@lannguyensi/harness 0.51.0 → 0.52.0

package/dist/cli/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/cli/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAE/D,MAAM,aAAa,GAAG,KAAK,CAAC;AAoD5B,MAAM,cAAc,GAAmB;IACrC,OAAO;IACP,MAAM;IACN,kBAAkB;IAClB,MAAM;IACN,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAQ,cAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,OAAO,KAAK,EACV,SAAiB,EACjB,OAAuD,EAC3B,EAAE;QAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;YAC7C,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACtF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,OAAO,GAA6D,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,SAAS,EACP,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACjC,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,qEAAqE;QACrE,0EAA0E;QAC1E,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,IAAI;YAC/C,wBAAwB,EAAE,IAAI;SAC/B,CAAC;KACH,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,UAAU,GACd,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,KAAe,EAAU,EAAE,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB,EAAE;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,YAAa,GAAa,CAAC,OAAO,EAAE,EACpC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,EAChF,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,2DAA2D;IAC3D,sDAAsD;IACtD,gEAAgE;IAChE,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACpC,QAAQ;QACR,aAAa,EAAE,GAAG,oBAAoB,GAAG;KAC1C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,MAAM,CAAC,MAAM,EAAE,EACtC,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YACnD,CAAC,CAAC,mCAAmC,KAAK,IAAI,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QACzD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/cli/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAE/D,MAAM,aAAa,GAAG,KAAK,CAAC;AAkF5B,MAAM,cAAc,GAAmB;IACrC,OAAO;IACP,MAAM;IACN,kBAAkB;IAClB,MAAM;IACN,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAQ,cAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,OAAO,KAAK,EACV,SAAiB,EACjB,OAAuD,EAC3B,EAAE;QAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;YAC7C,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACtF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,OAAO,GAA6D,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,SAAS,EACP,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACjC,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,qEAAqE;QACrE,0EAA0E;QAC1E,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,IAAI;YAC/C,wBAAwB,EAAE,IAAI;SAC/B,CAAC;KACH,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,uBAAuB,CAC9B,OAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,GAAG,QAAQ,UAAU,CAAC;IAChD,MAAM,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EACP,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACjC,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACnC,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB,EAAE,IAAgB;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,KAAe,EAAU,EAAE,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAErE,wEAAwE;AACxE,4EAA4E;AAC5E,+BAA+B;AAC/B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,aAAa,GAAG,CAAC,CAAS,EAAU,EAAE;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,SAAS,WAAW,CAAC,IAAwB;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,UAAU,GACd,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB,EAAE;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,YAAa,GAAa,CAAC,OAAO,EAAE,EACpC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,EAChF,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,2DAA2D;IAC3D,sDAAsD;IACtD,gEAAgE;IAChE,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACpC,QAAQ;QACR,aAAa,EAAE,GAAG,oBAAoB,GAAG;KAC1C,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,MAAM,CAAC,MAAM,EAAE,EACtC,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,6DAA6D;IAC7D,+DAA+D;IAC/D,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QAC5C,QAAQ;QACR,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAuB,EAAE,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,sEAAsE;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oDAAoD;QACpD,uEAAuE;QACvE,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC;QAC7C,UAAU,CAAC,0BAA0B,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,uBAAuB,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GACjB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mCAAmC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/F,yEAAyE;IACzE,sEAAsE;IACtE,oCAAoC;IACpC,MAAM,aAAa,GACjB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,4BAA4B,oBAAoB,IAAI;QACtD,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,gBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CACf;YACE,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACpE,EACD,IAAI,EACJ,CAAC,CACF,IAAI;QACP,CAAC,CAAC,GAAG,aAAa,GAAG,aAAa,EAAE,CAAC;IACvC,OAAO;QACL,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/cli/delegate/index.d.ts

@@ -0,0 +1,63 @@
+import type { Manifest } from "../../schema/index.js";
+import { type LoaderOptions } from "../loader.js";
+/** Default delegation lifetime when neither `--ttl` nor the pack's `approval_lifecycle.max_age` is set (ADR "TTL, cwd, and subagents"). */
+export declare const DEFAULT_DELEGATION_TTL_SECONDS = 3600;
+/** Default ledger `source` tag for the audit-only fact this verb writes (ADR "Audit and doctor"). */
+export declare const DEFAULT_DELEGATE_LEDGER_SOURCE = "harness-delegate-cli";
+/** Ceiling for an explicit `--ttl` when the applied pack sets no `approval_lifecycle.max_age` (L4 fix, agent-tasks 37ad0b05: an unbounded `--ttl` would otherwise let a caller mint a delegation that outlives any lifetime the pack's own policy intends). */
+export declare const MAX_DELEGATION_TTL_SECONDS: number;
+/** The exact usage message the ADR pins for a delegation with no binding (AC 1). Shared so the CLI's early usage check and this function's own refusal read identically. */
+export declare const NO_BINDING_MESSAGE = "a delegation must bind a cwd or a task";
+export interface IssueDelegationOptions extends LoaderOptions {
+    /** Session id of the `claude -p` child this delegation authorizes. Must be a UUID (case-insensitive). */
+    childSessionId: string;
+    /** Bind the delegation to this working directory. At least one of `cwd` / `taskId` is required. */
+    cwd?: string;
+    /** Bind the delegation to this agent-tasks task id. At least one of `cwd` / `taskId` is required. */
+    taskId?: string;
+    /** Delegation lifetime in seconds (already parsed, e.g. via `parseDurationSeconds`). Default: the applied pack's `approval_lifecycle.max_age` when set, else {@link DEFAULT_DELEGATION_TTL_SECONDS}. */
+    ttlSeconds?: number;
+    /** Fallback shape: path to the launcher-supplied Understanding Report file, bound by content AND path hash. */
+    reportPath?: string;
+    /** Explicit parent session id. Resolved exactly like `harness approve understanding` (flag > env > `.pending-approval`; no newest-report fallback) when omitted. */
+    parentSessionId?: string;
+    /** Override `harness.generated/` (test injection). */
+    generatedDir?: string;
+    /** Override "now" for deterministic tests. */
+    now?: Date;
+    /** Inject a manifest (test). */
+    manifest?: Manifest;
+    /** Override the ledger writer (test). */
+    ledgerAdd?: (sessionId: string, content: string) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+export type IssueDelegationRefusalReason = "invalid-child-session" | "no-binding" | "invalid-cwd" | "invalid-task" | "invalid-ttl" | "ttl-above-max-age" | "parent-session-unresolved" | "parent-marker-missing" | "parent-marker-forged" | "parent-marker-expired" | "signing-key-absent" | "report-unreadable" | "invalid-input" | "write-failed";
+export type IssueDelegationResult = {
+    ok: true;
+    filePath: string;
+    parentSessionId: string;
+    childSessionId: string;
+    expiresAt: string;
+    /** `written: false` is audit-only degradation (ADR: "failure to write the fact is one stderr line, never a refusal"); the delegation itself is still minted. */
+    ledgerFact: {
+        written: boolean;
+        reason?: string;
+    };
+} | {
+    ok: false;
+    reason: IssueDelegationRefusalReason;
+    detail: string;
+};
+/** The `understanding-delegated:<child-sid>:<parent-sid>` ledger fact content (ADR "Audit and doctor"). */
+export declare function delegationLedgerFactFor(childSessionId: string, parentSessionId: string): string;
+/**
+ * Issue a signed delegation marker for a `claude -p` child session. Never
+ * calls `process.exit`; every failure mode is a `{ ok: false }` result
+ * with a distinct `reason` (ADR slice plan format rule: every refusal is
+ * a block with a distinct diagnostic, never a fall-through to allow).
+ */
+export declare function issueDelegation(opts: IssueDelegationOptions): Promise<IssueDelegationResult>;

package/dist/cli/delegate/index.js

@@ -0,0 +1,313 @@
+// `harness delegate`: slice 3 of docs/decisions/2026-08-27-ug-auto-mode-approval.md
+// ("`claude -p` child processes", "Delegation marker shape", "TTL, cwd,
+// and subagents"), acceptance criterion 1.
+//
+// Issues a signed delegation for a headless `claude -p` child session,
+// bound to an already-approved PARENT session. The delegation is a
+// PRE-AUTHORIZATION, not an approval (key one of the ADR's two-key
+// design): it supplies the trusted signal and the parent linkage; the
+// child's own Understanding Report (key two) is still checked, and its
+// auto-marker still minted, by the child's own PreToolUse hook: nothing
+// here opens a gate.
+//
+// `issueDelegation` is an in-process function, never calling
+// `process.exit`, so the smoke runner (a future consumer, ADR "TTL, cwd,
+// and subagents": "The harness smoke runner ... is the natural first
+// consumer") and tests can call it directly. The CLI wiring in
+// `src/cli/index.ts` is a thin wrapper: flag parsing, one CLI-level
+// usage check with the exact ADR-specified message, and printing the
+// result in the approve CLI's line style.
+//
+// PARENT SESSION RESOLUTION mirrors `harness approve understanding`
+// exactly (flag > $CLAUDE_CODE_SESSION_ID > $CLAUDE_SESSION_ID >
+// $CODEX_SESSION_ID > staged .pending-approval), via the same
+// `resolveApprovalSessionId` helper, with NO newest-report fallback
+// (delegation has no report of its own to guess a session from).
+//
+// LEDGER SOURCE: the ledger fact this verb writes uses its own fixed
+// source tag `harness-delegate-cli` (ADR "Audit and doctor"), distinct
+// from `harness approve understanding`'s `harness-approve-understanding`.
+// Reused directly: the approve CLI's `writeLedgerTag` now takes `source`
+// as an additive parameter (default unchanged, so `approveUnderstanding`'s
+// own call is unaffected) so this verb does not re-implement the same
+// findGroundingMcp + addLedgerFact shape `branch-protection.ts` already
+// carries its own independent copy of. There is no actor field to stamp
+// on a delegation and no `--approved-by` flag to override the source:
+// the delegation's signed `approvedBy` string is the packed
+// `delegated:<parent>;cwd=...;task=...;expires=...` tuple
+// (delegation-markers.ts), which has no room for one, and the ADR rules
+// out adding a new signed field (a `SIGNING_ALG` bump).
+//
+// REPORT FALLBACK (`--report <path>`): binds the launcher-supplied
+// report by BOTH its content (`reportContentHash`) and its path
+// (`reportPathHash`, via the same `hashDelegationCwd` the cwd binding
+// uses, so both sides of the delegation hash paths the same way).
+import { sha256Hex, signingKeyExists, signingKeyPathFor } from "../../runtime/approval-signing.js";
+import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
+import { resolveApprovalSessionId } from "../../runtime/session-id.js";
+import { checkApprovalMarker, hashDelegationCwd, parseApprovalLifecycle, writeDelegationMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
+import { loadDeclaredUnderstandingPack, writeLedgerTag } from "../approve/understanding.js";
+import { resolvePaths } from "../loader.js";
+/** Default delegation lifetime when neither `--ttl` nor the pack's `approval_lifecycle.max_age` is set (ADR "TTL, cwd, and subagents"). */
+export const DEFAULT_DELEGATION_TTL_SECONDS = 3600;
+/** Default ledger `source` tag for the audit-only fact this verb writes (ADR "Audit and doctor"). */
+export const DEFAULT_DELEGATE_LEDGER_SOURCE = "harness-delegate-cli";
+/** Ceiling for an explicit `--ttl` when the applied pack sets no `approval_lifecycle.max_age` (L4 fix, agent-tasks 37ad0b05: an unbounded `--ttl` would otherwise let a caller mint a delegation that outlives any lifetime the pack's own policy intends). */
+export const MAX_DELEGATION_TTL_SECONDS = 24 * 60 * 60;
+/** Same 8-4-4-4-12 hex shape the session-id helpers already validate a Claude Code session id against (`session-id.ts`'s `SESSION_TRANSCRIPT_RE`), case-insensitive. */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The exact usage message the ADR pins for a delegation with no binding (AC 1). Shared so the CLI's early usage check and this function's own refusal read identically. */
+export const NO_BINDING_MESSAGE = "a delegation must bind a cwd or a task";
+/** The `understanding-delegated:<child-sid>:<parent-sid>` ledger fact content (ADR "Audit and doctor"). */
+export function delegationLedgerFactFor(childSessionId, parentSessionId) {
+    return `understanding-delegated:${childSessionId}:${parentSessionId}`;
+}
+/** Control characters rejected from a raw `--task` value, mirroring the `CONTROL_CHARS` check `delegation-markers.ts` already runs on `parentSessionId` (not exported, so mirrored rather than imported). */
+const TASK_ID_CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+/**
+ * Validate a raw `--task` value before it ever reaches
+ * `writeDelegationMarker` (L1 fix, agent-tasks 37ad0b05: an unvalidated
+ * `--task` used to surface downstream as an opaque `write-failed`, or
+ * silently rebind, depending on the value). Mirrors
+ * `delegation-markers.ts`'s own (unexported) `rejectUnsafeSegmentValue`:
+ * empty, or carrying a `;`/`=` segment delimiter, both corrupt the
+ * packed `approvedBy` encoding, plus the reserved unbound literal
+ * `"-"` (would silently round-trip as "no task bound") and a control
+ * character. Returns a detail string on a rejected value, `null` on a
+ * safe one.
+ */
+function validateTaskId(taskId) {
+    if (taskId.length === 0) {
+        return "--task must not be empty";
+    }
+    if (taskId === "-") {
+        return '--task must not be the reserved unbound literal "-"';
+    }
+    if (taskId.includes(";") || taskId.includes("=")) {
+        return `--task must not contain a delegation-segment delimiter (";" or "="): ${JSON.stringify(taskId)}`;
+    }
+    if (TASK_ID_CONTROL_CHARS.test(taskId)) {
+        return `--task must not contain a control character: ${JSON.stringify(taskId)}`;
+    }
+    return null;
+}
+/**
+ * Issue a signed delegation marker for a `claude -p` child session. Never
+ * calls `process.exit`; every failure mode is a `{ ok: false }` result
+ * with a distinct `reason` (ADR slice plan format rule: every refusal is
+ * a block with a distinct diagnostic, never a fall-through to allow).
+ */
+export async function issueDelegation(opts) {
+    if (!UUID_RE.test(opts.childSessionId)) {
+        return {
+            ok: false,
+            reason: "invalid-child-session",
+            detail: `--child-session must be a UUID (8-4-4-4-12 hex, case-insensitive): got ${JSON.stringify(opts.childSessionId)}`,
+        };
+    }
+    if (opts.cwd === undefined && opts.taskId === undefined) {
+        return { ok: false, reason: "no-binding", detail: NO_BINDING_MESSAGE };
+    }
+    // L3 fix (agent-tasks 37ad0b05): an empty `--cwd` used to fall through
+    // uncaught, and `hashDelegationCwd("")` -> `path.resolve("")` silently
+    // rebinds it to the issuer's OWN cwd rather than refusing. Caught here,
+    // alongside the no-binding check, before either value reaches a hash.
+    if (opts.cwd !== undefined && opts.cwd.length === 0) {
+        return {
+            ok: false,
+            reason: "invalid-cwd",
+            detail: "--cwd must not be empty (an empty value would silently rebind to the issuer's own cwd via path.resolve)",
+        };
+    }
+    if (opts.taskId !== undefined) {
+        const taskError = validateTaskId(opts.taskId);
+        if (taskError !== null) {
+            return { ok: false, reason: "invalid-task", detail: taskError };
+        }
+    }
+    const generatedDir = opts.generatedDir ??
+        resolveGeneratedDir({
+            ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
+            manifestPath: resolvePaths(opts).base,
+        });
+    // Signing-key precheck FIRST, before resolving or checking the parent
+    // marker at all. `checkApprovalMarker`'s own read path (via
+    // `verifyMarkerSignature` -> `getOrCreateSigningKey`) self-heals a
+    // missing key by CREATING one as a side effect of verification, that
+    // is correct for the gate's read side (delegation-markers.ts's own
+    // doc comment on `verifyDelegation` explains why), but it would mean
+    // this precheck could never observe a genuinely absent key if it ran
+    // after the parent-marker check: by the time that check returns, a
+    // key would already exist again. Checking here, before either
+    // resolveApprovalSessionId or checkApprovalMarker touches the
+    // filesystem, is what keeps "no operator signing key" a real,
+    // independently reachable refusal rather than one only writeDelegationMarker's
+    // own (necessarily later) precheck could ever see.
+    if (!signingKeyExists(generatedDir)) {
+        return {
+            ok: false,
+            reason: "signing-key-absent",
+            detail: `no operator signing key at ${signingKeyPathFor(generatedDir)}; refusing to delegate (key creation is an operator-side act, never a side effect of delegating)`,
+        };
+    }
+    // Parent session resolution: exactly the `harness approve
+    // understanding` precedence chain (flag > $CLAUDE_CODE_SESSION_ID >
+    // $CLAUDE_SESSION_ID > $CODEX_SESSION_ID > staged .pending-approval),
+    // with NO 6th-tier newest-report fallback: a delegation has no report
+    // of its own to guess a parent session from, and guessing the PARENT
+    // wrong here would mint a pre-authorization under the wrong identity.
+    const resolvedParent = resolveApprovalSessionId({
+        session: opts.parentSessionId,
+        generatedDir,
+    });
+    const parentSessionId = resolvedParent.sessionId;
+    if (parentSessionId === "") {
+        return {
+            ok: false,
+            reason: "parent-session-unresolved",
+            detail: "no parent session id available. Pass --session-id <id>, or set one of " +
+                "$CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID / $CODEX_SESSION_ID, or run " +
+                "`harness preflight` (or trip the gate once) so harness.generated/.pending-approval is staged.",
+        };
+    }
+    // Manifest: best-effort, exactly like the approve CLI (shared via
+    // `loadDeclaredUnderstandingPack`, agent-tasks 37ad0b05). A load
+    // failure here degrades the TTL default (falls back to the hardcoded
+    // default below) and the ledger write (audit-only, never a refusal)
+    // but never blocks issuing the delegation itself.
+    const { manifest, manifestLoadError, declaredPack } = loadDeclaredUnderstandingPack(opts);
+    const lifecycle = parseApprovalLifecycle(declaredPack.config["approval_lifecycle"]);
+    // Key one of the ADR's two-key design: the parent must already carry a
+    // valid, unexpired, signed approval marker. Same check the gate itself
+    // runs (`checkApprovalMarker`), same `max_age` bound.
+    const parentCheck = checkApprovalMarker(generatedDir, parentSessionId, {
+        ...(lifecycle.maxAgeMs !== undefined ? { maxAgeMs: lifecycle.maxAgeMs } : {}),
+        ...(opts.now !== undefined ? { now: opts.now } : {}),
+    });
+    if (!parentCheck.matched) {
+        const reason = parentCheck.forged
+            ? "parent-marker-forged"
+            : parentCheck.expired
+                ? "parent-marker-expired"
+                : "parent-marker-missing";
+        return { ok: false, reason, detail: parentCheck.detail };
+    }
+    const now = opts.now ?? new Date();
+    // L2/L4 fix (agent-tasks 37ad0b05): an explicit `--ttl` is validated
+    // and clamped BEFORE it can reach `expiresAt`. `ttlSeconds <= 0` (or
+    // non-finite) used to mint a delegation that is already expired
+    // (L2); an unbounded `--ttl` used to let a caller mint one that
+    // outlives the applied pack's own `approval_lifecycle.max_age` (L4,
+    // or the 24h default ceiling when the pack sets none). Only an
+    // EXPLICIT `--ttl` is checked here: the computed default below (from
+    // `max_age` or the hardcoded default) is by construction already
+    // within whichever ceiling would apply to it.
+    let ttlSeconds;
+    if (opts.ttlSeconds !== undefined) {
+        if (!Number.isFinite(opts.ttlSeconds) || opts.ttlSeconds <= 0) {
+            return {
+                ok: false,
+                reason: "invalid-ttl",
+                detail: `--ttl must resolve to a positive, finite number of seconds; got ${opts.ttlSeconds}`,
+            };
+        }
+        const ceilingSeconds = lifecycle.maxAgeMs !== undefined
+            ? Math.round(lifecycle.maxAgeMs / 1_000)
+            : MAX_DELEGATION_TTL_SECONDS;
+        if (opts.ttlSeconds > ceilingSeconds) {
+            return {
+                ok: false,
+                reason: "ttl-above-max-age",
+                detail: lifecycle.maxAgeMs !== undefined
+                    ? `--ttl (${opts.ttlSeconds}s) exceeds the applied pack's approval_lifecycle.max_age (${ceilingSeconds}s)`
+                    : `--ttl (${opts.ttlSeconds}s) exceeds the default ${ceilingSeconds}s (24h) ceiling; set approval_lifecycle.max_age to raise it`,
+            };
+        }
+        ttlSeconds = opts.ttlSeconds;
+    }
+    else {
+        ttlSeconds =
+            lifecycle.maxAgeMs !== undefined
+                ? Math.round(lifecycle.maxAgeMs / 1_000)
+                : DEFAULT_DELEGATION_TTL_SECONDS;
+    }
+    const expiresAt = new Date(now.getTime() + ttlSeconds * 1_000).toISOString();
+    // Fallback shape: bind the launcher-supplied report by BOTH its
+    // content and its path (delegation-markers.ts, "Delegation marker
+    // shape" table: half a binding is worse than none).
+    let reportPathHash;
+    let reportContentHash;
+    if (opts.reportPath !== undefined) {
+        const read = readRegularFileRejectingSymlink(opts.reportPath);
+        if (read.kind !== "ok") {
+            return {
+                ok: false,
+                reason: "report-unreadable",
+                detail: `--report ${opts.reportPath} could not be read (${read.kind})`,
+            };
+        }
+        reportContentHash = sha256Hex(read.content);
+        reportPathHash = hashDelegationCwd(opts.reportPath);
+    }
+    const cwdHash = opts.cwd !== undefined ? hashDelegationCwd(opts.cwd) : null;
+    const taskId = opts.taskId !== undefined ? opts.taskId : null;
+    const writeResult = writeDelegationMarker({
+        generatedDir,
+        childSessionId: opts.childSessionId,
+        parentSessionId,
+        cwdHash,
+        taskId,
+        expiresAt,
+        ...(reportPathHash !== undefined ? { reportPathHash } : {}),
+        ...(reportContentHash !== undefined ? { reportContentHash } : {}),
+        now,
+    });
+    if (!writeResult.ok) {
+        if (writeResult.reason === "signing-key-absent") {
+            return { ok: false, reason: "signing-key-absent", detail: writeResult.detail };
+        }
+        if (writeResult.reason === "invalid-input") {
+            // Reachable: a malformed raw parent session id (`--session-id`, or
+            // a value read from $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID /
+            // $CODEX_SESSION_ID / a staged .pending-approval) still reaches
+            // `buildDelegationApprovedBy`'s `rejectMalformedSessionId` /
+            // `rejectUnsafeSegmentValue` checks on `parentSessionId`
+            // unvalidated by this function. `--task` no longer reaches this
+            // branch: its own value is now validated (the `invalid-task`
+            // refusal above) before `writeDelegationMarker` is ever called.
+            // Mapped to its own reason rather than folded into "write-failed",
+            // so a malformed parent session id fails closed with a diagnostic
+            // distinct from a genuine I/O write failure.
+            return { ok: false, reason: "invalid-input", detail: writeResult.detail };
+        }
+        return { ok: false, reason: "write-failed", detail: writeResult.detail };
+    }
+    const ledgerContent = delegationLedgerFactFor(opts.childSessionId, parentSessionId);
+    let ledgerResult;
+    if (opts.ledgerAdd) {
+        ledgerResult = await opts.ledgerAdd(opts.childSessionId, ledgerContent);
+    }
+    else if (manifest) {
+        ledgerResult = await writeLedgerTag(manifest, opts.childSessionId, ledgerContent, {}, DEFAULT_DELEGATE_LEDGER_SOURCE);
+    }
+    else {
+        ledgerResult = {
+            ok: false,
+            reason: manifestLoadError
+                ? `manifest unreadable (${manifestLoadError}); skipped ledger write`
+                : "manifest unreadable; skipped ledger write",
+        };
+    }
+    return {
+        ok: true,
+        filePath: writeResult.filePath,
+        parentSessionId,
+        childSessionId: opts.childSessionId,
+        expiresAt,
+        ledgerFact: ledgerResult.ok
+            ? { written: true }
+            : { written: false, reason: ledgerResult.reason },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/delegate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/delegate/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,qBAAqB;AACrB,EAAE;AACF,6DAA6D;AAC7D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,0DAA0D;AAC1D,wEAAwE;AACxE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAElE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,2IAA2I;AAC3I,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE,+PAA+P;AAC/P,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD,wKAAwK;AACxK,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,4KAA4K;AAC5K,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAwD3E,2GAA2G;AAC3G,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,eAAuB;IACrF,OAAO,2BAA2B,cAAc,IAAI,eAAe,EAAE,CAAC;AACxE,CAAC;AAED,6MAA6M;AAC7M,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,wEAAwE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,gDAAgD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,0EAA0E,IAAI,CAAC,SAAS,CAC9F,IAAI,CAAC,cAAc,CACpB,EAAE;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,+EAA+E;IAC/E,mDAAmD;IACnD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,YAAY,CACb,kGAAkG;SACpG,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;QAC7B,YAAY;KACb,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC;IACjD,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B;YACnC,MAAM,EACJ,wEAAwE;gBACxE,2EAA2E;gBAC3E,+FAA+F;SAClG,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,sBAAsB,CACrC,YAAY,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CACvE,CAAC;IAEF,uEAAuE;IACvE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,WAAW,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAiC,WAAW,CAAC,MAAM;YAC7D,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,WAAW,CAAC,OAAO;gBACnB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,mEAAmE,IAAI,CAAC,UAAU,EAAE;aAC7F,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxC,CAAC,CAAC,0BAA0B,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EACJ,SAAS,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,6DAA6D,cAAc,IAAI;oBAC1G,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,0BAA0B,cAAc,6DAA6D;aACrI,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU;YACR,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxC,CAAC,CAAC,8BAA8B,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7E,gEAAgE;IAChE,kEAAkE;IAClE,oDAAoD;IACpD,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,uBAAuB,IAAI,CAAC,IAAI,GAAG;aACvE,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS;QACT,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,6DAA6D;YAC7D,yDAAyD;YACzD,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,6CAA6C;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,YAA0D,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,cAAc,CACjC,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,aAAa,EACb,EAAE,EACF,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;gBACvB,CAAC,CAAC,wBAAwB,iBAAiB,yBAAyB;gBACpE,CAAC,CAAC,2CAA2C;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS;QACT,UAAU,EAAE,YAAY,CAAC,EAAE;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/auto-approve-mode.d.ts

@@ -0,0 +1,37 @@
+import type { Manifest } from "../../schema/index.js";
+export interface AutoApproveModeWarning {
+    /**
+     * The RESOLVED effective mode (`resolveModeFromConfig(pack).mode`);
+     * never the literal `pack.config.mode` value. Always a recognised
+     * Mode literal (the resolver always returns one, defaulting to
+     * `grill_me` when `config.mode` is absent or unrecognised).
+     */
+    mode: string;
+    /** Rendered as the `⚠` line itself. */
+    message: string;
+    /**
+     * Indented detail lines rendered directly under {@link message} by
+     * `format.ts`, mirroring `understandingModeEnv`'s detail-line idiom.
+     */
+    detail: string[];
+}
+/**
+ * Pure: manifest in, a warning out (or `undefined` when there is nothing
+ * to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (a pack that never runs has no live auto-approve path to warn
+ *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
+ *     `ug-auto-approvals.ts` use);
+ *   - `config.auto_approve` parses as a valid opt-in block (schema
+ *     validation already rejects a malformed block at lint time, so a
+ *     manifest that reaches doctor with an unparseable block has
+ *     already failed loud elsewhere; this mirrors that same fail-closed
+ *     "not opted in" reading rather than re-deriving a second opinion);
+ *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
+ *     is not `"grill_me"`. An absent or unrecognised `config.mode`
+ *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
+ *     this warning, see the module header for why that resolved value,
+ *     not the literal config key, is what the auto path's report
+ *     actually carries.
+ */
+export declare function checkAutoApproveMode(manifest: Manifest): AutoApproveModeWarning | undefined;

package/dist/cli/doctor/auto-approve-mode.js

@@ -0,0 +1,80 @@
+// Doctor advisory (agent-tasks abfad738, follow-up of ADR
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1): warn when
+// an operator has opted into the hook-written signed auto-marker path
+// (`policy_packs[understanding-before-execution].config.auto_approve`)
+// without also pairing it with `mode: grill_me`.
+//
+// Why this matters: the auto-approval path's report precondition reuses
+// `validatePersistedReport` (`src/cli/approve/understanding.ts`), which
+// only enforces the report's `mode` field when it is `grill_me`.
+// Outside that mode, report validation is structural only (the report
+// exists and belongs to the session, not that its contents reflect any
+// real understanding exchange). Both the ADR (recommendation 4) and the
+// pack doc recommend pairing `auto_approve` with `grill_me` for exactly
+// this reason. Nothing surfaced the gap before this check: an operator
+// who opts a non-grill_me mode into `auto_approve` gets no signal that
+// the auto path's report gate has degraded to a near-no-op.
+//
+// Deliberately advisory, never an error: `auto_approve` outside
+// `grill_me` is a real, if weaker, gate (the permission-mode allowlist
+// and the signed marker still apply), not a misconfiguration.
+//
+// This check reads `resolveModeFromConfig(pack).mode`, the same
+// GENERATION-path resolver `checkUnderstandingModeEnvDivergence` and
+// `resolveBuiltinDefaultConfig` use, NOT `pack.config.mode` verbatim.
+// A missing `config.mode` resolves to `DEFAULT_MODE` (`grill_me`), and
+// that resolved value is what the generated Stop-hook command actually
+// passes as `UNDERSTANDING_GATE_MODE`, so a report written under an
+// unset `mode` genuinely carries `grill_me` and IS the strict check;
+// there is no gap to warn about. An unrecognised `config.mode` literal
+// also resolves to `grill_me` this same way, with its own warning
+// already surfaced elsewhere (`resolveModeFromConfig`'s `warning`
+// return, consumed by `harness validate` / other doctor checks); this
+// check does not duplicate that.
+//
+// A session-level `UNDERSTANDING_GATE_MODE` env override that diverges
+// from the resolved `config.mode` is a SEPARATE gap, already covered by
+// `checkUnderstandingModeEnvDivergence` (`understanding-mode-env.ts`)'s
+// own advisory line, this check only ever reads the manifest, never
+// `process.env`.
+import { resolveModeFromConfig } from "../../policy-packs/builtin/understanding-before-execution.js";
+import { parseAutoApprove } from "../../policy-packs/builtin/understanding-before-execution/index.js";
+import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
+/**
+ * Pure: manifest in, a warning out (or `undefined` when there is nothing
+ * to flag). Only fires when:
+ *   - the `understanding-before-execution` pack is declared AND enabled
+ *     (a pack that never runs has no live auto-approve path to warn
+ *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
+ *     `ug-auto-approvals.ts` use);
+ *   - `config.auto_approve` parses as a valid opt-in block (schema
+ *     validation already rejects a malformed block at lint time, so a
+ *     manifest that reaches doctor with an unparseable block has
+ *     already failed loud elsewhere; this mirrors that same fail-closed
+ *     "not opted in" reading rather than re-deriving a second opinion);
+ *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
+ *     is not `"grill_me"`. An absent or unrecognised `config.mode`
+ *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
+ *     this warning, see the module header for why that resolved value,
+ *     not the literal config key, is what the auto path's report
+ *     actually carries.
+ */
+export function checkAutoApproveMode(manifest) {
+    const pack = findEnabledUnderstandingPack(manifest);
+    if (!pack)
+        return undefined;
+    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
+    if (autoApprove === null)
+        return undefined;
+    const { mode } = resolveModeFromConfig(pack);
+    if (mode === "grill_me")
+        return undefined;
+    return {
+        mode,
+        message: `auto_approve is configured with mode ${mode} (policy_packs[understanding-before-execution].config.mode); report validation is structural only outside grill_me`,
+        detail: [
+            "set config.mode: grill_me, or accept the weaker report gate; see docs/policy-packs/understanding-before-execution.md",
+        ],
+    };
+}
+//# sourceMappingURL=auto-approve-mode.js.map

package/dist/cli/doctor/auto-approve-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve-mode.js","sourceRoot":"","sources":["../../../src/cli/doctor/auto-approve-mode.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,iBAAiB;AAEjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oEAAoE,CAAC;AAEtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAmB3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAE1C,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,wCAAwC,IAAI,oHAAoH;QACzK,MAAM,EAAE;YACN,sHAAsH;SACvH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/codex-config-drift.d.ts

@@ -0,0 +1,28 @@
+import type { Manifest } from "../../schema/index.js";
+export interface CodexConfigDriftSection {
+    /** ⚠ lines; each rolls into warningCount. */
+    warnings: string[];
+}
+/**
+ * Whether the manifest's `understanding-before-execution` pack has opted
+ * Codex into the `auto_approve` path (`auto_approve.harnesses` contains
+ * `"codex"`). Pure and side-effect-free: reuses the same fail-closed
+ * parser the Codex PreToolUse hook itself consults
+ * (`attemptAutoApproval` in `../pack/auto-approve-path.ts`), so a
+ * malformed `auto_approve` block resolves to "not opted in" here too,
+ * never a guess.
+ */
+export declare function isCodexOptedIntoAutoApprove(manifest: Manifest): boolean;
+export interface BuildCodexConfigDriftOptions {
+    /** `harness.generated/` for the manifest in use; kept for shape-parity with `BuildSettingsDriftOptions` (`driftCheckOpts` in index.ts is shared between both), unused by this check (see module header: no baseline exists to read here). */
+    generatedDir: string;
+    /** `harness.lock` path for the manifest in use; kept for the same shape-parity reason as `generatedDir`, unused by this check. */
+    lockPath: string;
+    /** Resolves the repo-scoped candidate file (`<cwd>/.codex/config.toml`). */
+    cwd: string;
+    /** Operator home; resolves the default `$CODEX_HOME` when the env var is unset. */
+    home: string;
+    /** Env for `CODEX_HOME` resolution. */
+    env: NodeJS.ProcessEnv;
+}
+export declare function buildCodexConfigDrift(opts: BuildCodexConfigDriftOptions): CodexConfigDriftSection;