@lannguyensi/harness 0.49.0 → 0.51.0

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Prefix every auto-minted marker's `approvedBy` carries, distinguishing
+ * it from a human `harness approve understanding` marker (which carries
+ * the operator's own identity string, never this prefix).
+ */
+export declare const AUTO_APPROVED_BY_PREFIX = "auto-mode:";
+/** The harness identifier the Claude Code PreToolUse hook mints markers for. */
+export declare const CLAUDE_CODE_HARNESS = "claude-code";
+/**
+ * The harness identifier the Codex PreToolUse hook mints markers for
+ * (slice 2 of the ADR: same auto path, same fail-closed conditions, a
+ * distinct `approvedBy` segment so an audit can tell the two runtimes
+ * apart). Deliberately NOT re-exported through
+ * `understanding-before-execution/index.ts`: its only consumer is
+ * `src/cli/pack/hook-codex-pre-tool-use.ts`, and widening the runtime
+ * shim's pinned public surface (tests/policy-packs/ube-export-surface.test.ts)
+ * is a separate, conscious act.
+ */
+export declare const CODEX_HARNESS = "codex";
+/**
+ * Build the `approvedBy` value the hook writes into a signed auto-marker:
+ * `auto-mode:<harness>:<mode>`, for example `auto-mode:claude-code:bypassPermissions`
+ * or `auto-mode:codex:bypassPermissions` ("Audit and doctor" in the ADR).
+ * Neither `harness` nor `mode` is validated here; callers pass
+ * already-known-good values (one of the fixed harness constants above and
+ * a `when`-matched mode string).
+ */
+export declare function autoApprovedByFor(harness: string, mode: string): string;
+/** Parsed shape of an `approvedBy` string minted by {@link autoApprovedByFor}. */
+export interface ParsedAutoApprovedBy {
+    harness: string;
+    mode: string;
+}
+/**
+ * Parse an `approvedBy` string back into its harness/mode pair. Returns
+ * `null` for anything that is not exactly `auto-mode:<harness>:<mode>`
+ * with both segments non-empty, including a human marker's `approvedBy`
+ * (which never carries this prefix) and a malformed or truncated auto
+ * value. A slice 3 delegation suffix (`;delegated:<parent-sid>`) is
+ * tolerated: it is stripped before parsing and otherwise ignored, per
+ * the ADR's "Audit and doctor" convention that the delegation binding
+ * packs into the same field without changing the harness/mode shape.
+ */
+export declare function parseAutoApprovedBy(approvedBy: unknown): ParsedAutoApprovedBy | null;
+/**
+ * Build the audit-only ledger fact the ADR's "Audit and doctor" section
+ * names: `understanding-auto-approved:<sid>`, distinct from the human
+ * `understanding-approved:<sid>` tag (`ledger.ts`), following the same
+ * `...:forced:<field>` suffix precedent the ADR cites. Ledger only, never
+ * consulted for the gate decision itself.
+ */
+export declare function autoApprovedLedgerTagFor(sessionId: string): string;
+/**
+ * The harness identifiers `auto_approve.harnesses` accepts, in the order
+ * the schema and every diagnostic list them. Shared with the pack's zod
+ * `configSchema` (`../understanding-before-execution.ts`) so the lint-time
+ * enum and this runtime parser cannot drift apart.
+ */
+export declare const AUTO_APPROVE_HARNESS_VALUES: readonly ["claude-code", "codex"];
+/**
+ * What `auto_approve.harnesses` resolves to when the key is ABSENT.
+ * Claude Code only, deliberately: slice 1 shipped `auto_approve` as a
+ * Claude-only opt-in, so a repo that opted in before slice 2 must keep
+ * exactly the meaning it had — adding the Codex hook to the shared body
+ * must not silently extend an existing opt-in to a second runtime
+ * (reviewer round-1 finding on slice 2). Opting Codex in is an explicit,
+ * visible config edit.
+ */
+export declare const DEFAULT_AUTO_APPROVE_HARNESSES: readonly string[];
+/** Parsed, validated `auto_approve` pack-config block. */
+export interface AutoApproveConfig {
+    /** Allowlist of `permission_mode` payload literals eligible for auto-approval. */
+    when: string[];
+    /**
+     * Allowlist of HARNESSES whose PreToolUse hook may take the auto path
+     * at all. Always non-empty: an absent key resolves to
+     * {@link DEFAULT_AUTO_APPROVE_HARNESSES}, and every malformed shape
+     * fails the whole block closed rather than defaulting.
+     */
+    harnesses: string[];
+}
+/**
+ * Parse the optional `auto_approve` pack-config block
+ * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
+ *
+ * FAIL CLOSED, unlike {@link parseApprovalLifecycle}'s best-effort
+ * fallback: this block is an opt-IN to a hook-side signing path
+ * (hardening item 3 in the ADR's threat model (b) — `require_report:
+ * false` must be a schema error, not a silently-ignored key), so any
+ * malformed shape here means "not opted in" (`null`), never a partial
+ * or default-filled config that could still enable the auto path. The
+ * `configSchema` zod block in `../understanding-before-execution.ts` is
+ * the first line of defence (`harness validate` / `harness doctor`
+ * reject a malformed manifest at lint time); this parser is the second,
+ * defensive line for the runtime hook, which must not trust that every
+ * config it sees on disk passed the schema.
+ *
+ * `undefined` / `null` (the block is simply absent) returns `null`
+ * silently — that is the ordinary "not opted in" case, not a warning.
+ * Every other malformed shape writes exactly one stderr line and
+ * returns `null`.
+ *
+ * `label` is the stderr prefix of the calling hook, so a Codex-side
+ * warning reads `harness pack hook codex: ...` like every other line
+ * that hook writes. The default reproduces the Claude Code hook's
+ * wording byte-for-byte.
+ */
+export declare function parseAutoApprove(raw: unknown, stderr?: {
+    write(s: string): void;
+} | null, label?: string): AutoApproveConfig | null;
+/**
+ * ADR "Additional hardening to specify" item 2: `when` is an allowlist
+ * of payload literals, membership by exact string equality, no case
+ * folding, no substring, no wildcards. `mode` absent, empty, or not a
+ * string means no auto-approval, and `cfg === null` (block absent or
+ * malformed) means no auto-approval regardless of `mode`.
+ */
+export declare function permissionModeAllowed(cfg: AutoApproveConfig | null, mode: unknown): boolean;
+/**
+ * Per-harness opt-in membership, the same exact-string-equality
+ * discipline {@link permissionModeAllowed} applies to `when`. `cfg ===
+ * null` (block absent or malformed) means no auto-approval regardless of
+ * the harness, and an unlisted harness means no auto-approval regardless
+ * of `when` — the two allowlists are independent AND conditions, not
+ * alternatives.
+ *
+ * Re-exported through `understanding-before-execution/index.ts` (round-2
+ * review finding on slice 2): its call site (`src/cli/pack/auto-approve-path.ts`)
+ * imports every sibling symbol it needs (`parseAutoApprove`,
+ * `permissionModeAllowed`, ...) through the runtime shim already, so this
+ * one was pulled onto the pinned shim surface
+ * (tests/policy-packs/ube-export-surface.test.ts) to match, unlike
+ * {@link CODEX_HARNESS} which still has exactly one consumer and stays a
+ * direct import.
+ */
+export declare function harnessAllowed(cfg: AutoApproveConfig | null, harness: unknown): boolean;

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js

@@ -0,0 +1,224 @@
+// `auto_approve` pack-config parsing and shared conventions, split out
+// alongside lifecycle.ts (structural sibling of the former monolithic
+// understanding-before-execution-runtime.ts, agent-tasks 348a4d42).
+// Implements slice 1 of docs/decisions/2026-08-27-ug-auto-mode-approval.md
+// (agent-tasks 74b4b17d): the strict pack-config block that lets an
+// operator opt a permission mode into the hook-written signed
+// auto-marker path, plus the shared `approvedBy` / ledger-tag
+// conventions the hook and doctor consume so there is one authority
+// for the string shapes instead of each caller reimplementing them.
+//
+// This module owns no gate decision and no marker write: it only
+// parses the opt-in config (fail-closed: any malformed shape is
+// treated as "not opted in", never as a partial default) and builds /
+// parses the string conventions the ADR's "Audit and doctor" section
+// documents. The PreToolUse hook (auto-path condition checks) and
+// `harness doctor` (auto-approval listing) are the consumers; both
+// land in later slice-1 tasks and import from here.
+/**
+ * Prefix every auto-minted marker's `approvedBy` carries, distinguishing
+ * it from a human `harness approve understanding` marker (which carries
+ * the operator's own identity string, never this prefix).
+ */
+export const AUTO_APPROVED_BY_PREFIX = "auto-mode:";
+/** The harness identifier the Claude Code PreToolUse hook mints markers for. */
+export const CLAUDE_CODE_HARNESS = "claude-code";
+/**
+ * The harness identifier the Codex PreToolUse hook mints markers for
+ * (slice 2 of the ADR: same auto path, same fail-closed conditions, a
+ * distinct `approvedBy` segment so an audit can tell the two runtimes
+ * apart). Deliberately NOT re-exported through
+ * `understanding-before-execution/index.ts`: its only consumer is
+ * `src/cli/pack/hook-codex-pre-tool-use.ts`, and widening the runtime
+ * shim's pinned public surface (tests/policy-packs/ube-export-surface.test.ts)
+ * is a separate, conscious act.
+ */
+export const CODEX_HARNESS = "codex";
+/**
+ * Build the `approvedBy` value the hook writes into a signed auto-marker:
+ * `auto-mode:<harness>:<mode>`, for example `auto-mode:claude-code:bypassPermissions`
+ * or `auto-mode:codex:bypassPermissions` ("Audit and doctor" in the ADR).
+ * Neither `harness` nor `mode` is validated here; callers pass
+ * already-known-good values (one of the fixed harness constants above and
+ * a `when`-matched mode string).
+ */
+export function autoApprovedByFor(harness, mode) {
+    return `${AUTO_APPROVED_BY_PREFIX}${harness}:${mode}`;
+}
+/**
+ * Parse an `approvedBy` string back into its harness/mode pair. Returns
+ * `null` for anything that is not exactly `auto-mode:<harness>:<mode>`
+ * with both segments non-empty, including a human marker's `approvedBy`
+ * (which never carries this prefix) and a malformed or truncated auto
+ * value. A slice 3 delegation suffix (`;delegated:<parent-sid>`) is
+ * tolerated: it is stripped before parsing and otherwise ignored, per
+ * the ADR's "Audit and doctor" convention that the delegation binding
+ * packs into the same field without changing the harness/mode shape.
+ */
+export function parseAutoApprovedBy(approvedBy) {
+    if (typeof approvedBy !== "string")
+        return null;
+    if (!approvedBy.startsWith(AUTO_APPROVED_BY_PREFIX))
+        return null;
+    const withoutPrefix = approvedBy.slice(AUTO_APPROVED_BY_PREFIX.length);
+    const [withoutDelegation] = withoutPrefix.split(";delegated:");
+    const segments = (withoutDelegation ?? "").split(":");
+    if (segments.length !== 2)
+        return null;
+    const [harness, mode] = segments;
+    if (!harness || !mode)
+        return null;
+    return { harness, mode };
+}
+/**
+ * Build the audit-only ledger fact the ADR's "Audit and doctor" section
+ * names: `understanding-auto-approved:<sid>`, distinct from the human
+ * `understanding-approved:<sid>` tag (`ledger.ts`), following the same
+ * `...:forced:<field>` suffix precedent the ADR cites. Ledger only, never
+ * consulted for the gate decision itself.
+ */
+export function autoApprovedLedgerTagFor(sessionId) {
+    return `understanding-auto-approved:${sessionId}`;
+}
+/**
+ * The harness identifiers `auto_approve.harnesses` accepts, in the order
+ * the schema and every diagnostic list them. Shared with the pack's zod
+ * `configSchema` (`../understanding-before-execution.ts`) so the lint-time
+ * enum and this runtime parser cannot drift apart.
+ */
+export const AUTO_APPROVE_HARNESS_VALUES = [CLAUDE_CODE_HARNESS, CODEX_HARNESS];
+/**
+ * What `auto_approve.harnesses` resolves to when the key is ABSENT.
+ * Claude Code only, deliberately: slice 1 shipped `auto_approve` as a
+ * Claude-only opt-in, so a repo that opted in before slice 2 must keep
+ * exactly the meaning it had — adding the Codex hook to the shared body
+ * must not silently extend an existing opt-in to a second runtime
+ * (reviewer round-1 finding on slice 2). Opting Codex in is an explicit,
+ * visible config edit.
+ */
+export const DEFAULT_AUTO_APPROVE_HARNESSES = [CLAUDE_CODE_HARNESS];
+const KNOWN_AUTO_APPROVE_KEYS = new Set(["when", "harnesses", "require_report"]);
+/**
+ * Parse the optional `auto_approve` pack-config block
+ * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
+ *
+ * FAIL CLOSED, unlike {@link parseApprovalLifecycle}'s best-effort
+ * fallback: this block is an opt-IN to a hook-side signing path
+ * (hardening item 3 in the ADR's threat model (b) — `require_report:
+ * false` must be a schema error, not a silently-ignored key), so any
+ * malformed shape here means "not opted in" (`null`), never a partial
+ * or default-filled config that could still enable the auto path. The
+ * `configSchema` zod block in `../understanding-before-execution.ts` is
+ * the first line of defence (`harness validate` / `harness doctor`
+ * reject a malformed manifest at lint time); this parser is the second,
+ * defensive line for the runtime hook, which must not trust that every
+ * config it sees on disk passed the schema.
+ *
+ * `undefined` / `null` (the block is simply absent) returns `null`
+ * silently — that is the ordinary "not opted in" case, not a warning.
+ * Every other malformed shape writes exactly one stderr line and
+ * returns `null`.
+ *
+ * `label` is the stderr prefix of the calling hook, so a Codex-side
+ * warning reads `harness pack hook codex: ...` like every other line
+ * that hook writes. The default reproduces the Claude Code hook's
+ * wording byte-for-byte.
+ */
+export function parseAutoApprove(raw, stderr, label = "harness pack hook") {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+        stderr?.write(`${label}: config.auto_approve ignored (expected object, got ${typeof raw})\n`);
+        return null;
+    }
+    const obj = raw;
+    const unknownKeys = Object.keys(obj).filter((k) => !KNOWN_AUTO_APPROVE_KEYS.has(k));
+    if (unknownKeys.length > 0) {
+        stderr?.write(`${label}: config.auto_approve ignored (unknown key(s): ${unknownKeys.join(", ")})\n`);
+        return null;
+    }
+    const whenRaw = obj["when"];
+    if (!Array.isArray(whenRaw) || whenRaw.length === 0) {
+        stderr?.write(`${label}: config.auto_approve.when ignored (expected a non-empty string[], got ${Array.isArray(whenRaw) ? "empty array" : typeof whenRaw})\n`);
+        return null;
+    }
+    const when = [];
+    for (const v of whenRaw) {
+        if (typeof v !== "string" || v.length === 0) {
+            stderr?.write(`${label}: config.auto_approve.when ignored (every entry must be a non-empty string, got ${typeof v})\n`);
+            return null;
+        }
+        when.push(v);
+    }
+    // `harnesses`: absent means the slice-1 default (Claude Code only).
+    // Present means an exact, non-empty, duplicate-free list of the known
+    // harness identifiers — anything else fails the whole block closed,
+    // like every other malformed shape here, so a typo'd entry can never
+    // widen the opt-in to a runtime the operator did not name.
+    const harnessesRaw = obj["harnesses"];
+    let harnesses = [...DEFAULT_AUTO_APPROVE_HARNESSES];
+    if (harnessesRaw !== undefined) {
+        if (!Array.isArray(harnessesRaw) || harnessesRaw.length === 0) {
+            stderr?.write(`${label}: config.auto_approve.harnesses ignored (expected a non-empty array of ${AUTO_APPROVE_HARNESS_VALUES.join(" | ")}, got ${Array.isArray(harnessesRaw) ? "empty array" : typeof harnessesRaw})\n`);
+            return null;
+        }
+        const seen = [];
+        for (const v of harnessesRaw) {
+            if (typeof v !== "string" || !AUTO_APPROVE_HARNESS_VALUES.includes(v)) {
+                stderr?.write(`${label}: config.auto_approve.harnesses ignored (every entry must be one of ${AUTO_APPROVE_HARNESS_VALUES.join(", ")}, got ${typeof v === "string" ? `"${v}"` : typeof v})\n`);
+                return null;
+            }
+            if (seen.includes(v)) {
+                stderr?.write(`${label}: config.auto_approve.harnesses ignored (duplicate entry "${v}")\n`);
+                return null;
+            }
+            seen.push(v);
+        }
+        harnesses = seen;
+    }
+    const requireReport = obj["require_report"];
+    if (requireReport !== true) {
+        stderr?.write(`${label}: config.auto_approve ignored (require_report must be true, got ${requireReport === false ? "false" : typeof requireReport})\n`);
+        return null;
+    }
+    return { when, harnesses };
+}
+/**
+ * ADR "Additional hardening to specify" item 2: `when` is an allowlist
+ * of payload literals, membership by exact string equality, no case
+ * folding, no substring, no wildcards. `mode` absent, empty, or not a
+ * string means no auto-approval, and `cfg === null` (block absent or
+ * malformed) means no auto-approval regardless of `mode`.
+ */
+export function permissionModeAllowed(cfg, mode) {
+    if (cfg === null)
+        return false;
+    if (typeof mode !== "string" || mode.length === 0)
+        return false;
+    return cfg.when.includes(mode);
+}
+/**
+ * Per-harness opt-in membership, the same exact-string-equality
+ * discipline {@link permissionModeAllowed} applies to `when`. `cfg ===
+ * null` (block absent or malformed) means no auto-approval regardless of
+ * the harness, and an unlisted harness means no auto-approval regardless
+ * of `when` — the two allowlists are independent AND conditions, not
+ * alternatives.
+ *
+ * Re-exported through `understanding-before-execution/index.ts` (round-2
+ * review finding on slice 2): its call site (`src/cli/pack/auto-approve-path.ts`)
+ * imports every sibling symbol it needs (`parseAutoApprove`,
+ * `permissionModeAllowed`, ...) through the runtime shim already, so this
+ * one was pulled onto the pinned shim surface
+ * (tests/policy-packs/ube-export-surface.test.ts) to match, unlike
+ * {@link CODEX_HARNESS} which still has exactly one consumer and stays a
+ * direct import.
+ */
+export function harnessAllowed(cfg, harness) {
+    if (cfg === null)
+        return false;
+    if (typeof harness !== "string" || harness.length === 0)
+        return false;
+    return cfg.harnesses.includes(harness);
+}
+//# sourceMappingURL=auto-approve.js.map

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/auto-approve.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,oEAAoE;AACpE,8DAA8D;AAC9D,8DAA8D;AAC9D,oEAAoE;AACpE,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,+BAA+B,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAU,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,mBAAmB,CAAC,CAAC;AAevF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,MAA0C,EAC1C,KAAK,GAAG,mBAAmB;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,GAAG,KAAK,CAC/E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,kDAAkD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EACN,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,OAClD,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mFAAmF,OAAO,CAAC,KAAK,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAAS,GAAa,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EAA0E,2BAA2B,CAAC,IAAI,CAChH,KAAK,CACN,SAAS,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,YAAY,KAAK,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAU,CAAC,EAAE,CAAC;gBAC/E,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uEAAuE,2BAA2B,CAAC,IAAI,CAC7G,IAAI,CACL,SAAS,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAC3D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,6DAA6D,CAAC,MAAM,CAC7E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aAC7C,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAA6B,EAAE,IAAa;IAChF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,GAA6B,EAAE,OAAgB;IAC5E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/index.d.ts

@@ -1,4 +1,4 @@
-export type ApprovalSource = "marker" | "ledger" | "persisted-report" | "none" | "recovery-commit";
+export type ApprovalSource = "marker" | "ledger" | "none" | "recovery-commit";
 export interface ApprovalCheckResult {
     approved: boolean;
     source: ApprovalSource;
@@ -6,8 +6,9 @@ export interface ApprovalCheckResult {
 }
 export { APPROVED_LEDGER_TAG_PREFIX, approvedLedgerTagFor, isPolicyDecisionRow, matchLedgerEntries, } from "./ledger.js";
 export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, type ApprovalMarker, writeApprovalMarker, type MarkerCheck, type CheckApprovalMarkerOptions, checkApprovalMarker, clearApprovalMarker, } from "./markers.js";
-export { type PersistedReport, REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, type FindReportOptions, type FindReportSelection, selectReportForSession, findLatestReportForSession, type PersistedReportApprovalCheck, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
+export { type PersistedReport, REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, type FindReportOptions, type FindReportSelection, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, type PersistedReportEvidence, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
 export { type ApprovalLifecycle, parseApprovalLifecycle } from "./lifecycle.js";
+export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, type ParsedAutoApprovedBy, parseAutoApprovedBy, autoApprovedLedgerTagFor, type AutoApproveConfig, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, } from "./auto-approve.js";
 export { APPROVAL_MARKER_TASK_PREFIX, taskApprovalMarkerPathFor, writeTaskApprovalMarker, checkActiveClaimApprovalMarker, type OperatorMarkerApproval, checkOperatorApprovalMarkers, clearTaskApprovalMarker, } from "./task-markers.js";
 export { DEFAULT_BASH_TOOL_NAMES, toolNameMatchesAny, bashCommandMatchesAny, extractBashCommandFromToolInput, extractTaskIdFromToolInput, extractTasksTransitionStatusFromToolInput, type PostToolUseBoundaryMatch, matchPostToolUseBoundary, type ApplyPostToolUseExpiryResult, applyPostToolUseExpiry, describePostToolUseExpiry, } from "./post-tool-use-boundary.js";
 export { ACTIVE_CLAIM_FILENAME, activeClaimPathFor, writeActiveClaim, readActiveClaim, clearActiveClaim, } from "./active-claim.js";

package/dist/policy-packs/builtin/understanding-before-execution/index.js

@@ -1,38 +1,45 @@
 // Phase 6 #4 — runtime helpers for the understanding-before-execution pack.
 //
-// Two-source approval check that the harness-side PreToolUse blocker
-// consults:
+// Single-authority approval check that the harness-side PreToolUse
+// blockers (Claude and Codex) consult, plus two evidence-only probes:
 //
-//   1. Filesystem marker `<generatedDir>/.approvals/<sessionId>` written
-//      by `harness approve understanding` from the operator's shell.
-//      Canonical for harnessed sessions. Replaces the ledger-substring
-//      check that shipped through v0.13.0 (agent-tasks/88ca4bb3): the
-//      agent has direct MCP access to the same ledger that gate path
-//      consulted, so any agent could write `understanding-approved:<sid>`
-//      itself and self-approve. Edit / Write / Bash are all gated by
-//      this same PreToolUse hook, and the configured MCP servers do not
-//      expose filesystem writes, so the marker file is reachable only
-//      from a process the operator launched (their `!`-shell or any
-//      other un-hooked terminal). Operator-side: writeApprovalMarker
-//      below. Forensics: the ledger row is still written by
-//      `harness approve understanding`, for audit only.
-//   2. Persisted JSON report under `.understanding-gate/reports/`
-//      (canonical for solo `@lannguyensi/understanding-gate` users).
-//      The package writes one file per session; the latest with
-//      `approvalStatus: "approved"` matching the session_id wins. The
-//      report is flipped to "approved" by `harness approve`; the
-//      agent's Stop hook only writes `pending` reports and cannot flip
-//      them (Edit/Write/Bash gated), so this source is also operator-
-//      authored.
+//   AUTHORITY. Filesystem marker `<generatedDir>/.approvals/<sessionId>`
+//      (or `task-<id>`) written by `harness approve understanding` from
+//      the operator's shell and HMAC-signed with the operator-side key
+//      (harness/f9485cc7). Replaces the ledger-substring check that
+//      shipped through v0.13.0 (agent-tasks/88ca4bb3): the agent has
+//      direct MCP access to the same ledger that gate path consulted, so
+//      any agent could write `understanding-approved:<sid>` itself and
+//      self-approve. Edit / Write / Bash are all gated by this same
+//      PreToolUse hook, and the configured MCP servers do not expose
+//      filesystem writes, so the marker file is reachable only from a
+//      process the operator launched; the signature is what keeps that
+//      true even if a future write primitive the blocker matcher does
+//      not cover appears. Operator-side: writeApprovalMarker below.
+//   EVIDENCE. Persisted JSON report under `.understanding-gate/reports/`
+//      (owned by `@lannguyensi/understanding-gate`). Flipped to
+//      `approved` by the same `harness approve understanding` call and to
+//      `expired` by the post-tool-use boundary hook, so the audit record
+//      tracks the marker. Until task 7402301d this was a SECOND, equal
+//      approval source, and it was unsigned: under the very threat model
+//      that motivated marker signing, one unsigned JSON write into the
+//      reports directory forged an approval with less effort than the
+//      old marker forgery (no session id, no key read). Gate-time
+//      approval authority now flows only through the signed marker; the
+//      report is consulted for the block diagnostic only
+//      (`checkPersistedReport` returns evidence, never an approval).
+//   EVIDENCE. The evidence-ledger row `understanding-approved:<sid>`,
+//      still written by `harness approve understanding` for forensics.
 //
-// Either source approves. The persisted-report fallback is what makes a
-// solo user without grounding-mcp wired still able to approve via the
-// package's CLI; the marker path is what makes a harnessed session see
-// the approval immediately on the next tool call.
+// Consequence for solo `@lannguyensi/understanding-gate` users running
+// under harness: the package's own `understanding-gate approve` flips
+// the report but writes no signed marker, so it no longer opens the
+// harness gate; `harness approve understanding` is the approval path.
 export { APPROVED_LEDGER_TAG_PREFIX, approvedLedgerTagFor, isPolicyDecisionRow, matchLedgerEntries, } from "./ledger.js";
 export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, writeApprovalMarker, checkApprovalMarker, clearApprovalMarker, } from "./markers.js";
-export { REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, selectReportForSession, findLatestReportForSession, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
+export { REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
 export { parseApprovalLifecycle } from "./lifecycle.js";
+export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, parseAutoApprovedBy, autoApprovedLedgerTagFor, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, } from "./auto-approve.js";
 export { APPROVAL_MARKER_TASK_PREFIX, taskApprovalMarkerPathFor, writeTaskApprovalMarker, checkActiveClaimApprovalMarker, checkOperatorApprovalMarkers, clearTaskApprovalMarker, } from "./task-markers.js";
 export { DEFAULT_BASH_TOOL_NAMES, toolNameMatchesAny, bashCommandMatchesAny, extractBashCommandFromToolInput, extractTaskIdFromToolInput, extractTasksTransitionStatusFromToolInput, matchPostToolUseBoundary, applyPostToolUseExpiry, describePostToolUseExpiry, } from "./post-tool-use-boundary.js";
 export { ACTIVE_CLAIM_FILENAME, activeClaimPathFor, writeActiveClaim, readActiveClaim, clearActiveClaim, } from "./active-claim.js";

package/dist/policy-packs/builtin/understanding-before-execution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,qEAAqE;AACrE,YAAY;AACZ,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,4DAA4D;AAC5D,wDAAwD;AACxD,kEAAkE;AAClE,qEAAqE;AACrE,gEAAgE;AAChE,sEAAsE;AACtE,iEAAiE;AACjE,uEAAuE;AACvE,sEAAsE;AACtE,iBAAiB;AACjB,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,kDAAkD;AAelD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAE9B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AActE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAEjB,mBAAmB,EACnB,wBAAwB,EAExB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAE9B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/markers.js

@@ -1,5 +1,5 @@
-// Session-scoped approval marker file (filesystem source of the
-// two-source approval check), split out of the former monolithic
+// Session-scoped approval marker file (the signed filesystem source that
+// is the gate's only approval authority), split out of the former monolithic
 // understanding-before-execution-runtime.ts (structural concentration
 // slice 2, agent-tasks 348a4d42). Pure move: see
 // src/policy-packs/builtin/understanding-before-execution/index.ts for

package/dist/policy-packs/builtin/understanding-before-execution/markers.js.map

@@ -1 +1 @@
-{"version":3,"file":"markers.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/markers.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,iEAAiE;AACjE,sEAAsE;AACtE,iDAAiD;AACjD,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;IAC3E,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,SAAiB,EACjB,MAAsB;IAEtB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,SAAiB,EACjB,OAAmC,EAAE;IAErC,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;YACF,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,uDAAuD;IACvD,uEAAuE;IACvE,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB,QAAQ,EAAE;YAC3C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sDAAsD,QAAQ,EAAE;YACxE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+CAA+C,QAAQ,EAAE;YACjE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,oEAAoE;QACpE,iEAAiE;QACjE,mEAAmE;QACnE,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sBAAsB,QAAQ,0GAA0G;YAChJ,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,qBAAqB;IACrB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mDAAmD,QAAQ,uBAAuB;YAC1F,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,oEAAoE;YACpE,yDAAyD;YACzD,mEAAmE;YACnE,qEAAqE;YACrE,SAAS;YACT,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,sBAAsB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,0BAA0B;gBAC9G,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;YAC/E,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAW,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAW,CAAC;IAC/C,MAAM,iBAAiB,GACrB,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,mBAAmB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,MAAM,GAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAE7E,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;gBAClD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mBAAmB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,MAAM,WAAW,MAAM,kBAAkB,UAAU,GAAG;oBACzH,MAAM;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,KAAK;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,uBAAuB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,UAAU,OAAO,UAAU,sBAAsB;QACxH,MAAM;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,SAAiB;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"markers.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/markers.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,sEAAsE;AACtE,iDAAiD;AACjD,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;IAC3E,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,SAAiB,EACjB,MAAsB;IAEtB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,SAAiB,EACjB,OAAmC,EAAE;IAErC,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0CACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;YACF,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,uDAAuD;IACvD,uEAAuE;IACvE,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB,QAAQ,EAAE;YAC3C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sDAAsD,QAAQ,EAAE;YACxE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+CAA+C,QAAQ,EAAE;YACjE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,oEAAoE;QACpE,iEAAiE;QACjE,mEAAmE;QACnE,yDAAyD;QACzD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sBAAsB,QAAQ,0GAA0G;YAChJ,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,qBAAqB;IACrB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mDAAmD,QAAQ,uBAAuB;YAC1F,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,oEAAoE;YACpE,yDAAyD;YACzD,mEAAmE;YACnE,qEAAqE;YACrE,SAAS;YACT,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,sBAAsB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,0BAA0B;gBAC9G,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oCAAoC,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;YAC/E,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAW,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAW,CAAC;IAC/C,MAAM,iBAAiB,GACrB,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,mBAAmB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,MAAM,GAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAE7E,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;gBAClD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mBAAmB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,MAAM,WAAW,MAAM,kBAAkB,UAAU,GAAG;oBACzH,MAAM;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,KAAK;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,uBAAuB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,UAAU,OAAO,UAAU,sBAAsB;QACxH,MAAM;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,SAAiB;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/measured-permission-modes.d.ts

@@ -0,0 +1,29 @@
+export type MeasuredHarness = "claude-code" | "codex";
+export interface MeasuredPermissionMode {
+    readonly harness: MeasuredHarness;
+    readonly permissionMode: string;
+    /** Repo-relative path under dogfood/ug-auto-mode-signals/payloads/. */
+    readonly fixture: string;
+}
+/** Repo-relative directory every registry fixture must live in. */
+export declare const MEASURED_FIXTURES_DIR = "dogfood/ug-auto-mode-signals/payloads";
+/**
+ * Which harness a fixture file under {@link MEASURED_FIXTURES_DIR} was
+ * captured from, by file-name convention: `codex-*` is Codex, anything
+ * else is Claude Code. Shared with the sync test so the convention has
+ * one definition.
+ */
+export declare function harnessForFixtureFile(basename: string): MeasuredHarness;
+export declare const MEASURED_PERMISSION_MODES: ReadonlyArray<MeasuredPermissionMode>;
+/**
+ * True when the given HARNESS has a measured fixture for this exact
+ * literal. `auto_approve.harnesses` (docs/decisions/2026-08-27-ug-auto-mode-approval.md,
+ * Slice 2) scopes which harnesses' PreToolUse hooks may take the auto
+ * path at all, so "measured" is checked per listed harness, not across
+ * the whole registry: a literal measured only for Claude Code is not
+ * evidence that Codex ever emits it. Exact string equality: no case
+ * folding, no wildcards.
+ */
+export declare function isMeasuredPermissionModeFor(literal: string, harness: MeasuredHarness): boolean;
+/** Sorted, de-duplicated list of every literal measured for HARNESS. */
+export declare function measuredPermissionModeLiteralsFor(harness: MeasuredHarness): string[];

package/dist/policy-packs/builtin/understanding-before-execution/measured-permission-modes.js

@@ -0,0 +1,82 @@
+// Registry of measured `permission_mode` literals for the
+// `auto_approve.when` allowlist (docs/decisions/2026-08-27-ug-auto-mode-approval.md,
+// Slice 2 AC 3, "Option A").
+//
+// RULE: an entry is added here ONLY together with a checked-in dogfood
+// fixture (under `dogfood/ug-auto-mode-signals/payloads/`) that shows the
+// named harness actually emitting that exact `permission_mode` string on a
+// `PreToolUse` hook payload. `tests/policy-packs/measured-permission-modes-sync.test.ts`
+// enforces both directions: every entry here must be backed by a fixture
+// that carries the claimed value, and every `permission_mode` value found
+// in any `*.PreToolUse.json` fixture must be registered for its harness.
+// Do not add a literal "because it seems plausible": capture a fixture
+// first, then register it.
+//
+// A fixture's harness is bound by its file name: `codex-*` fixtures are
+// Codex captures, every other `*.PreToolUse.json` under the payloads
+// directory is a Claude Code capture (`harnessForFixtureFile`). The sync
+// test checks each entry's fixture name against the entry's `harness`, so
+// a Claude Code fixture cannot back a Codex claim or vice versa.
+//
+// `harness validate` runs in the OPERATOR's repo, which has no `dogfood/`
+// directory, so this registry ships inside the package as a constant
+// (`checkUnderstandingBeforeExecutionAutoApproveMeasured` in
+// `src/cli/validate/checks.ts` consults it without touching the
+// filesystem); the sync test above is what keeps it honest against the
+// fixtures in THIS repo.
+/** Repo-relative directory every registry fixture must live in. */
+export const MEASURED_FIXTURES_DIR = "dogfood/ug-auto-mode-signals/payloads";
+const PAYLOADS_DIR = MEASURED_FIXTURES_DIR;
+/**
+ * Which harness a fixture file under {@link MEASURED_FIXTURES_DIR} was
+ * captured from, by file-name convention: `codex-*` is Codex, anything
+ * else is Claude Code. Shared with the sync test so the convention has
+ * one definition.
+ */
+export function harnessForFixtureFile(basename) {
+    return basename.startsWith("codex-") ? "codex" : "claude-code";
+}
+export const MEASURED_PERMISSION_MODES = [
+    {
+        harness: "claude-code",
+        permissionMode: "default",
+        fixture: `${PAYLOADS_DIR}/claude-p-default.PreToolUse.json`,
+    },
+    {
+        harness: "claude-code",
+        permissionMode: "acceptEdits",
+        fixture: `${PAYLOADS_DIR}/claude-p-acceptedits.PreToolUse.json`,
+    },
+    {
+        harness: "claude-code",
+        permissionMode: "bypassPermissions",
+        fixture: `${PAYLOADS_DIR}/claude-p-bypass.PreToolUse.json`,
+    },
+    {
+        harness: "codex",
+        permissionMode: "bypassPermissions",
+        fixture: `${PAYLOADS_DIR}/codex-exec-default.PreToolUse.json`,
+    },
+    {
+        harness: "codex",
+        permissionMode: "default",
+        fixture: `${PAYLOADS_DIR}/codex-tui-default.PreToolUse.json`,
+    },
+];
+/**
+ * True when the given HARNESS has a measured fixture for this exact
+ * literal. `auto_approve.harnesses` (docs/decisions/2026-08-27-ug-auto-mode-approval.md,
+ * Slice 2) scopes which harnesses' PreToolUse hooks may take the auto
+ * path at all, so "measured" is checked per listed harness, not across
+ * the whole registry: a literal measured only for Claude Code is not
+ * evidence that Codex ever emits it. Exact string equality: no case
+ * folding, no wildcards.
+ */
+export function isMeasuredPermissionModeFor(literal, harness) {
+    return MEASURED_PERMISSION_MODES.some((entry) => entry.harness === harness && entry.permissionMode === literal);
+}
+/** Sorted, de-duplicated list of every literal measured for HARNESS. */
+export function measuredPermissionModeLiteralsFor(harness) {
+    return Array.from(new Set(MEASURED_PERMISSION_MODES.filter((entry) => entry.harness === harness).map((entry) => entry.permissionMode))).sort();
+}
+//# sourceMappingURL=measured-permission-modes.js.map