@lannguyensi/harness 0.49.0 → 0.51.0

package/dist/cli/doctor/settings-drift.js

@@ -0,0 +1,189 @@
+// Settings-drift half of ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md
+// slice 1 (agent-tasks 74b4b17d), threat model (c): "The permission mode
+// itself is settings-derived, and settings files are agent-editable
+// after approval" and "The same settings write also reaches the hook
+// roster, which supplies key two." A post-approval agent can plant
+// `permissions.defaultMode: "bypassPermissions"` (key one) and/or a
+// `UserPromptSubmit`/`SessionStart` hook entry that mints a report for
+// every later session (key two) into a Claude Code settings file, and
+// nothing named that plant before this check: `harness diff
+// --since-apply` only re-hashes the whole `--target` file as a lock
+// entry, so it flags SOME change without naming which key moved.
+//
+// What this module actually has to compare against, verified against
+// the real `apply()` code path (not assumed from the ADR prose):
+//
+//   - `.last-apply` (`src/io/last-apply.ts`) stores exactly ONE
+//     `files["settings.json"]` entry: harness's own GENERATED
+//     settings.json content (`buildExpectedFiles` in apply.ts), keyed by
+//     basename, not by which `--target` path it was merged into. Harness
+//     never writes `permissions.defaultMode` itself
+//     (`generate-settings.ts` has no such key), and `--merge` replaces
+//     `hooks` WHOLESALE (`src/io/merge-settings.ts`'s module header: "harness
+//     owns whichever top-level keys appear in the generated output...
+//     hooks stays wholesale-owned"). So this one snapshot is, for every
+//     settings file harness has ever targeted, an accurate "what harness
+//     itself put there at apply time" baseline: defaultMode absent
+//     (harness never owns it) and hooks exactly the generated roster (no
+//     operator hand-added hook entry survives a `--merge`).
+//   - `harness.lock` (`src/io/harness-lock.ts`) records which absolute
+//     path(s) were an actual `--target` write, as a `kind: "target"`
+//     entry. This is how a live settings file is told apart from one
+//     harness has never touched: matching against this lock entry is
+//     the "SAME path" mapping the file was written under.
+//
+// A file whose absolute path has no `target` lock entry never received
+// harness's baseline at all, so it gets the EMPTY baseline (everything
+// in it reads as "absent at last apply") rather than the shared
+// generated-settings.json baseline.
+//
+// Warnings only, never a block; this is the compensating control named
+// in the ADR, not an enforcement (the enforcing lever is the managed
+// setting in operator decision 7).
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readLastApply } from "../../io/last-apply.js";
+import { readLock } from "../../io/harness-lock.js";
+import { safeJsonParse } from "../../io/safe-json-parse.js";
+import { resolveSettingsPath as resolveUserSettingsPath } from "./claude-mcp.js";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function hookIdentityKey(h) {
+    return JSON.stringify([h.event, h.matcher, h.type, h.command]);
+}
+/**
+ * Enumerate every `hooks[event][].hooks[]` entry in a parsed settings
+ * object as an identity tuple. Mirrors the group-parsing convention
+ * `collectOwnedHookGroups`/`classifyHookGroup` use in
+ * `src/cli/uninstall/index.ts` for the same on-disk shape. Malformed
+ * groups/entries are skipped rather than throwing — a live settings.json
+ * this check does not own may carry shapes this parser has no opinion
+ * about.
+ */
+function collectHookIdentities(hooksValue) {
+    const out = [];
+    if (!isRecord(hooksValue))
+        return out;
+    for (const event of Object.keys(hooksValue)) {
+        const groups = hooksValue[event];
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            if (!isRecord(group))
+                continue;
+            const matcher = typeof group["matcher"] === "string" ? group["matcher"] : "";
+            const inner = group["hooks"];
+            if (!Array.isArray(inner))
+                continue;
+            for (const h of inner) {
+                if (!isRecord(h))
+                    continue;
+                const type = typeof h["type"] === "string" ? h["type"] : "";
+                const command = typeof h["command"] === "string" ? h["command"] : "";
+                out.push({ event, matcher, type, command });
+            }
+        }
+    }
+    return out;
+}
+function defaultModeOf(settings) {
+    const permissions = settings["permissions"];
+    if (!isRecord(permissions))
+        return undefined;
+    const mode = permissions["defaultMode"];
+    return typeof mode === "string" ? mode : undefined;
+}
+function checkOneFile(file, baseline, targetAbsPaths, warnings) {
+    // Plain read, no readRegularFileRejectingSymlink: this is a live
+    // Claude Code settings file (project or user scope), not one of
+    // harness's own generated artefacts, and doctor's existing reader for
+    // this exact file class (`findDeadSettingsMcpNames` in claude-mcp.ts)
+    // already reads it the same way — a missing file resolves to "nothing
+    // to report" here too, not a symlink-defense case.
+    let raw;
+    try {
+        raw = fs.readFileSync(file.absolutePath, "utf8");
+    }
+    catch {
+        return;
+    }
+    const parsed = safeJsonParse(raw);
+    if (!isRecord(parsed)) {
+        warnings.push(`${file.displayLabel}: unreadable settings JSON`);
+        return;
+    }
+    const live = parsed;
+    const hasSnapshot = targetAbsPaths.has(path.resolve(file.absolutePath));
+    const effectiveBaseline = hasSnapshot ? baseline : {};
+    const suffix = hasSnapshot ? "" : " (no apply snapshot for this file)";
+    const liveMode = defaultModeOf(live);
+    const baselineMode = defaultModeOf(effectiveBaseline);
+    if (liveMode !== undefined && liveMode !== baselineMode) {
+        if (baselineMode === undefined) {
+            warnings.push(`permissions.defaultMode set in ${file.displayLabel} but absent at last apply: ${liveMode}${suffix}`);
+        }
+        else {
+            warnings.push(`permissions.defaultMode set in ${file.displayLabel} changed from ${baselineMode} to ${liveMode}${suffix}`);
+        }
+    }
+    const liveHooks = collectHookIdentities(live["hooks"]);
+    const baselineHookKeys = new Set(collectHookIdentities(effectiveBaseline["hooks"]).map(hookIdentityKey));
+    for (const h of liveHooks) {
+        if (baselineHookKeys.has(hookIdentityKey(h)))
+            continue;
+        warnings.push(`hook entries in ${file.displayLabel} absent at last apply: ${h.event}/${h.matcher || "*"}${suffix}`);
+    }
+}
+/** `~`-relativize `absPath` under `home` for display; never leak the raw absolute path. */
+function tildeize(absPath, home) {
+    const resolvedHome = path.resolve(home);
+    const resolvedPath = path.resolve(absPath);
+    if (resolvedPath === resolvedHome)
+        return "~";
+    const withSep = resolvedHome.endsWith(path.sep) ? resolvedHome : `${resolvedHome}${path.sep}`;
+    if (resolvedPath.startsWith(withSep)) {
+        return path.join("~", resolvedPath.slice(withSep.length));
+    }
+    return absPath;
+}
+export function buildSettingsDrift(opts) {
+    const notes = [];
+    const warnings = [];
+    const lastApply = readLastApply(opts.generatedDir);
+    if (lastApply === null) {
+        notes.push("no apply snapshot; settings drift not checked");
+        return { notes, warnings };
+    }
+    const baselineRaw = lastApply.files["settings.json"]?.content;
+    let baseline = {};
+    if (baselineRaw !== undefined) {
+        const parsed = safeJsonParse(baselineRaw);
+        if (isRecord(parsed))
+            baseline = parsed;
+    }
+    const lockEntries = readLock(opts.lockPath) ?? [];
+    const targetAbsPaths = new Set(lockEntries
+        .filter((e) => e.kind === "target")
+        .map((e) => path.resolve(e.path)));
+    const userSettingsPath = resolveUserSettingsPath(opts.home, opts.env);
+    const candidates = [
+        {
+            absolutePath: path.resolve(opts.cwd, ".claude", "settings.json"),
+            displayLabel: ".claude/settings.json",
+        },
+        {
+            absolutePath: path.resolve(opts.cwd, ".claude", "settings.local.json"),
+            displayLabel: ".claude/settings.local.json",
+        },
+        {
+            absolutePath: path.resolve(userSettingsPath),
+            displayLabel: tildeize(userSettingsPath, opts.home),
+        },
+    ];
+    for (const c of candidates) {
+        checkOneFile(c, baseline, targetAbsPaths, warnings);
+    }
+    return { notes, warnings };
+}
+//# sourceMappingURL=settings-drift.js.map

package/dist/cli/doctor/settings-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-drift.js","sourceRoot":"","sources":["../../../src/cli/doctor/settings-drift.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,4DAA4D;AAC5D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,gEAAgE;AAChE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,oDAAoD;AACpD,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,mEAAmE;AACnE,yEAAyE;AACzE,4DAA4D;AAC5D,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,oCAAoC;AACpC,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,mCAAmC;AAEnC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAoB,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,IAAI,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAejF,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAUD,SAAS,eAAe,CAAC,CAAe;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,UAAmB;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC;IACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CACnB,IAAuB,EACvB,QAAiC,EACjC,cAAmC,EACnC,QAAkB;IAElB,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,4BAA4B,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC;IAEpB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC;IAEvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,8BAA8B,QAAQ,GAAG,MAAM,EAAE,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,iBAAiB,YAAY,OAAO,QAAQ,GAAG,MAAM,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvD,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,CAAC,YAAY,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9F,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC9D,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,MAAM,CAAC;IAC1C,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,WAAW;SACR,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;IAEF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,UAAU,GAAwB;QACtC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC;YAChE,YAAY,EAAE,uBAAuB;SACtC;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC;YACtE,YAAY,EAAE,6BAA6B;SAC5C;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC5C,YAAY,EAAE,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC;SACpD;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/cli/doctor/types.d.ts

@@ -9,6 +9,8 @@ import type { NpmBinReport } from "./npm-bin-path.js";
 import type { RogueLedgerDb } from "./rogue-ledger.js";
 import type { UnderstandingModeEnvDivergence } from "./understanding-mode-env.js";
 import type { ToolchainParitySection } from "./toolchain-parity.js";
+import type { UgAutoApprovalsSection } from "./ug-auto-approvals.js";
+import type { SettingsDriftSection } from "./settings-drift.js";
 /**
  * Phase 6 #6 follow-up — doctor target identifier. Distinct from
  * `Runtime` (which gates `harness apply --runtime`): doctor only adds
@@ -114,6 +116,14 @@ export interface PolicyEntryReport {
     caveat: string;
     /** Present when this policy has an unproduced freshness-gated tag. */
     producerGap?: PolicyProducerGap;
+    /**
+     * True when this policy object was derived from `workflows[]`
+     * (`isDerivedPolicy`, F7, review round 2) rather than hand-authored
+     * under `policies:`. Rendered as "(derived from workflows[])" so an
+     * operator reading `harness doctor` output can tell provenance apart
+     * without cross-referencing `workflows:` themselves.
+     */
+    derived?: boolean;
 }
 /**
  * A declared policy pack whose `source` or builtin name does not
@@ -229,6 +239,24 @@ export interface WorkflowsSectionReport {
     declared: number;
     templates: number;
     entries: WorkflowEntryReport[];
+    /**
+     * `checkWorkflowGateWiring` errors (F3, review round 2, 99f47307 Slice
+     * 1): a `spawn: "required"` review-then-merge workflow whose runtime
+     * merge gate is not correctly wired (a missing evidence hook, or one
+     * declared under the right name but the wrong trigger surface/command).
+     * `harness doctor` previously imported checks selectively and never ran
+     * this one, so it showed green on exactly this misconfiguration.
+     * Delegates to the shared validate check, mirroring `templateDrift`.
+     * Each rolls into `errorCount`.
+     */
+    errors: string[];
+    /**
+     * `checkWorkflowGateWeakOverlap` warnings (F1, review round 2): a
+     * hand-authored policy sharing a derived gate's trigger surface but
+     * weaker than it (does not suppress the derived gate, just worth
+     * flagging). Each rolls into `warningCount`.
+     */
+    warnings: string[];
 }
 /**
  * Phase 7 #6 — Risk Gate wiring health. Reports whether the three Risk
@@ -353,6 +381,28 @@ export interface DoctorReport {
      * `understanding-mode-env.ts` for the full rationale.
      */
     understandingModeEnv?: UnderstandingModeEnvDivergence;
+    /**
+     * Auto-approval listing + last-N metric (ADR
+     * docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1,
+     * agent-tasks 74b4b17d, "Audit and doctor"). Present only when the
+     * `understanding-before-execution` pack is declared and enabled
+     * (mirrors `understandingModeEnv`'s gate) — a manifest that never
+     * uses the pack has no `.approvals/` markers this listing owns an
+     * opinion about. Purely informational (`ℹ`); never rolls into
+     * `warningCount`.
+     */
+    ugAutoApprovals?: UgAutoApprovalsSection;
+    /**
+     * Settings-drift compensating control (same ADR, threat model (c)): a
+     * `permissions.defaultMode` or hook entry present in a live Claude
+     * Code settings file but absent from harness's own last-apply
+     * snapshot. Present only when the understanding-gate pack is enabled
+     * AND `harness apply` has run at least once for this manifest
+     * (`harness.generated/` exists) — otherwise there is no baseline to
+     * compare against and nothing to say. `warnings` roll into
+     * `warningCount`; `notes` never do.
+     */
+    settingsDrift?: SettingsDriftSection;
     memory: MemoryReport;
     hooks: HookEntryReport[];
     policies: PolicyEntryReport[];
@@ -452,5 +502,7 @@ export interface DoctorReport {
 export type { NpmBinReport } from "./npm-bin-path.js";
 export type { ClaudeMcpRegistrationSection, ClaudeMcpEntryReport } from "./claude-mcp.js";
 export type { UnderstandingModeEnvDivergence } from "./understanding-mode-env.js";
+export type { UgAutoApprovalsSection, AutoApprovalListingEntry } from "./ug-auto-approvals.js";
+export type { SettingsDriftSection } from "./settings-drift.js";
 export type { ToolchainParitySection, ToolchainParityPeerReport } from "./toolchain-parity.js";
 export type { Manifest, McpProbeResult, MemoryReport, StaleMemory, CodexTargetReport, RogueLedgerDb, };

package/dist/cli/doctor/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/doctor/types.ts"],"names":[],"mappings":"AAYA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAC;AAGnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/doctor/types.ts"],"names":[],"mappings":"AAcA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAC;AAGnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC"}

package/dist/cli/doctor/ug-auto-approvals.d.ts

@@ -0,0 +1,40 @@
+/** Default doctor window when `--recent-sessions` is not passed. */
+export declare const DEFAULT_RECENT_SESSIONS = 20;
+export interface AutoApprovalListingEntry {
+    sessionId: string;
+    mode: string;
+    harness: string;
+    approvedAt: string;
+}
+export interface UgAutoApprovalsSection {
+    /** Whether `<generatedDir>/.approvals/` exists at all. */
+    approvalsDirPresent: boolean;
+    /** The `recentSessions` window that was applied. */
+    windowSize: number;
+    /** Auto approvals among the newest `windowSize` session markers. */
+    autoApprovedCount: number;
+    /** Per-mode breakdown of `autoApprovedCount` (e.g. `{bypassPermissions: 3}`). */
+    byMode: Record<string, number>;
+    /** Per-harness breakdown of `autoApprovedCount` (e.g. `{"claude-code": 3}`). */
+    byHarness: Record<string, number>;
+    /** `(sessionId, mode, approvedAt)` for each auto approval in the window, newest first. */
+    entries: AutoApprovalListingEntry[];
+    /**
+     * Session markers whose body could not be read as JSON with a
+     * parseable `approvedAt` (corrupt file, non-JSON content, missing
+     * `approvedAt`). Excluded from the window (there is no timestamp to
+     * sort them by) and never counted as auto approvals; surfaced as a
+     * single summary count instead of per-file noise.
+     */
+    unreadableCount: number;
+}
+/**
+ * Build the auto-approval listing + last-N metric. Pure filesystem read;
+ * never throws for ordinary "nothing to see" states (missing
+ * `.approvals/`, empty directory, every marker unreadable) — those all
+ * resolve to an empty-ish section rather than an exception, mirroring
+ * the rest of doctor's read-only checks.
+ */
+export declare function buildUgAutoApprovals(generatedDir: string, opts: {
+    recentSessions: number;
+}): UgAutoApprovalsSection;

package/dist/cli/doctor/ug-auto-approvals.js

@@ -0,0 +1,116 @@
+// Doctor visibility half of ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md
+// slice 1 (agent-tasks 74b4b17d): the "auto approvals in the last N
+// sessions" listing named in the ADR's "Audit and doctor" section and
+// slice 1 acceptance criterion 7.
+//
+// Scans `<generatedDir>/.approvals/` for SESSION markers (skips the
+// per-task markers named `task-<id>` and the branch-protection markers
+// named `branch-protection-<sid>`, neither of which is a session
+// approval), sorts the readable ones newest-first by `approvedAt`,
+// takes the newest `recentSessions` of them, and reports how many of
+// THOSE were minted by the auto path (`approvedBy` starting with
+// `auto-mode:`, see auto-approve.ts's `parseAutoApprovedBy`).
+//
+// This is an AUDIT SURFACE, not a security check: it never verifies a
+// marker's HMAC signature (that is `checkApprovalMarker`'s job at gate
+// time; a forged marker still gets rejected there regardless of what
+// this listing shows) and it never blocks or writes anything.
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
+import { safeJsonParse } from "../../io/safe-json-parse.js";
+import { BRANCH_PROTECTION_MARKER_PREFIX } from "../../policy-packs/builtin/branch-protection-runtime.js";
+import { APPROVAL_MARKER_DIRNAME, APPROVAL_MARKER_TASK_PREFIX, parseAutoApprovedBy, } from "../../policy-packs/builtin/understanding-before-execution/index.js";
+/** Default doctor window when `--recent-sessions` is not passed. */
+export const DEFAULT_RECENT_SESSIONS = 20;
+function emptySection(windowSize) {
+    return {
+        approvalsDirPresent: false,
+        windowSize,
+        autoApprovedCount: 0,
+        byMode: {},
+        byHarness: {},
+        entries: [],
+        unreadableCount: 0,
+    };
+}
+/**
+ * Build the auto-approval listing + last-N metric. Pure filesystem read;
+ * never throws for ordinary "nothing to see" states (missing
+ * `.approvals/`, empty directory, every marker unreadable) — those all
+ * resolve to an empty-ish section rather than an exception, mirroring
+ * the rest of doctor's read-only checks.
+ */
+export function buildUgAutoApprovals(generatedDir, opts) {
+    const windowSize = opts.recentSessions;
+    const dir = path.join(generatedDir, APPROVAL_MARKER_DIRNAME);
+    let dirents;
+    try {
+        dirents = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return emptySection(windowSize);
+    }
+    const readable = [];
+    let unreadableCount = 0;
+    for (const d of dirents) {
+        const name = d.name;
+        if (name.startsWith(APPROVAL_MARKER_TASK_PREFIX))
+            continue;
+        if (name.startsWith(BRANCH_PROTECTION_MARKER_PREFIX))
+            continue;
+        const full = path.join(dir, name);
+        const read = readRegularFileRejectingSymlink(full);
+        // A symlink / non-regular / raced-away entry is not a session marker
+        // this listing owns an opinion about; skip silently rather than
+        // counting it as "unreadable" (that count is for a FILE we expected
+        // to be a marker but could not parse).
+        if (read.kind === "symlink" || read.kind === "not-regular" || read.kind === "missing") {
+            continue;
+        }
+        if (read.kind === "unreadable") {
+            unreadableCount++;
+            continue;
+        }
+        const parsed = safeJsonParse(read.content);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            unreadableCount++;
+            continue;
+        }
+        const obj = parsed;
+        const approvedAt = obj["approvedAt"];
+        if (typeof approvedAt !== "string" || Number.isNaN(Date.parse(approvedAt))) {
+            unreadableCount++;
+            continue;
+        }
+        readable.push({ sessionId: name, approvedAt, approvedBy: obj["approvedBy"] });
+    }
+    readable.sort((a, b) => Date.parse(b.approvedAt) - Date.parse(a.approvedAt));
+    const windowed = readable.slice(0, windowSize);
+    const byMode = {};
+    const byHarness = {};
+    const entries = [];
+    for (const m of windowed) {
+        const parsedAuto = parseAutoApprovedBy(m.approvedBy);
+        if (parsedAuto === null)
+            continue;
+        byMode[parsedAuto.mode] = (byMode[parsedAuto.mode] ?? 0) + 1;
+        byHarness[parsedAuto.harness] = (byHarness[parsedAuto.harness] ?? 0) + 1;
+        entries.push({
+            sessionId: m.sessionId,
+            mode: parsedAuto.mode,
+            harness: parsedAuto.harness,
+            approvedAt: m.approvedAt,
+        });
+    }
+    return {
+        approvalsDirPresent: true,
+        windowSize,
+        autoApprovedCount: entries.length,
+        byMode,
+        byHarness,
+        entries,
+        unreadableCount,
+    };
+}
+//# sourceMappingURL=ug-auto-approvals.js.map

package/dist/cli/doctor/ug-auto-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ug-auto-approvals.js","sourceRoot":"","sources":["../../../src/cli/doctor/ug-auto-approvals.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,oEAAoE;AACpE,sEAAsE;AACtE,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,iEAAiE;AACjE,8DAA8D;AAC9D,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,8DAA8D;AAE9D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,oEAAoE,CAAC;AAE5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAgC1C,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO;QACL,mBAAmB,EAAE,KAAK;QAC1B,UAAU;QACV,iBAAiB,EAAE,CAAC;QACpB,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,IAAgC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAE7D,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAqE,EAAE,CAAC;IACtF,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC;YAAE,SAAS;QAE/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACnD,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,uCAAuC;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,eAAe,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,eAAe,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3E,eAAe,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,mBAAmB,EAAE,IAAI;QACzB,UAAU;QACV,iBAAiB,EAAE,OAAO,CAAC,MAAM;QACjC,MAAM;QACN,SAAS;QACT,OAAO;QACP,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/understanding-mode-env.d.ts

@@ -36,4 +36,14 @@ export interface UnderstandingModeEnvDivergence {
  *     warn about.
  *   - the normalised env mode differs from the resolved `config.mode`.
  */
+/**
+ * Shared gate for the understanding-gate doctor sub-checks that only
+ * make sense when the pack is actually live: this divergence advisory,
+ * and (ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1,
+ * agent-tasks 74b4b17d) the auto-approval listing and settings-drift
+ * checks. Declared-but-disabled counts as not enabled, mirroring the
+ * `p.enabled !== false` gate `checkUnderstandingModeEnvDivergence` uses
+ * inline below.
+ */
+export declare function isUnderstandingPackEnabled(manifest: Manifest): boolean;
 export declare function checkUnderstandingModeEnvDivergence(manifest: Manifest, env: NodeJS.ProcessEnv): UnderstandingModeEnvDivergence | undefined;

package/dist/cli/doctor/understanding-mode-env.js

@@ -48,6 +48,18 @@ import { isMode, MODE_ENV, PACK_NAME as UNDERSTANDING_PACK_NAME, resolveModeFrom
  *     warn about.
  *   - the normalised env mode differs from the resolved `config.mode`.
  */
+/**
+ * Shared gate for the understanding-gate doctor sub-checks that only
+ * make sense when the pack is actually live: this divergence advisory,
+ * and (ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1,
+ * agent-tasks 74b4b17d) the auto-approval listing and settings-drift
+ * checks. Declared-but-disabled counts as not enabled, mirroring the
+ * `p.enabled !== false` gate `checkUnderstandingModeEnvDivergence` uses
+ * inline below.
+ */
+export function isUnderstandingPackEnabled(manifest) {
+    return manifest.policy_packs.some((p) => p.name === UNDERSTANDING_PACK_NAME && p.enabled !== false);
+}
 export function checkUnderstandingModeEnvDivergence(manifest, env) {
     const pack = manifest.policy_packs.find((p) => p.name === UNDERSTANDING_PACK_NAME && p.enabled !== false);
     if (!pack)

package/dist/cli/doctor/understanding-mode-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"understanding-mode-env.js","sourceRoot":"","sources":["../../../src/cli/doctor/understanding-mode-env.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,EAAE;AACF,iEAAiE;AACjE,0EAA0E;AAC1E,kEAAkE;AAClE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,+DAA+D;AAC/D,0EAA0E;AAC1E,kEAAkE;AAClE,2BAA2B;AAE3B,OAAO,EACL,MAAM,EACN,QAAQ,EACR,SAAS,IAAI,uBAAuB,EACpC,qBAAqB,GAEtB,MAAM,8DAA8D,CAAC;AAwBtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAkB,EAClB,GAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CACjE,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,aAAa,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAEnD,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAEhE,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,UAAU;QACV,OAAO,EAAE,GAAG,QAAQ,IAAI,aAAa,8BAA8B,UAAU,EAAE;QAC/E,MAAM,EAAE;YACN,uFAAuF;gBACrF,iFAAiF,aAAa,GAAG;YACnG,yBAAyB,UAAU,GAAG,WAAW,EAAE;YACnD,uDAAuD,QAAQ,wBAAwB;SACxF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"understanding-mode-env.js","sourceRoot":"","sources":["../../../src/cli/doctor/understanding-mode-env.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,EAAE;AACF,iEAAiE;AACjE,0EAA0E;AAC1E,kEAAkE;AAClE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,+DAA+D;AAC/D,0EAA0E;AAC1E,kEAAkE;AAClE,2BAA2B;AAE3B,OAAO,EACL,MAAM,EACN,QAAQ,EACR,SAAS,IAAI,uBAAuB,EACpC,qBAAqB,GAEtB,MAAM,8DAA8D,CAAC;AAwBtE;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,QAAQ,CAAC,YAAY,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAkB,EAClB,GAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CACjE,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,aAAa,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAEnD,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAEhE,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,UAAU;QACV,OAAO,EAAE,GAAG,QAAQ,IAAI,aAAa,8BAA8B,UAAU,EAAE;QAC/E,MAAM,EAAE;YACN,uFAAuF;gBACrF,iFAAiF,aAAa,GAAG;YACnG,yBAAyB,UAAU,GAAG,WAAW,EAAE;YACnD,uDAAuD,QAAQ,wBAAwB;SACxF;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/explain-policy.d.ts

@@ -1,4 +1,4 @@
-import { type EnvironmentResolution, type RiskProfile, type WhenClauseResult } from "../runtime/index.js";
+import { type DeletionTargetVerdict, type EnvironmentResolution, type RiskProfile, type WhenClauseResult } from "../runtime/index.js";
 import type { Manifest } from "../schema/index.js";
 import { type EventInputSeams } from "./event-input.js";
 import { type LoaderOptions } from "./loader.js";
@@ -28,6 +28,9 @@ interface ExplainPolicyProjection {
     };
     classifier: RiskProfile;
     environment: EnvironmentResolution;
+    /** Static deletion-target verdict (task d03af8f6); null when the
+     *  event's command is not a recognized deletion verb. */
+    deletion_target: DeletionTargetVerdict | null;
     when: {
         declared: false;
     } | {

package/dist/cli/explain-policy.js

@@ -13,7 +13,9 @@
 // LAST recorded decision from the evidence ledger; `explain-policy`
 // evaluates a hypothetical event live and reads nothing from the ledger.
 import { stringify as stringifyYaml } from "yaml";
-import { classifyRisk, evaluateWhen, policyMatchesEvent, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
+import { classifyRisk, evaluateWhen, policyMatchesEvent, resolveDeletionTarget, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
+import { extractShellCommand } from "../runtime/tool-name-aliases.js";
+import { DEFAULT_SAFE_DELETION_ROOTS } from "../schema/risk.js";
 import { loadEventEnvelope } from "./event-input.js";
 import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
 import { loadManifest } from "./loader.js";
@@ -43,9 +45,16 @@ export function explainPolicy(policyName, opts) {
         kubeContext: kube.context,
         kubeNamespace: kube.namespace,
     });
+    // Static deletion-target resolution (task d03af8f6) — same "raw
+    // command only, no ambient cwd/env" contract as the runtime's own
+    // `enrichEnvelope`. See `deletion-target-resolve.ts`.
+    const explainShellCommand = extractShellCommand({ raw_input: envelope.raw_input });
+    const deletionTarget = explainShellCommand === null
+        ? null
+        : resolveDeletionTarget(explainShellCommand, manifest.risk.safe_deletion_roots ?? DEFAULT_SAFE_DELETION_ROOTS);
     const triggerMatched = policyMatchesEvent(policy, event);
     const whenEval = policy.when !== undefined
-        ? evaluateWhen(policy.when, { risk: classifier, environment })
+        ? evaluateWhen(policy.when, { risk: classifier, environment, deletionTarget })
         : undefined;
     const projection = {
         policy: policy.name,
@@ -63,6 +72,7 @@ export function explainPolicy(policyName, opts) {
         },
         classifier,
         environment,
+        deletion_target: deletionTarget,
         when: whenEval
             ? {
                 declared: true,

package/dist/cli/explain-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AA8C/D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAC3C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAiD/D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAC3C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAClB,mBAAmB,KAAK,IAAI;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CACnB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,2BAA2B,CACjE,CAAC;IAER,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/export.js

@@ -2,6 +2,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { stringify as stringifyYaml } from "yaml";
 import { atomicWriteFile } from "../io/atomic-write.js";
+import { withoutDerivedPolicies } from "../runtime/workflow-policies.js";
 import { loadManifest } from "./loader.js";
 const SECRET_KEY_PATTERN = /(?:_|^)(KEY|TOKEN|SECRET|PASSWORD|API_KEY)$/i;
 const REDACTED = "<REDACTED>";
@@ -10,7 +11,17 @@ export const SANITIZE_FOOTER = "# sanitised: /home/<user>/ paths replaced with ~
     "sanitiser does NOT touch secrets in command:[] arrays or in policy " +
     "`requires.ledger_tag` values; review before sharing.";
 export function exportManifest(opts = {}) {
-    const { manifest } = loadManifest(opts);
+    const { manifest: loaded } = loadManifest(opts);
+    // F7 (review round 2, 99f47307 Slice 1): `loadManifest` folds
+    // `workflows[]`-derived policies into `manifest.policies` (F2), but
+    // `harness export` is meant to emit what the OPERATOR declared, not a
+    // computed view — a derived policy re-imported via `harness init
+    // --config <exported file>`-style workflows would then be a
+    // hand-authored duplicate of something the next `harness apply` would
+    // derive again anyway. `withoutDerivedPolicies` (identity-based; see
+    // workflow-policies.ts) restores the hand-authored view before
+    // projecting; `harness list policies` / `doctor` show the derived pair.
+    const manifest = withoutDerivedPolicies(loaded);
     const projection = manifest;
     const projected = opts.sanitize ? sanitize(projection, os.homedir()) : projection;
     let output;

package/dist/cli/export.js.map

@@ -1 +1 @@
-{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/cli/export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAe/D,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,CAAC,MAAM,eAAe,GAC1B,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,sDAAsD,CAAC;AAEzD,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAA4B,QAA8C,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAElF,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,IAAI,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,CAAC;YACZ,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,eAAe,IAAI,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc,EAAE,OAAe;IACtD,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAe,EAAE,QAA6B;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtF,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA6B;IACrD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,OAAe;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,mBAAmB;IACnB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/cli/export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAe/D,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,CAAC,MAAM,eAAe,GAC1B,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,sDAAsD,CAAC;AAEzD,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE;IACrD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChD,8DAA8D;IAC9D,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,4DAA4D;IAC5D,sEAAsE;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,QAAQ,GAAa,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,UAAU,GAA4B,QAA8C,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAElF,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,IAAI,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,CAAC;YACZ,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,eAAe,IAAI,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc,EAAE,OAAe;IACtD,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAe,EAAE,QAA6B;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtF,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA6B;IACrD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,OAAe;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,mBAAmB;IACnB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC"}