@lannguyensi/harness 0.50.0 → 0.51.0

package/dist/cli/pack/auto-approve-path.js

@@ -0,0 +1,347 @@
+// Step 9 of the understanding-gate PreToolUse decision order: the
+// operator-opt-in auto-approval attempt (agent-tasks/74b4b17d, slice 1 of
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
+//
+// WHERE THIS RUNS, AND WHY IT MATTERS. `hook-pre-tool-use.ts` calls
+// `attemptAutoApproval` on a call that EVERY branch above it has already
+// declined: the signed-marker check (step 3), the read-only Bash
+// exemption (step 6), the recovery-commit exemption (step 7) and the
+// escape `ask` (step 8). So the auto path only ever acts on a call that
+// would otherwise reach the final block. Three consequences the ADR's
+// decision-order table spells out: the session's first `ls` or `git
+// status` mints nothing, `max_age` starts counting from the call that
+// actually needed an approval, and a bare `harness approve understanding`
+// keeps whatever the interactive prompt resolves it to. The negative
+// controls in tests/cli/pack-hook-pre-tool-use-auto-approve.test.ts pin
+// that ordering; moving this call site up is a mutation those tests
+// catch.
+//
+// WHAT IT IS NOT. This function never returns an allow of its own. On
+// success it consumes the report, writes the signed SESSION marker
+// through the same `writeApprovalMarker` path `harness approve
+// understanding` uses, records an audit-only ledger fact, and then
+// re-runs `checkOperatorApprovalMarkers` — that re-check, and nothing
+// else, is what produces the allow. The gate's decision input stays
+// exactly one signed marker (invariant 1). Every failure returns
+// `approved: false` and the caller falls through to the existing final
+// block with step 3's `markerExpired` / `markerForged` intact.
+//
+// FAIL CLOSED ON EVERY MISSING INPUT. Absent opt-in, unlisted
+// `permission_mode`, a forged marker already detected at step 3, a
+// failed session-consistency check, a missing signing key, a missing /
+// already-consumed / foreign / invalid report: each one declines with
+// one stderr line and no write.
+//
+// TWO CALL SITES, ONE BODY (slice 2, agent-tasks/57058364).
+// `hook-codex-pre-tool-use.ts` calls this same function at the same
+// place in its own decision order. Everything that differs between the
+// two runtimes is an ARGUMENT, never a fork: the `harness` segment of
+// the minted `approvedBy`, which session-consistency evidence the
+// payload can be held against (`sessionConsistency`), the ledger fact's
+// `source` verb, and the stderr `label`. Claude Code carries
+// `$CLAUDE_CODE_SESSION_ID` in the hook environment; Codex carries no
+// session-id environment variable at all (measured live, Codex 0.150.1)
+// but does name a per-session `transcript_path` that exists on disk at
+// PreToolUse time.
+//
+// ONE BODY IS NOT ONE OPT-IN. Sharing the body would otherwise mean an
+// `auto_approve` block written for Claude Code opts every Codex session
+// in too; `auto_approve.harnesses` is the explicit per-harness
+// allowlist that prevents it, defaulting to Claude Code only when the
+// key is absent (step 1b below).
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { autoApprovedByFor, autoApprovedLedgerTagFor, checkOperatorApprovalMarkers, harnessAllowed, listPersistedReports, parseAutoApprove, permissionModeAllowed, selectNewestStrictSessionReport, writeApprovalMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { sha256Hex, signingKeyExists } from "../../runtime/approval-signing.js";
+import { clearPendingApproval, readPendingApproval, } from "../../runtime/pending-approval.js";
+import { rewriteReportApproved, validatePersistedReport } from "../approve/understanding.js";
+/**
+ * Source string the CLAUDE CODE hook records on the audit-only ledger
+ * fact — the verb that actually made the write.
+ */
+export const AUTO_APPROVE_LEDGER_SOURCE = "harness-pack-hook-pre-tool-use";
+/**
+ * The Codex hook's counterpart. A shared body must not stamp the Claude
+ * verb on a Codex write: the ledger fact is an audit surface, and an
+ * auditor reading `harness-pack-hook-pre-tool-use` on a Codex session
+ * would be reading a fact about a hook that never ran (reviewer round-1
+ * finding on slice 2). The `approvedBy` segment already distinguishes
+ * the runtimes; this makes the ledger row agree with it.
+ */
+export const AUTO_APPROVE_LEDGER_SOURCE_CODEX = "harness-pack-hook-codex-pre-tool-use";
+/** Default stderr prefix: the Claude Code hook's, byte-for-byte. */
+const DEFAULT_LABEL = "harness pack hook";
+function decline(reason) {
+    return { approved: false, reason };
+}
+/**
+ * Attempt the operator-opted-in auto-approval for this PreToolUse call.
+ * See the module header for placement and the fail-closed contract; the
+ * numbered steps below are conditions 1-6 of the ADR's Option A.
+ */
+export async function attemptAutoApproval(args) {
+    const { stderr } = args;
+    const label = args.label ?? DEFAULT_LABEL;
+    const note = (msg) => {
+        stderr.write(`${label}: ${msg}\n`);
+    };
+    // (1) Opt-in. Absent is the ordinary case and stays SILENT; a
+    // malformed block already wrote its own single line inside
+    // `parseAutoApprove` (fail-closed: malformed means "not opted in",
+    // never a partial default).
+    const packConfigObj = args.packConfig !== null && typeof args.packConfig === "object" && !Array.isArray(args.packConfig)
+        ? args.packConfig
+        : {};
+    const cfg = parseAutoApprove(packConfigObj["auto_approve"], stderr, label);
+    if (cfg === null)
+        return decline("auto_approve not configured");
+    // (1b) Per-harness opt-in, checked BEFORE the `when` allowlist and
+    // before the ledger thunk below, so an unlisted harness resolves
+    // nothing and never reaches any evidence lookup. Two call sites share
+    // this body; without this check an `auto_approve` block written for
+    // Claude Code before the Codex hook existed would silently start
+    // auto-approving every Codex session that runs in a listed
+    // `permission_mode` (reviewer round-1 finding on slice 2). `harnesses`
+    // is absent in exactly those older configs and resolves to Claude Code
+    // only, so opting a second runtime in stays an explicit config edit.
+    // Diagnosed, unlike the silent `when` miss below: an unlisted harness
+    // is a configuration mismatch worth seeing once per call, not the
+    // ordinary state of an opted-in session.
+    if (!harnessAllowed(cfg, args.harness)) {
+        note(`auto-approval declined: harness "${args.harness}" is not listed in auto_approve.harnesses`);
+        return decline("harness not in auto_approve.harnesses");
+    }
+    // (2) `when` allowlist, exact string equality against the payload
+    // literal (hardening item 2). Absent / empty / unlisted is the normal
+    // case for an opted-in repo whose session simply runs in a prompting
+    // mode, and it fires on EVERY such call once the opt-in is present, so
+    // this stays SILENT (no stderr line): a per-call note here would echo
+    // the configured `auto_approve.when` allowlist to stderr on every
+    // ordinary prompting-mode call (reviewer round-1 finding).
+    const mode = args.permissionMode;
+    if (!permissionModeAllowed(cfg, mode)) {
+        return decline("permission_mode not in auto_approve.when");
+    }
+    const modeStr = mode;
+    // Resolve the audit-only ledger writer NOW, not earlier: this is the
+    // first point past both the opt-in check (1) and the `when` allowlist
+    // check (2), so `args.resolveLedger` runs only on a call that has an
+    // actual chance of reaching the ledger write below, never on the
+    // overwhelming majority of gated calls that are not opted in or run in
+    // an unlisted permission mode.
+    const ledger = args.resolveLedger();
+    // (3) A forgery detected at step 3 is never laundered into an
+    // approval (ADR condition 6). Declining also leaves the forged FILE and
+    // its distinct `forged/unsigned marker rejected` diagnostic on disk —
+    // `writeApprovalMarker` would atomically overwrite that exact path.
+    if (args.markerForged) {
+        note("auto-approval declined: forged/unsigned marker present");
+        return decline("forged marker present");
+    }
+    // (4) Session consistency (hardening item 1): the PAYLOAD's own
+    // `session_id` must be present and must agree with a SECOND input the
+    // hook reads for itself — the runtime's session-id environment
+    // variable on Claude Code, the named per-session transcript file on
+    // Codex. Compared against the payload field specifically, never the
+    // hook's env-fallback-resolved id, or the env variant would compare
+    // the environment with itself.
+    const payloadSid = typeof args.payloadSessionId === "string" && args.payloadSessionId.length > 0
+        ? args.payloadSessionId
+        : null;
+    if (payloadSid === null) {
+        note("auto-approval declined: event payload carries no session_id");
+        return decline("no payload session_id");
+    }
+    const consistency = args.sessionConsistency;
+    if (consistency.kind === "env") {
+        const envSid = process.env[consistency.variable];
+        if (typeof envSid !== "string" || envSid.length === 0) {
+            note(`auto-approval declined: $${consistency.variable} is not set in the hook environment`);
+            return decline(`no ${consistency.variable}`);
+        }
+        if (envSid !== payloadSid) {
+            note(`auto-approval declined: payload session_id does not match $${consistency.variable} in the hook environment`);
+            return decline("session id mismatch");
+        }
+    }
+    else {
+        // Codex carries no session-id environment variable in the hook
+        // process (measured live, Codex 0.150.1: only CODEX_HOME,
+        // CODEX_MANAGED_BY_NPM, CODEX_MANAGED_PACKAGE_ROOT), so the env
+        // variant has no counterpart there. The payload's own
+        // `transcript_path` is the second input instead: Codex names the
+        // session's rollout file
+        // `<CODEX_HOME>/sessions/YYYY/MM/DD/rollout-<timestamp>-<session_id>.jsonl`
+        // and the file already exists when PreToolUse fires.
+        //
+        // Three separately-diagnosed conditions, each fail-closed: the
+        // field is a non-empty string; its BASENAME names this exact
+        // session (`-<sid>.jsonl`, or a bare `<sid>.jsonl` for a shim that
+        // drops the `rollout-<timestamp>` prefix); and the path resolves to
+        // a REGULAR FILE. `statSync().isFile()`, not `existsSync`: a
+        // directory named `<sid>.jsonl` is not a transcript, and neither is
+        // a socket or a device node, yet all of them satisfy mere existence
+        // (reviewer round-1 finding on slice 2). It is deliberately not a
+        // content check: reading and parsing the rollout would make the hook
+        // depend on Codex's internal transcript format for a check that is
+        // not a boundary anyway (see SessionConsistencyCheck).
+        const transcriptPath = typeof consistency.transcriptPath === "string" && consistency.transcriptPath.length > 0
+            ? consistency.transcriptPath
+            : null;
+        if (transcriptPath === null) {
+            note("auto-approval declined: event payload carries no transcript_path");
+            return decline("no transcript_path");
+        }
+        const base = path.basename(transcriptPath);
+        if (base !== `${payloadSid}.jsonl` && !base.endsWith(`-${payloadSid}.jsonl`)) {
+            note(`auto-approval declined: transcript_path does not name session ${payloadSid} (basename ${base})`);
+            return decline("transcript_path session mismatch");
+        }
+        // `throwIfNoEntry: false` covers the ordinary ENOENT; the try/catch
+        // covers every other stat failure (a permission error, a symlink
+        // loop), which fails closed here rather than throwing out of a hook
+        // whose caller treats a throw as neither allow nor block.
+        let transcriptIsFile = false;
+        try {
+            transcriptIsFile = fs.statSync(transcriptPath, { throwIfNoEntry: false })?.isFile() === true;
+        }
+        catch {
+            transcriptIsFile = false;
+        }
+        if (!transcriptIsFile) {
+            note(`auto-approval declined: transcript_path does not name an existing file (${transcriptPath})`);
+            return decline("transcript_path missing");
+        }
+    }
+    // (5) Key precheck BEFORE any write (hardening item 5). The shared
+    // write path would otherwise mint the key it is supposed to require:
+    // `writeApprovalMarker` -> `signMarker` -> `getOrCreateSigningKey`
+    // generates one on ENOENT. Key creation stays an operator-side act.
+    if (args.generatedDir === undefined) {
+        note("auto-approval declined: harness.generated/ could not be resolved");
+        return decline("generatedDir unresolvable");
+    }
+    const generatedDir = args.generatedDir;
+    if (!signingKeyExists(generatedDir)) {
+        note("auto-approval declined: signing key absent (never created by the hook)");
+        return decline("signing key absent");
+    }
+    // (6) The report precondition: the NEWEST strict-session report, and
+    // only that one, must be exactly `pending`, parse, and pass the
+    // approve CLI's own content validation.
+    const newest = selectNewestStrictSessionReport(listPersistedReports(args.reportsDir), args.sessionId);
+    if (newest === null) {
+        note(`auto-approval declined: no persisted report bound to session ${args.sessionId}`);
+        return decline("no report for session");
+    }
+    if (newest.approvalStatus !== "pending") {
+        note(`auto-approval declined: newest report for session ${args.sessionId} is approvalStatus=${newest.approvalStatus ?? "<missing>"}, not pending`);
+        return decline("newest report not pending");
+    }
+    let raw;
+    try {
+        raw = fs.readFileSync(newest.filePath, "utf8");
+    }
+    catch (err) {
+        note(`auto-approval declined: report unreadable (${err.message})`);
+        return decline("report unreadable");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        note(`auto-approval declined: report invalid (unparseable JSON: ${err.message})`);
+        return decline("report unparseable");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        note("auto-approval declined: report invalid (body is not a JSON object)");
+        return decline("report not an object");
+    }
+    const validation = validatePersistedReport(parsed);
+    if (!validation.ok) {
+        note(`auto-approval declined: report invalid (${validation.field}: ${validation.reason})`);
+        return decline(`report invalid: ${validation.field}`);
+    }
+    // Success sequence. `reportContentHash` binds the bytes as they were
+    // BEFORE the approval rewrite, exactly as the approve CLI computes it.
+    const reportContentHash = sha256Hex(raw);
+    const approvedAt = new Date().toISOString();
+    const approvedBy = autoApprovedByFor(args.harness, modeStr);
+    // CONSUME FIRST, then sign. If the marker write fails after this, the
+    // report is spent and no marker exists: the call blocks and the same
+    // report can never mint again. The reverse order would leave a
+    // still-`pending` report behind a failed write, i.e. a report that is
+    // mintable on the very next call — the direction this design refuses.
+    try {
+        rewriteReportApproved(newest.filePath, approvedAt, approvedBy, args.sessionId);
+    }
+    catch (err) {
+        note(`auto-approval declined: could not consume the report (${err.message})`);
+        return decline("report consumption failed");
+    }
+    let markerPath;
+    try {
+        markerPath = writeApprovalMarker(generatedDir, args.sessionId, {
+            approvedAt,
+            approvedBy,
+            reportContentHash,
+        });
+    }
+    catch (err) {
+        note(`auto-approval declined: failed to write the approval marker (${err.message}); the report was consumed, so this session needs a fresh report`);
+        return decline("marker write failed");
+    }
+    // Audit-only ledger fact. Never a gate input, so every failure here is
+    // one stderr line and nothing more.
+    const tag = autoApprovedLedgerTagFor(args.sessionId);
+    if (ledger.write === null) {
+        note(`auto-approval ledger fact ${tag} not recorded (${ledger.reason ?? "ledger writer unavailable"}); audit only, continuing`);
+    }
+    else {
+        try {
+            const result = await ledger.write({
+                sessionId: args.sessionId,
+                content: tag,
+                source: args.ledgerSource,
+            });
+            if (!result.ok) {
+                note(`auto-approval ledger fact ${tag} not recorded (${result.reason ?? "unknown error"}); audit only, continuing`);
+            }
+        }
+        catch (err) {
+            note(`auto-approval ledger fact ${tag} not recorded (${err.message}); audit only, continuing`);
+        }
+    }
+    // Drop this session's `.pending-approval` staging entry (decision-order
+    // table, step 9). It is tier 5 of the approve verbs' session
+    // resolution and is otherwise cleared only by `harness approve
+    // understanding`, which auto mode never runs — so leaving it would let
+    // a later env-less operator `harness approve ...` resolve to this
+    // already-auto-approved id. Only ever clears OUR OWN id.
+    try {
+        if (readPendingApproval(generatedDir) === args.sessionId) {
+            clearPendingApproval(generatedDir);
+        }
+    }
+    catch {
+        /* best-effort; staging is not a gate input */
+    }
+    // The verdict comes from the same marker check every other approval
+    // goes through — the auto path itself never allows.
+    const recheck = checkOperatorApprovalMarkers(generatedDir, args.sessionId, args.packConfig, stderr);
+    if (!recheck.matched) {
+        note(`auto-approval wrote a marker but the re-check did not match (${recheck.detail}); falling through to the block`);
+        return decline("post-write marker re-check did not match");
+    }
+    note(`auto-approved via session marker by ${approvedBy}`);
+    return {
+        approved: true,
+        detail: recheck.detail,
+        approvedBy,
+        markerPath,
+        reportPath: newest.filePath,
+        reportContentHash,
+    };
+}
+//# sourceMappingURL=auto-approve-path.js.map

package/dist/cli/pack/auto-approve-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve-path.js","sourceRoot":"","sources":["../../../src/cli/pack/auto-approve-path.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,mEAAmE;AACnE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,iEAAiE;AACjE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,SAAS;AACT,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,+DAA+D;AAC/D,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,4DAA4D;AAC5D,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;AAEvF,oEAAoE;AACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AA4F1C,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAChG,CAAC,CAAE,IAAI,CAAC,UAAsC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEhE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,2DAA2D;IAC3D,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CACF,oCAAoC,IAAI,CAAC,OAAO,2CAA2C,CAC5F,CAAC;QACF,OAAO,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,IAAc,CAAC;IAE/B,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAEpC,8DAA8D;IAC9D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC5C,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CACF,4BAA4B,WAAW,CAAC,QAAQ,qCAAqC,CACtF,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,CACF,8DAA8D,WAAW,CAAC,QAAQ,0BAA0B,CAC7G,CAAC;YACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,sDAAsD;QACtD,iEAAiE;QACjE,yBAAyB;QACzB,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,cAAc,GAClB,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrF,CAAC,CAAC,WAAW,CAAC,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,GAAG,UAAU,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,EAAE,CAAC;YAC7E,IAAI,CACF,iEAAiE,UAAU,cAAc,IAAI,GAAG,CACjG,CAAC;YACF,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CACF,2EAA2E,cAAc,GAAG,CAC7F,CAAC;YACF,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,wCAAwC;IACxC,MAAM,MAAM,GAAG,+BAA+B,CAC5C,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EACrC,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CACF,qDAAqD,IAAI,CAAC,SAAS,sBACjE,MAAM,CAAC,cAAc,IAAI,WAC3B,eAAe,CAChB,CAAC;QACF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,8CAA+C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,6DAA8D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,2CAA2C,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC,mBAAmB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE5D,sEAAsE;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,CAAC;QACH,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,yDAA0D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE;YAC7D,UAAU;YACV,UAAU;YACV,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CACF,gEAAiE,GAAa,CAAC,OAAO,kEAAkE,CACzJ,CAAC;QACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CACF,6BAA6B,GAAG,kBAC9B,MAAM,CAAC,MAAM,IAAI,2BACnB,2BAA2B,CAC5B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CACF,6BAA6B,GAAG,kBAAkB,MAAM,CAAC,MAAM,IAAI,eAAe,2BAA2B,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CACF,6BAA6B,GAAG,kBAAmB,GAAa,CAAC,OAAO,2BAA2B,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,yDAAyD;IACzD,IAAI,CAAC;QACH,IAAI,mBAAmB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,oEAAoE;IACpE,oDAAoD;IACpD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,EACf,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CACF,gEAAgE,OAAO,CAAC,MAAM,iCAAiC,CAChH,CAAC;QACF,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-codex-pre-tool-use.d.ts

@@ -1,5 +1,6 @@
 import { type LedgerEntry } from "../../policies/index.js";
 import { type ApprovalCheckResult } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { type LedgerWriteFn } from "../../runtime/ledger-writer.js";
 import { type Manifest } from "../../schema/index.js";
 import { type LoaderOptions } from "../loader.js";
 export interface PackHookCodexPreToolUseOptions extends LoaderOptions {
@@ -21,6 +22,14 @@ export interface PackHookCodexPreToolUseOptions extends LoaderOptions {
     ledgerQuery?: (sessionId: string) => Promise<LedgerEntry[] | {
         degraded: string;
     }>;
+    /**
+     * Inject the audit-only ledger WRITER that the auto-approval path
+     * records its fact through (test injection). Mirrors the Claude
+     * hook's option of the same name. Absent, the writer is resolved from
+     * the manifest, lazily, and only on a call that already passed the
+     * opt-in, `harnesses` and `when` checks.
+     */
+    writeLedger?: LedgerWriteFn;
 }
 export interface PackHookCodexPreToolUseResult {
     exitCode: number;

package/dist/cli/pack/hook-codex-pre-tool-use.js

@@ -23,7 +23,10 @@ import * as path from "node:path";
 import { queryLedgerByTag } from "../../policies/index.js";
 import { checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, matchLedgerEntries, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { findLatestParseError, renderMalformedSectionsNotice } from "../approve/understanding.js";
+import { CODEX_HARNESS } from "../../policy-packs/builtin/understanding-before-execution/auto-approve.js";
+import { attemptAutoApproval, AUTO_APPROVE_LEDGER_SOURCE_CODEX, } from "./auto-approve-path.js";
 import { resolveGeneratedDir, writePendingApproval, } from "../../runtime/pending-approval.js";
+import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
 import { extractShellCommand } from "../../runtime/tool-name-aliases.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
 import { isReadOnlyBashPipeline } from "../../runtime/read-only-bash.js";
@@ -58,6 +61,48 @@ function extractCodexShellCommand(rawInput) {
         return command;
     return typeof rawInput === "string" ? rawInput : null;
 }
+/**
+ * The command the two EXEMPTIONS below (read-only Bash, recovery
+ * `git commit`) are allowed to act on, or `null` when the payload does
+ * not pin one down. Deliberately stricter than the shared
+ * `resolveToolInput` (hook-bootstrap.ts), which stays as it is: its
+ * other callers are PostToolUse observers whose worst case is a missed
+ * observation, whereas here the classified command decides whether a
+ * gated call is exempted (reviewer round-1 finding on slice 2). Two
+ * differences, both fail-closed:
+ *
+ *   - `tool_input: null` is treated as ABSENT and falls back to
+ *     `raw_input`, instead of shadowing it. `resolveToolInput` tests
+ *     `!== undefined`, so a payload carrying an explicit null
+ *     `tool_input` plus a real `raw_input` would otherwise classify to
+ *     nothing.
+ *   - When BOTH fields carry a command and they DISAGREE, this returns
+ *     `null` rather than picking one. Otherwise a payload could pair a
+ *     read-only `ls` in the preferred field with `rm -rf ...` in the
+ *     other and be exempted on the harmless one while the runtime runs
+ *     whichever field it itself reads.
+ *
+ * `null` is never an allow: both call sites fall through to the block
+ * path, and the auto-approval attempt below does not read this at all.
+ */
+function resolveCodexExemptionCommand(event) {
+    const toolInput = event.tool_input ?? undefined;
+    const rawInput = event.raw_input ?? undefined;
+    if (toolInput !== undefined && rawInput !== undefined) {
+        const fromToolInput = extractCodexShellCommand(toolInput);
+        const fromRawInput = extractCodexShellCommand(rawInput);
+        if (fromToolInput === null || fromRawInput === null)
+            return null;
+        if (fromToolInput.trim() !== fromRawInput.trim())
+            return null;
+        return fromToolInput;
+    }
+    if (toolInput !== undefined)
+        return extractCodexShellCommand(toolInput);
+    if (rawInput !== undefined)
+        return extractCodexShellCommand(rawInput);
+    return null;
+}
 async function checkLedger(manifest, sessionId, opts) {
     if (opts.ledgerQuery) {
         const result = await opts.ledgerQuery(sessionId);
@@ -200,10 +245,15 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     const report = checkPersistedReport(reportsDir, sessionId);
     // Audit-only ledger probe.
     const ledger = await checkLedger(manifest, sessionId, opts);
-    // Exception: read-only shell commands. Codex's documented hook
-    // envelope carries tool args in `raw_input`; if that field is absent
-    // or unclassifiable, fall through to the block path (fail-closed).
-    const commandStr = extractCodexShellCommand(event.raw_input);
+    // Exception: read-only shell commands. Real Codex carries tool args in
+    // `tool_input`, harness's older published envelope in `raw_input`;
+    // `resolveCodexExemptionCommand` reads both (before this, a real Codex
+    // payload's command was invisible here and every read-only `ls` hit
+    // the block). If neither field carries a classifiable command — a
+    // conflicting `command`/`cmd` pair, or two fields naming DIFFERENT
+    // commands — this stays `null` and the call falls through to the block
+    // path (fail-closed); see that function for the full argument.
+    const commandStr = resolveCodexExemptionCommand(event);
     if (commandStr !== null &&
         CODEX_SHELL_TOOLS.has(toolName) &&
         isReadOnlyBashPipeline(commandStr)) {
@@ -236,6 +286,70 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
             diagnostic,
         };
     }
+    // Step 9: the operator-opt-in auto-approval attempt (slice 2 of
+    // docs/decisions/2026-08-27-ug-auto-mode-approval.md, agent-tasks/
+    // 57058364). The SAME `attemptAutoApproval` the Claude hook calls, at
+    // the same place in the decision order: last, on a call that the
+    // marker check (source 1) and both exemptions above have already
+    // declined — i.e. exactly a call that would otherwise reach the final
+    // block. So a read-only `ls` or a recovery `git commit` mints nothing,
+    // and `max_age` starts counting from the call that actually needed an
+    // approval. Arguments carry everything that is Codex-specific:
+    // `harness: CODEX_HARNESS` (the minted `approvedBy` reads
+    // `auto-mode:codex:<mode>`, so an audit can tell the runtimes apart),
+    // the transcript-path session-consistency check (a Codex hook process
+    // carries no session-id environment variable for the Claude variant to
+    // compare against), and this hook's own ledger `source` and stderr
+    // label.
+    //
+    // Sharing the body does NOT share the opt-in: the attempt declines
+    // unless the operator listed `codex` in `auto_approve.harnesses`,
+    // which an `auto_approve` block written before this hook existed does
+    // not (an absent key means Claude Code only).
+    //
+    // It never returns an allow of its own: the allow below comes from the
+    // auto path's own re-run of `checkOperatorApprovalMarkers`, the same
+    // authority source 1 consults, and is reported through this hook's
+    // ordinary `allowResult` with `source: "marker"`. Any failure falls
+    // through to the block with `markerExpired` / `markerForged` intact.
+    //
+    // Placed BEFORE the `.pending-approval` staging write below on
+    // purpose: a successful auto-approval must not leave this session id
+    // staged for a later arg-less `harness approve understanding` to
+    // resolve to.
+    //
+    // The ledger writer resolves lazily, exactly like the Claude hook: the
+    // thunk runs only after the auto path's own opt-in and `when` checks
+    // both pass, so an ordinary gated Codex call never resolves one.
+    const resolveAutoLedger = () => {
+        if (opts.writeLedger)
+            return { write: opts.writeLedger };
+        const resolved = resolveManifestLedgerWriter(manifest, {
+            ...(opts.ledgerTimeoutMs !== undefined ? { ledgerTimeoutMs: opts.ledgerTimeoutMs } : {}),
+        });
+        return resolved.ok ? { write: resolved.write } : { write: null, reason: resolved.reason };
+    };
+    const auto = await attemptAutoApproval({
+        generatedDir,
+        sessionId,
+        payloadSessionId: event.session_id,
+        permissionMode: event.permission_mode,
+        harness: CODEX_HARNESS,
+        // This hook's own verb on the audit-only ledger fact and its own
+        // stderr prefix, so neither an audit row nor a diagnostic line
+        // attributes a Codex decision to the Claude Code hook.
+        ledgerSource: AUTO_APPROVE_LEDGER_SOURCE_CODEX,
+        label: "harness pack hook codex",
+        sessionConsistency: { kind: "transcript-path", transcriptPath: event.transcript_path },
+        packConfig: declared.config,
+        reportsDir,
+        markerForged,
+        stderr,
+        resolveLedger: resolveAutoLedger,
+    });
+    if (auto.approved) {
+        return allowResult(auto.detail, "marker", stderr);
+    }
     // Stage the session id so `harness approve understanding`, run from
     // the operator's shell where none of $CODEX_SESSION_ID,
     // $CLAUDE_CODE_SESSION_ID or $CLAUDE_SESSION_ID is set, can resolve it without scraping logs or

package/dist/cli/pack/hook-codex-pre-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,gDAAgD;AAChD,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AA2CrB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CACzB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAgD,CAAC;QAC9D,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6DACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,qGAAqG,EACrG,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,qEAAqE;IACrE,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,CAAC,KAAK,CACV,+CAA+C,OAAO,CAAC,eAAe,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,mBAAmB;IACnB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE3D,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,+DAA+D;IAC/D,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,sBAAsB,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,GAAG,2FAA2F,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QACrI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,kDAAkD;IAClD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,aAAa;QACb,mBAAmB,CAAC,UAAU,CAAC,EAC/B,CAAC;QACD,MAAM,UAAU,GAAG,6EAA6E,SAAS,oIAAoI,UAAU,CAAC,IAAI,EAAE,kFAAkF,CAAC;QACjV,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;YAChF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wDAAwD;IACxD,gGAAgG;IAChG,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,+CAA+C,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACrF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF,IAAI,WAAW,GAAG,QAAQ;QACxB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,yDAAyD;IACzD,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,KAAK,IAAI;QACpB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC;QACtF,CAAC,CAAC,IAAI,CAAC;IACX,kEAAkE;IAClE,qDAAqD;IACrD,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,eAAe,GAAG,6BAA6B,CACnD,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAC1C,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,GAAG,GAAG,WAAW,OAAO,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,gDAAgD;AAChD,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,2EAA2E,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AAmErB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CACzB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAgD,CAAC;QAC9D,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6DACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,qGAAqG,EACrG,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,qEAAqE;IACrE,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,CAAC,KAAK,CACV,+CAA+C,OAAO,CAAC,eAAe,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,mBAAmB;IACnB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE3D,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,sBAAsB,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,GAAG,2FAA2F,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QACrI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,kDAAkD;IAClD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,aAAa;QACb,mBAAmB,CAAC,UAAU,CAAC,EAC/B,CAAC;QACD,MAAM,UAAU,GAAG,6EAA6E,SAAS,oIAAoI,UAAU,CAAC,IAAI,EAAE,kFAAkF,CAAC;QACjV,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;YAChF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,+DAA+D;IAC/D,0DAA0D;IAC1D,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,SAAS;IACT,EAAE;IACF,mEAAmE;IACnE,kEAAkE;IAClE,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,EAAE;IACF,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,cAAc;IACd,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,GAAqD,EAAE;QAC/E,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,UAAU;QAClC,cAAc,EAAE,KAAK,CAAC,eAAe;QACrC,OAAO,EAAE,aAAa;QACtB,iEAAiE;QACjE,+DAA+D;QAC/D,uDAAuD;QACvD,YAAY,EAAE,gCAAgC;QAC9C,KAAK,EAAE,yBAAyB;QAChC,kBAAkB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE;QACtF,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,UAAU;QACV,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,oEAAoE;IACpE,wDAAwD;IACxD,gGAAgG;IAChG,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,+CAA+C,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACrF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF,IAAI,WAAW,GAAG,QAAQ;QACxB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,yDAAyD;IACzD,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,KAAK,IAAI;QACpB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC;QACtF,CAAC,CAAC,IAAI,CAAC;IACX,kEAAkE;IAClE,qDAAqD;IACrD,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,eAAe,GAAG,6BAA6B,CACnD,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAC1C,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,GAAG,GAAG,WAAW,OAAO,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.d.ts

@@ -1,5 +1,6 @@
 import { type LedgerEntry } from "../../policies/index.js";
 import { type ApprovalCheckResult } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { type LedgerWriteFn } from "../../runtime/ledger-writer.js";
 import { type Manifest } from "../../schema/index.js";
 import { type LoaderOptions } from "../loader.js";
 export interface PackHookPreToolUseOptions extends LoaderOptions {
@@ -23,6 +24,16 @@ export interface PackHookPreToolUseOptions extends LoaderOptions {
     ledgerQuery?: (sessionId: string) => Promise<LedgerEntry[] | {
         degraded: string;
     }>;
+    /**
+     * Inject the ledger WRITER used for the auto-approval path's audit-only
+     * `understanding-auto-approved:<sid>` fact (test). Mirrors
+     * `hook-post-merge-gate-record.ts`'s injection point. When omitted the
+     * writer is resolved from the manifest's `grounding-mcp` entry, exactly
+     * as every other Trusted-Writer producer does; when that resolution
+     * fails the auto path logs one line and continues (audit only, never a
+     * gate input).
+     */
+    writeLedger?: LedgerWriteFn;
     /**
      * Override "now" for the pause-sentinel expiry check (test injection).
      * The lower layers (`checkPauseFromLoader`, `maybeAnnouncePause`,