_ALIASES } from "../../runtime/tool-name-aliases.js";
 import { loadManifest } from "../loader.js";
@@ -195,6 +196,35 @@ function applyBranchSwitchUpgrade(event, manifest, cwd, baseGit, branchTarget, i
     const candidateResolution = resolveEnvironment(buildActionEnvelope(event, { cwd, git: candidateGit, user, host, now: effectiveNow }), manifest.environments.resolvers, inputs);
     return ENV_RANK[candidateResolution.name] < ENV_RANK[baseResolution.name] ? candidateGit : baseGit;
 }
+/**
+ * Explicit kubectl target, upgrade-only merge (task a7eb1a71): an
+ * explicit --context/--namespace/-n on a kubectl command can only push
+ * the resolved environment to something MORE dangerous than the
+ * ambient kubeconfig alone already gave, never less, mirroring
+ * applyBranchSwitchUpgrade exactly (both the ambient-only base and the
+ * merged-candidate kube inputs run through the SAME resolveEnvironment
+ * call with identical git/env inputs, so ENV_RANK picks the more
+ * dangerous of the two). See CHANGELOG.md's `[Unreleased]` entry for
+ * the measured downgrade this fixes.
+ */
+function applyKubeTargetUpgrade(event, manifest, cwd, git, ambientKube, kubectlTarget, env, user, host, now) {
+    if (kubectlTarget === null)
+        return ambientKube;
+    const candidateKube = {
+        context: kubectlTarget.context ?? ambientKube.context,
+        namespace: kubectlTarget.namespace ?? ambientKube.namespace,
+    };
+    if (candidateKube.context === ambientKube.context &&
+        candidateKube.namespace === ambientKube.namespace) {
+        return ambientKube;
+    }
+    const effectiveNow = now ?? new Date();
+    const baseResolution = resolveEnvironment(buildActionEnvelope(event, { cwd, git, user, host, now: effectiveNow }), manifest.environments.resolvers, { env, kubeContext: ambientKube.context, kubeNamespace: ambientKube.namespace });
+    const candidateResolution = resolveEnvironment(buildActionEnvelope(event, { cwd, git, user, host, now: effectiveNow }), manifest.environments.resolvers, { env, kubeContext: candidateKube.context, kubeNamespace: candidateKube.namespace });
+    return ENV_RANK[candidateResolution.name] < ENV_RANK[baseResolution.name]
+        ? candidateKube
+        : ambientKube;
+}
 /**
  * Real grounding-mcp-backed ledger client. Exported for testing: the
  * `record` adapter's failure-surfacing path is exercised against a
@@ -813,12 +843,19 @@ export async function runInterceptCli(opts = {}) {
         // `resolverGit` itself — a switch away from a production branch can
         // never downgrade what `resolverGit` (cwd- or cd-based) already
         // resolved.
-        const bashPrefix = event.tool_name === "Bash"
-            ? (() => {
-                const cmd = readBashCommand(event.tool_input);
-                return cmd === null ? null : parseBashPrefix(cmd);
-            })()
-            : null;
+        const riskBashCommand = event.tool_name === "Bash" ? readBashCommand(event.tool_input) : null;
+        const bashPrefix = riskBashCommand === null ? null : parseBashPrefix(riskBashCommand);
+        // Explicit `--context`/`--namespace`/`-n` on a `kubectl ...`
+        // invocation (task a7eb1a71). Fed the REMAINDER after `bashPrefix`
+        // consumed a leading `cd <path> &&` / `VAR=value` / `git switch
+        // <branch> &&` prefix, not the raw command, so a wrapped invocation
+        // like `cd /tmp && kubectl ... --context x` is still covered; see
+        // `parseKubectlTarget`'s own doc comment for the narrow,
+        // command-head-anchored scope this is otherwise kept to, and for
+        // the forms still NOT unwrapped (sudo/time/env wrappers, a kubectl
+        // that is not the first chained segment, a piped kubectl).
+        const kubectlSubject = riskBashCommand === null ? null : riskBashCommand.slice(bashPrefix?.remainderStart ?? 0);
+        const kubectlTarget = kubectlSubject === null ? null : parseKubectlTarget(kubectlSubject);
         const resolverGit = (() => {
             if (bashPrefix === null || bashPrefix.cdTarget === null)
                 return cwdGitContext;
@@ -841,18 +878,31 @@ export async function runInterceptCli(opts = {}) {
         const riskUser = safeOs(() => os.userInfo().username);
         const riskHost = safeOs(() => os.hostname());
         // A leading `git switch`/`checkout <branch>` (task 341e024b) is
-        // merged on top of `resolverGit` above — upgrade-only, see
+        // merged on top of `resolverGit` above, upgrade-only, using the
+        // AMBIENT kube state (`kube` from `resolveKubeContext()` / the
+        // `opts.kubeContext`/`opts.kubeNamespace` test override), unaffected
+        // by the kubectl-target merge below. See
         // `applyBranchSwitchUpgrade`'s own doc comment for why this one is
         // NOT a straight replacement the way the `cd` merge is.
         const gitForRisk = applyBranchSwitchUpgrade(event, manifest, cwd, resolverGit, bashPrefix?.branchTarget ?? null, { env: resolverEnv, kubeContext: kube.context, kubeNamespace: kube.namespace }, riskUser, riskHost, opts.now);
+        // CONFLICT PRIORITY (task a7eb1a71): an explicit kubectl
+        // --context/--namespace/-n is merged on top of the AMBIENT kube
+        // state (`kube`), on top of `gitForRisk` above (the git context
+        // AFTER the branch-switch upgrade), upgrade-only, exactly the same
+        // asymmetric shape the branch-switch merge itself uses. Command
+        // text can only raise the resolved environment toward production,
+        // never lower an already-resolved production; see
+        // `applyKubeTargetUpgrade`'s own doc comment for the measured
+        // downgrade this fixes.
+        const kubeForRisk = applyKubeTargetUpgrade(event, manifest, cwd, gitForRisk, { context: kube.context, namespace: kube.namespace }, kubectlTarget, resolverEnv, riskUser, riskHost, opts.now);
         riskContext = {
             git: gitForRisk,
             cwd,
             user: riskUser,
             host: riskHost,
             env: resolverEnv,
-            kubeContext: kube.context,
-            kubeNamespace: kube.namespace,
+            kubeContext: kubeForRisk.context,
+            kubeNamespace: kubeForRisk.namespace,
         };
     }
     let result;