@lannguyensi/harness 0.51.0 → 0.52.0

package/dist/cli/pack/auto-approve-path.d.ts

@@ -76,6 +76,23 @@ export interface AutoApproveAttemptArgs {
     reportsDir: string;
     /** Step 3's verdict: a marker FILE existed and failed signature verification. */
     markerForged: boolean;
+    /**
+     * Slice 3 (agent-tasks 37ad0b05, ADR "Decision: two-key design"): a
+     * VALID, unexpired, cwd/task-matching delegation the calling hook has
+     * already verified for this child session. Present means key one is
+     * satisfied by the delegation instead of by a `when`-listed
+     * `permission_mode`, so a `-p` child whose payload carries `default`
+     * (or no mode at all) can still reach the report check.
+     *
+     * It is a PRE-AUTHORIZATION, not an approval: every other condition in
+     * this function stays exactly as it was, key two (the child's own
+     * `pending` report) very much included. The caller is responsible for
+     * the verification; this function never reads a delegation file
+     * itself, so there is no second, weaker verifier to keep in sync.
+     */
+    delegation?: {
+        parentSessionId: string;
+    };
     stderr: {
         write(s: string): void;
     };

package/dist/cli/pack/auto-approve-path.js

@@ -44,6 +44,16 @@
 // but does name a per-session `transcript_path` that exists on disk at
 // PreToolUse time.
 //
+// TWO ALTERNATIVE KEY-ONE SIGNALS (slice 3, agent-tasks 37ad0b05). The
+// ADR's "Decision: two-key design" makes the trusted signal a
+// disjunction: a `when`-listed `permission_mode`, OR a valid delegation
+// for this child session that the CALLING HOOK has already verified and
+// passes in as `delegation`. Both are only key ONE. Key two, the child's
+// own strict-session `pending` report, is condition (6) below and is
+// identical on both paths; nothing about a delegation relaxes it, and no
+// branch here reads a delegation file, so the one verifier stays in
+// `understanding-before-execution/delegation-markers.ts`.
+//
 // ONE BODY IS NOT ONE OPT-IN. Sharing the body would otherwise mean an
 // `auto_approve` block written for Claude Code opts every Codex session
 // in too; `auto_approve.harnesses` is the explicit per-harness
@@ -71,6 +81,15 @@ export const AUTO_APPROVE_LEDGER_SOURCE = "harness-pack-hook-pre-tool-use";
 export const AUTO_APPROVE_LEDGER_SOURCE_CODEX = "harness-pack-hook-codex-pre-tool-use";
 /** Default stderr prefix: the Claude Code hook's, byte-for-byte. */
 const DEFAULT_LABEL = "harness pack hook";
+/**
+ * The `<mode>` segment an auto-marker carries whenever key one came from
+ * the DELEGATION rather than from a `when`-listed `permission_mode`.
+ * `auto-mode:claude-code:delegated;delegated:<parent-sid>` reads as what
+ * it is: a child whose trusted signal was the parent's pre-authorization,
+ * not a permission mode. Used unconditionally on that path, whatever the
+ * payload's own mode says, since that mode played no part in the decision.
+ */
+const DELEGATED_MODE_LABEL = "delegated";
 function decline(reason) {
     return { approved: false, reason };
 }
@@ -119,10 +138,35 @@ export async function attemptAutoApproval(args) {
     // the configured `auto_approve.when` allowlist to stderr on every
     // ordinary prompting-mode call (reviewer round-1 finding).
     const mode = args.permissionMode;
-    if (!permissionModeAllowed(cfg, mode)) {
+    const modeAllowed = permissionModeAllowed(cfg, mode);
+    if (!modeAllowed && args.delegation === undefined) {
         return decline("permission_mode not in auto_approve.when");
     }
-    const modeStr = mode;
+    // Which of the ADR's two alternative key-one signals actually applied.
+    // Logged only on the delegation path: the `when` hit is the ordinary
+    // slice-1 case and stays as silent as it was, so slice 1's stderr trail
+    // is byte-identical to what it was before this argument existed.
+    if (args.delegation !== undefined) {
+        note(modeAllowed
+            ? `auto-approval key one: permission_mode ${JSON.stringify(mode)} in auto_approve.when (a valid delegation from parent session ${args.delegation.parentSessionId} is also present)`
+            : `auto-approval key one: valid delegation from parent session ${args.delegation.parentSessionId}`);
+    }
+    // The `<mode>` segment of `approvedBy` records WHICH key one applied,
+    // so it carries a payload literal in exactly one case: the mode itself
+    // was `when`-listed, i.e. the operator wrote that exact string in the
+    // config and this call matched it.
+    //
+    // On the delegation path the payload's mode is UNCONSTRAINED (that is
+    // the whole point: a `-p` child may carry `default`, or nothing) and it
+    // played no part in the decision, so it is replaced by the neutral
+    // `delegated` literal wholesale rather than filtered. Filtering only the
+    // encoding-breaking characters was not enough: `approvedBy` is a signed
+    // AUDIT record, and a payload-composed mode carrying a newline or a tab
+    // survives a `;`/`:` check, lands verbatim in the signed field, and then
+    // shows up in the doctor listing as a permission mode that never
+    // existed (reviewer finding L2). Nothing is lost: the payload's mode is
+    // not evidence of anything on this path.
+    const modeStr = modeAllowed ? mode : DELEGATED_MODE_LABEL;
     // Resolve the audit-only ledger writer NOW, not earlier: this is the
     // first point past both the opt-in check (1) and the `when` allowlist
     // check (2), so `args.resolveLedger` runs only on a call that has an
@@ -267,7 +311,16 @@ export async function attemptAutoApproval(args) {
     // BEFORE the approval rewrite, exactly as the approve CLI computes it.
     const reportContentHash = sha256Hex(raw);
     const approvedAt = new Date().toISOString();
-    const approvedBy = autoApprovedByFor(args.harness, modeStr);
+    // The parent linkage rides in the same signed `approvedBy` field the
+    // source already travels in (ADR "Audit and doctor"): no new signed
+    // field, therefore no `SIGNING_ALG` bump. `parseAutoApprovedBy` strips
+    // the suffix, so the doctor listing still buckets the marker by
+    // harness/mode. The parent id needs no escaping here: it comes out of a
+    // verified delegation whose own writer already refused a `;` or `=` in
+    // it (`buildDelegationApprovedBy`'s `rejectUnsafeSegmentValue`).
+    const approvedBy = args.delegation === undefined
+        ? autoApprovedByFor(args.harness, modeStr)
+        : `${autoApprovedByFor(args.harness, modeStr)};delegated:${args.delegation.parentSessionId}`;
     // CONSUME FIRST, then sign. If the marker write fails after this, the
     // report is spent and no marker exists: the call blocks and the same
     // report can never mint again. The reverse order would leave a

package/dist/cli/pack/auto-approve-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-approve-path.js","sourceRoot":"","sources":["../../../src/cli/pack/auto-approve-path.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,mEAAmE;AACnE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,iEAAiE;AACjE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,SAAS;AACT,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,+DAA+D;AAC/D,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,4DAA4D;AAC5D,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;AAEvF,oEAAoE;AACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AA4F1C,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAChG,CAAC,CAAE,IAAI,CAAC,UAAsC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEhE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,2DAA2D;IAC3D,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CACF,oCAAoC,IAAI,CAAC,OAAO,2CAA2C,CAC5F,CAAC;QACF,OAAO,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,IAAc,CAAC;IAE/B,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAEpC,8DAA8D;IAC9D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC5C,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CACF,4BAA4B,WAAW,CAAC,QAAQ,qCAAqC,CACtF,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,CACF,8DAA8D,WAAW,CAAC,QAAQ,0BAA0B,CAC7G,CAAC;YACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,sDAAsD;QACtD,iEAAiE;QACjE,yBAAyB;QACzB,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,cAAc,GAClB,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrF,CAAC,CAAC,WAAW,CAAC,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,GAAG,UAAU,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,EAAE,CAAC;YAC7E,IAAI,CACF,iEAAiE,UAAU,cAAc,IAAI,GAAG,CACjG,CAAC;YACF,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CACF,2EAA2E,cAAc,GAAG,CAC7F,CAAC;YACF,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,wCAAwC;IACxC,MAAM,MAAM,GAAG,+BAA+B,CAC5C,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EACrC,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CACF,qDAAqD,IAAI,CAAC,SAAS,sBACjE,MAAM,CAAC,cAAc,IAAI,WAC3B,eAAe,CAChB,CAAC;QACF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,8CAA+C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,6DAA8D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,2CAA2C,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC,mBAAmB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE5D,sEAAsE;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,CAAC;QACH,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,yDAA0D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE;YAC7D,UAAU;YACV,UAAU;YACV,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CACF,gEAAiE,GAAa,CAAC,OAAO,kEAAkE,CACzJ,CAAC;QACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CACF,6BAA6B,GAAG,kBAC9B,MAAM,CAAC,MAAM,IAAI,2BACnB,2BAA2B,CAC5B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CACF,6BAA6B,GAAG,kBAAkB,MAAM,CAAC,MAAM,IAAI,eAAe,2BAA2B,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CACF,6BAA6B,GAAG,kBAAmB,GAAa,CAAC,OAAO,2BAA2B,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,yDAAyD;IACzD,IAAI,CAAC;QACH,IAAI,mBAAmB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,oEAAoE;IACpE,oDAAoD;IACpD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,EACf,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CACF,gEAAgE,OAAO,CAAC,MAAM,iCAAiC,CAChH,CAAC;QACF,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,iBAAiB;KAClB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auto-approve-path.js","sourceRoot":"","sources":["../../../src/cli/pack/auto-approve-path.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,mEAAmE;AACnE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,iEAAiE;AACjE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,SAAS;AACT,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,+DAA+D;AAC/D,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,4DAA4D;AAC5D,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,uEAAuE;AACvE,8DAA8D;AAC9D,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,oEAAoE;AACpE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;AAEvF,oEAAoE;AACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,WAAW,CAAC;AA2GzC,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAChG,CAAC,CAAE,IAAI,CAAC,UAAsC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEhE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,2DAA2D;IAC3D,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CACF,oCAAoC,IAAI,CAAC,OAAO,2CAA2C,CAC5F,CAAC;QACF,OAAO,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CACF,WAAW;YACT,CAAC,CAAC,0CAA0C,IAAI,CAAC,SAAS,CACtD,IAAI,CACL,iEACC,IAAI,CAAC,UAAU,CAAC,eAClB,mBAAmB;YACrB,CAAC,CAAC,+DAA+D,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,mCAAmC;IACnC,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,IAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEtE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAEpC,8DAA8D;IAC9D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC5C,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CACF,4BAA4B,WAAW,CAAC,QAAQ,qCAAqC,CACtF,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,CACF,8DAA8D,WAAW,CAAC,QAAQ,0BAA0B,CAC7G,CAAC;YACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,sDAAsD;QACtD,iEAAiE;QACjE,yBAAyB;QACzB,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,cAAc,GAClB,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrF,CAAC,CAAC,WAAW,CAAC,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,GAAG,UAAU,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,EAAE,CAAC;YAC7E,IAAI,CACF,iEAAiE,UAAU,cAAc,IAAI,GAAG,CACjG,CAAC;YACF,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CACF,2EAA2E,cAAc,GAAG,CAC7F,CAAC;YACF,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,wCAAwC;IACxC,MAAM,MAAM,GAAG,+BAA+B,CAC5C,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EACrC,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CACF,qDAAqD,IAAI,CAAC,SAAS,sBACjE,MAAM,CAAC,cAAc,IAAI,WAC3B,eAAe,CAChB,CAAC;QACF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,8CAA+C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,6DAA8D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,2CAA2C,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC,mBAAmB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,KAAK,SAAS;QAC3B,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;IAEjG,sEAAsE;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,CAAC;QACH,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,yDAA0D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE;YAC7D,UAAU;YACV,UAAU;YACV,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CACF,gEAAiE,GAAa,CAAC,OAAO,kEAAkE,CACzJ,CAAC;QACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CACF,6BAA6B,GAAG,kBAC9B,MAAM,CAAC,MAAM,IAAI,2BACnB,2BAA2B,CAC5B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CACF,6BAA6B,GAAG,kBAAkB,MAAM,CAAC,MAAM,IAAI,eAAe,2BAA2B,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CACF,6BAA6B,GAAG,kBAAmB,GAAa,CAAC,OAAO,2BAA2B,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,yDAAyD;IACzD,IAAI,CAAC;QACH,IAAI,mBAAmB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,oEAAoE;IACpE,oDAAoD;IACpD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,EACf,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CACF,gEAAgE,OAAO,CAAC,MAAM,iCAAiC,CAChH,CAAC;QACF,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.d.ts

@@ -42,6 +42,17 @@ export interface PackHookPreToolUseOptions extends LoaderOptions {
      * real-time sleep.
      */
     now?: Date;
+    /**
+     * Clock / sleep / interval injection for the slice-3 transcript scan
+     * (test). The scan is a bounded POLL, so without this a suite covering
+     * its timeout would have to sleep for real time. Production leaves it
+     * unset and the scan uses `Date.now` and a real `setTimeout`.
+     */
+    reportScanClock?: {
+        now?: () => number;
+        sleep?: (ms: number) => Promise<void>;
+        pollMs?: number;
+    };
 }
 export interface PackHookPreToolUseResult {
     exitCode: number;
@@ -57,4 +68,18 @@ export interface PackHookPreToolUseResult {
     /** Diagnostic line emitted to stderr (always; even on allow). */
     diagnostic: string;
 }
+/**
+ * The sentence appended to the standard block reason when a valid
+ * delegation was present but the child's own report had not reached the
+ * transcript within `auto_approve.report_scan.max_wait` (ADR "Report
+ * capture under `-p`": past the bound the hook blocks with an instruction
+ * that asks for REPEATED retries, because a text asking for a single
+ * retry was measured to leave the outcome to run-to-run variation).
+ *
+ * Deliberately does NOT pin a heading level. The same block envelope
+ * already carries `renderReportSchemaHint`'s "any heading level (#, ##,
+ * ###)" rule, and naming one level here would give the agent two
+ * different heading rules in one deny text.
+ */
+export declare const DELEGATION_REPORT_RETRY_INSTRUCTION = "Emit or re-emit your Understanding Report as an `Understanding Report` section (any heading level), then retry this command; if it is denied again, retry again.";
 export declare function runPackHookPreToolUseCli(opts?: PackHookPreToolUseOptions): Promise<PackHookPreToolUseResult>;

package/dist/cli/pack/hook-pre-tool-use.js

@@ -20,12 +20,34 @@
 // hostile. The npm package's own standalone blocker still runs as a
 // secondary safety net for solo users, and `harness explain --trace`
 // (Phase 4 #6) surfaces the runtime audit trail when configured.
+//
+// SLICE 3 (agent-tasks 37ad0b05) adds the delegation-path capture of the
+// child's own report from its session transcript. Two rules of that path
+// live here rather than in the modules it calls:
+//
+//   - ONE TRANSCRIPT ENTRY IS ADOPTED AT MOST ONCE PER SESSION. Every
+//     adopted entry's id is appended to
+//     `<generatedDir>/.delegation-adoptions/<sid>` BEFORE the capture is
+//     persisted, and the scan is given that set. Without it the same
+//     report would be re-captured and re-minted every time the auto-marker
+//     expired (or a task boundary cleared it), so the delegation's TTL
+//     would silently replace the marker's.
+//   - A CAPTURE THAT DOES NOT PARSE writes a parse-error log, once per
+//     failed capture, through the same `persistStdinReport` the operator
+//     path uses. That log is what the block envelope's malformed-sections
+//     notice is rendered from, so the per-capture write is deliberate.
+import { appendFileSync, existsSync, lstatSync, mkdirSync } from "node:fs";
 import * as path from "node:path";
+import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
 import { queryLedgerByTag, } from "../../policies/index.js";
 import { renderProducers } from "../../policies/producers.js";
-import { CLAUDE_CODE_HARNESS, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, matchLedgerEntries, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { CLAUDE_CODE_HARNESS, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, delegationMarkerPathFor, harnessAllowed, listPersistedReports, matchLedgerEntries, parseAutoApprove, readActiveClaim, selectNewestStrictSessionReport, verifyDelegation, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { resolveMode, toPackageMode, } from "../../policy-packs/builtin/understanding-before-execution.js";
+import { signingKeyExists } from "../../runtime/approval-signing.js";
 import { findLatestParseError, renderMalformedSectionsNotice } from "../approve/understanding.js";
+import { persistStdinReport } from "../approve/stdin-report.js";
 import { attemptAutoApproval, AUTO_APPROVE_LEDGER_SOURCE } from "./auto-approve-path.js";
+import { scanTranscriptForReport } from "./transcript-report-scan.js";
 import { resolveGeneratedDir, writePendingApproval, } from "../../runtime/pending-approval.js";
 import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
 import { isReadOnlyBashPipeline } from "../../runtime/read-only-bash.js";
@@ -37,9 +59,114 @@ import { isEscapeCommand } from "./approve-escape.js";
 import { checkHookPause, loadManifestOrInjected, parseConfigUx, readStdin, } from "./hook-bootstrap.js";
 import { renderReportSchemaHint } from "./understanding-report-schema-hint.js";
 const PACK_NAME = "understanding-before-execution";
+/**
+ * The sentence appended to the standard block reason when a valid
+ * delegation was present but the child's own report had not reached the
+ * transcript within `auto_approve.report_scan.max_wait` (ADR "Report
+ * capture under `-p`": past the bound the hook blocks with an instruction
+ * that asks for REPEATED retries, because a text asking for a single
+ * retry was measured to leave the outcome to run-to-run variation).
+ *
+ * Deliberately does NOT pin a heading level. The same block envelope
+ * already carries `renderReportSchemaHint`'s "any heading level (#, ##,
+ * ###)" rule, and naming one level here would give the agent two
+ * different heading rules in one deny text.
+ */
+export const DELEGATION_REPORT_RETRY_INSTRUCTION = "Emit or re-emit your Understanding Report as an `Understanding Report` section (any heading level), then retry this command; if it is denied again, retry again.";
 function findGroundingMcp(manifest) {
     return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
 }
+/**
+ * Directory holding the per-child ADOPTED-ENTRY ledgers, a SIBLING of
+ * `.delegations/` itself rather than a subdirectory of it:
+ * `<generatedDir>/.delegation-adoptions/<sid>`.
+ *
+ * Never inside `.delegations/`, and never in `.approvals/`: these files
+ * record what was SPENT, they are not approvals and must never land where
+ * a marker scan or the doctor's `approvedBy` listing would read them as
+ * one. Kept OUT of `.delegations/` for two reasons: `harness doctor`'s
+ * delegations metric counts every regular file directly under
+ * `.delegations/` (a ledger file nested in there, flat or not, would be
+ * reported as an extra, unreadable delegation), and no reserved
+ * subdirectory NAME sits under `.delegations/` for a child session id to
+ * collide with, since the ledger lives at its own sibling path instead of
+ * inside `.delegations/` at all.
+ *
+ * One id per line. Ids come from the scan (`entryId`), which guarantees
+ * they carry no line break.
+ */
+const ADOPTION_LEDGER_DIRNAME = ".delegation-adoptions";
+function adoptedEntriesPathFor(generatedDir, childSessionId) {
+    return path.join(generatedDir, ADOPTION_LEDGER_DIRNAME, childSessionId);
+}
+/**
+ * The entry ids this session has already spent. An absent file is the
+ * ordinary first-call case and reads as the empty set; every OTHER read
+ * failure fails closed with a result the caller declines on, because a
+ * ledger we cannot read cannot prove that the next transcript hit has not
+ * already been adopted. Goes through the same symlink-rejecting reader
+ * every other gate marker uses (`readRegularFileRejectingSymlink`):
+ * without it a symlink planted at this path would have the ledger read
+ * follow it to an arbitrary target the agent controls, and an empty or
+ * missing target there would read as "nothing adopted yet", the same
+ * open the delegation and approval marker reads already close.
+ */
+function readAdoptedEntries(filePath) {
+    const read = readRegularFileRejectingSymlink(filePath);
+    if (read.kind === "missing")
+        return { ok: true, ids: new Set() };
+    if (read.kind === "symlink") {
+        return { ok: false, detail: `${filePath} is a symlink, refusing for safety` };
+    }
+    if (read.kind === "not-regular") {
+        return { ok: false, detail: `${filePath} is not a regular file` };
+    }
+    if (read.kind !== "ok") {
+        return { ok: false, detail: `${filePath} exists but could not be read (I/O error)` };
+    }
+    const ids = new Set();
+    for (const line of read.content.split("\n")) {
+        const id = line.trim();
+        if (id.length > 0)
+            ids.add(id);
+    }
+    return { ok: true, ids };
+}
+/**
+ * Append one adopted entry id, creating `.delegation-adoptions/` on first
+ * use with the same default directory mode `atomicWriteFile` gives
+ * `.delegations/` itself (the ledger FILE is 0600, like every marker).
+ * `appendFileSync` opens with `O_APPEND`, so a single short write lands
+ * whole even if two hooks race on the same session; no read-modify-write,
+ * therefore nothing to lose. `lstatSync` (NOT `existsSync`/`statSync`)
+ * gates the append the same way `readRegularFileRejectingSymlink` gates
+ * the read: a symlink planted at this path would otherwise have
+ * `appendFileSync` follow it and write the adoption record through to an
+ * arbitrary target, same class of defense as the read side above.
+ */
+function recordAdoptedEntry(filePath, entryId) {
+    try {
+        let priorStat;
+        try {
+            priorStat = lstatSync(filePath);
+        }
+        catch {
+            priorStat = undefined;
+        }
+        if (priorStat !== undefined && !priorStat.isFile()) {
+            return {
+                ok: false,
+                detail: `${filePath} exists and is not a regular file, refusing to append through it`,
+            };
+        }
+        mkdirSync(path.dirname(filePath), { recursive: true });
+        appendFileSync(filePath, `${entryId}\n`, { mode: 0o600 });
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, detail: err.message };
+    }
+}
 // The Claude Code "block" envelope. Mirrors the runtime/intercept.ts
 // shape (PR #81): `decision: "block"` keeps legacy 2.0.x CLIs blocking,
 // `hookSpecificOutput.permissionDecision: "deny"` is the Claude Code
@@ -76,7 +203,7 @@ function parseConfigProducers(raw, stderr) {
 // the deny envelope the agent sees becomes the plain-language
 // `{ cannot, required, run }` shape and the legacy "Understanding Gate:
 // no approved..." + schemaHint + producers vocabulary is suppressed.
-function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malformedSections) {
+function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malformedSections, retryInstruction) {
     // When the pack config declares `ux:`, the agent-facing surface
     // becomes the plain-language `{ cannot, required, run }` shape, and
     // the legacy schemaHint + producers block is suppressed (the ux
@@ -125,6 +252,15 @@ function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malfo
     if (escapeHint) {
         reasonText = `${reasonText}\n\n${escapeHint}`;
     }
+    // Slice 3's repeated-retry instruction, appended only when a valid
+    // delegation was present and the child's report simply had not landed
+    // yet. It is the most immediate remediation for that specific case (and
+    // the only one the child can act on alone), so it reads last. The
+    // standard reason above is kept intact rather than replaced: an
+    // operator reading the audit trail still sees the same block cause.
+    if (retryInstruction) {
+        reasonText = `${reasonText}\n\n${retryInstruction}`;
+    }
     return JSON.stringify({
         decision: "block",
         reason: reasonText,
@@ -543,6 +679,198 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // up `grounding-mcp` in the manifest on demand. Stays audit-only
     // either way: a missing `grounding-mcp` entry costs one stderr line
     // inside the auto path, never an approval.
+    // Step 9's key-one-by-delegation branch (slice 3, agent-tasks/37ad0b05,
+    // ADR "Decision: two-key design"). Placed immediately before the
+    // `attemptAutoApproval` call and therefore, like it, only on a call
+    // every branch above has already declined. What happens here is
+    // narrow: verify the delegation, and if it holds, obtain the child's
+    // OWN report through the bounded transcript poll and persist it
+    // `pending`. It writes no marker and returns no allow of its own; the
+    // auto path below still applies every condition it applies to a
+    // `when`-matched call, the `pending`-only report rule included, and the
+    // marker re-check inside it is still the only thing that allows.
+    //
+    // Fail-closed at every step, each with its own stderr line: no opt-in,
+    // an unlisted harness, no payload `session_id`, no delegation file, an
+    // absent signing key, any refusal from `verifyDelegation`, an
+    // unparseable or absent transcript report. Each one falls through with
+    // `delegation` unset, and the block below is what the call then
+    // reaches.
+    let delegation;
+    // Set only by the bound elapsing with no report in the transcript: the
+    // measured case where the child DID what it was asked and the write is
+    // simply still in flight. That is the one case where the deny text asks
+    // for a retry, so it is the one case that sets this flag.
+    let reportScanTimedOut = false;
+    if (generatedDir !== undefined && !markerForged) {
+        // `null` stderr on purpose: `attemptAutoApproval` parses the same
+        // block a few lines below and writes the malformed-config line
+        // itself, so passing this hook's stderr here would double it.
+        const autoCfg = parseAutoApprove(declared.config["auto_approve"], null);
+        const payloadSid = typeof event.session_id === "string" && event.session_id.length > 0
+            ? event.session_id
+            : null;
+        let delegationPath = null;
+        if (autoCfg !== null && harnessAllowed(autoCfg, CLAUDE_CODE_HARNESS) && payloadSid !== null) {
+            try {
+                delegationPath = delegationMarkerPathFor(generatedDir, payloadSid);
+            }
+            catch {
+                // A session id that cannot name a file has no delegation, by
+                // construction (`verifyDelegation` draws the same conclusion).
+                delegationPath = null;
+            }
+        }
+        if (autoCfg !== null && delegationPath !== null && existsSync(delegationPath)) {
+            const childSessionId = payloadSid;
+            if (!signingKeyExists(generatedDir)) {
+                // Never verify through a path that would MINT the key
+                // (`verifyMarkerSignature` -> `getOrCreateSigningKey`). The
+                // verifier prechecks this too; this line names the condition at
+                // the hook, where the operator is reading.
+                stderr.write("harness pack hook: delegation present but signing key absent; not verified\n");
+            }
+            else {
+                const verified = verifyDelegation({
+                    generatedDir,
+                    childSessionId,
+                    // The payload's own cwd, held against the hashed binding the
+                    // parent signed. Absent means the delegation's cwd binding
+                    // cannot be satisfied, which the verifier reports as a
+                    // `cwd_mismatch` rather than waving through.
+                    cwd: typeof event.cwd === "string" && event.cwd.length > 0 ? event.cwd : null,
+                    // The same active-claim id the task-scoped marker check resolves
+                    // above, so a delegation issued for one task cannot authorize a
+                    // child that has claimed another. Read a SECOND time here on
+                    // purpose: `checkOperatorApprovalMarkers` resolves the claim
+                    // inside itself and returns only a detail string, never the id,
+                    // so there is no resolved value to reuse without widening that
+                    // shared runtime's return shape for one caller.
+                    taskId: readActiveClaim(generatedDir),
+                });
+                if (!verified.ok) {
+                    if (verified.reason === "report_path_mismatch") {
+                        // This hook never passes `launcherReportPath` to
+                        // `verifyDelegation`, so a delegation that binds one (the
+                        // `--report` fallback shape) is refused here every time,
+                        // not merely on a path/content mismatch. Name the actual
+                        // limitation instead of the generic `report_path_mismatch`
+                        // wording `verified.detail` carries: the fallback shape is
+                        // issued and signature-verifiable by `harness delegate`, it
+                        // is just not yet consumed by THIS hook (a named
+                        // follow-up); the transcript scan below is the only report
+                        // channel this hook acts on today.
+                        stderr.write(`harness pack hook: delegation for ${childSessionId} refused: it binds a launcher-supplied report file (the --report fallback shape), which is issued and verifiable but not yet consumed by the child hook (a named follow-up); the transcript scan is the only report channel this hook acts on\n`);
+                    }
+                    else {
+                        stderr.write(`harness pack hook: delegation for ${childSessionId} refused: ${verified.reason}: ${verified.detail}\n`);
+                    }
+                }
+                else {
+                    delegation = { parentSessionId: verified.parentSessionId };
+                    // Key two: the child's own report. Already on disk and pending
+                    // (the child was denied once and its report has since been
+                    // captured) means there is nothing to scan for, so the
+                    // transcript is not read at all.
+                    // `childSessionId`, not the outer `sessionId`: this whole block
+                    // decides the PAYLOAD's session, and the two only coincide
+                    // because the env fallback never wins on a path that carries a
+                    // payload session_id. Spelling it out keeps the report this
+                    // branch looks for bound to the same session the delegation,
+                    // the scan and the adoption ledger are all keyed by.
+                    const existing = selectNewestStrictSessionReport(listPersistedReports(reportsDir), childSessionId);
+                    if (existing === null || existing.approvalStatus !== "pending") {
+                        const transcriptPath = typeof event.transcript_path === "string" && event.transcript_path.length > 0
+                            ? event.transcript_path
+                            : null;
+                        // The once-per-session adoption ledger, read only on the path
+                        // that can actually capture something.
+                        const adoptedPath = adoptedEntriesPathFor(generatedDir, childSessionId);
+                        const adopted = transcriptPath === null
+                            ? { ok: true, ids: new Set() }
+                            : readAdoptedEntries(adoptedPath);
+                        if (transcriptPath === null) {
+                            stderr.write(`harness pack hook: delegation for ${childSessionId} is valid but the payload carries no transcript_path; the child's report cannot be captured\n`);
+                        }
+                        else if (!adopted.ok) {
+                            // Fail closed: without the ledger we cannot tell a fresh
+                            // report from one this session already spent.
+                            stderr.write(`harness pack hook: the adopted-entry ledger at ${adoptedPath} could not be read (${adopted.detail}); refusing to capture a transcript entry that may already have been adopted for session ${childSessionId}\n`);
+                        }
+                        else {
+                            const scan = await scanTranscriptForReport({
+                                transcriptPath,
+                                sessionId: childSessionId,
+                                maxWaitMs: autoCfg.reportScan.maxWaitMs,
+                                adopted: adopted.ids,
+                                ...(opts.reportScanClock?.now !== undefined
+                                    ? { now: opts.reportScanClock.now }
+                                    : {}),
+                                ...(opts.reportScanClock?.sleep !== undefined
+                                    ? { sleep: opts.reportScanClock.sleep }
+                                    : {}),
+                                ...(opts.reportScanClock?.pollMs !== undefined
+                                    ? { pollMs: opts.reportScanClock.pollMs }
+                                    : {}),
+                            });
+                            if (scan.found) {
+                                // RECORD THE ADOPTION FIRST, then persist. In this order a
+                                // failed ledger write costs one blocked call and leaves the
+                                // entry re-scannable, while the reverse order would leave a
+                                // persisted, mintable report behind an unrecorded adoption:
+                                // exactly the replay this ledger exists to stop.
+                                const recorded = recordAdoptedEntry(adoptedPath, scan.entryId);
+                                if (!recorded.ok) {
+                                    stderr.write(`harness pack hook: could not record transcript entry ${scan.entryId} as adopted for session ${childSessionId} (${recorded.detail}); nothing was persisted\n`);
+                                }
+                                else {
+                                    // Reuses the SAME persister `harness approve
+                                    // understanding` uses for a heredoc-attached report, so
+                                    // the capture is session-bound, `pending`, and validated
+                                    // by one parser rather than a second one written here.
+                                    // A real `new Date()` on purpose: the persisted report
+                                    // must sort as the newest strict-session report against
+                                    // whatever is already on disk, which a caller-injected
+                                    // clock could not guarantee.
+                                    const persisted = persistStdinReport({
+                                        markdown: scan.markdown,
+                                        reportsDir,
+                                        sessionId: childSessionId,
+                                        now: new Date(),
+                                        mode: toPackageMode(resolveMode(declared).mode),
+                                    });
+                                    if (persisted.ok) {
+                                        stderr.write(`harness pack hook: captured the Understanding Report for session ${childSessionId} from its own transcript (line ${scan.lineIndex}, after ${scan.waitedMs}ms) and persisted it pending at ${persisted.filePath}\n`);
+                                    }
+                                    else {
+                                        // The entry stays adopted: re-reading a report that
+                                        // does not parse would fail identically forever, so
+                                        // the child needs a NEW one, which is what the block's
+                                        // retry instruction asks for. Set the same flag the
+                                        // timeout branch sets, for that reason: the retry
+                                        // sentence reads correctly for this case too, and
+                                        // without it the block below would ask for a retry
+                                        // implicitly while never saying so.
+                                        reportScanTimedOut = true;
+                                        stderr.write(`harness pack hook: the transcript report for session ${childSessionId} did not parse (${persisted.reason}); nothing was persisted\n`);
+                                    }
+                                }
+                            }
+                            else if (scan.reason === "timeout") {
+                                reportScanTimedOut = true;
+                                stderr.write(scan.adoptedOnly === true
+                                    ? `harness pack hook: the newest Understanding Report entry in the transcript for session ${childSessionId} was already adopted; emit a fresh report\n`
+                                    : `harness pack hook: no Understanding Report for session ${childSessionId} reached its transcript within ${autoCfg.reportScan.maxWaitMs}ms (waited ${scan.waitedMs}ms); blocking and asking the child to re-emit and retry\n`);
+                            }
+                            else {
+                                stderr.write(`harness pack hook: the transcript at ${transcriptPath} exists but could not be read; the report for session ${childSessionId} cannot be captured\n`);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
     const resolveAutoLedger = () => {
         if (opts.writeLedger)
             return { write: opts.writeLedger };
@@ -572,6 +900,11 @@ export async function runPackHookPreToolUseCli(opts = {}) {
         packConfig: declared.config,
         reportsDir,
         markerForged,
+        // Slice 3: present only when the branch above verified a delegation
+        // for this child session. It supplies key ONE in place of a
+        // `when`-listed `permission_mode`; every other condition, key two
+        // included, is unchanged.
+        ...(delegation !== undefined ? { delegation } : {}),
         stderr,
         resolveLedger: resolveAutoLedger,
     });
@@ -609,7 +942,7 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     const latestParseError = report.report === null
         ? findLatestParseError(path.join(path.dirname(reportsDir), "parse-errors"), sessionId)
         : null;
-    stdout.write(`${blockJson(toolName, "no approved Understanding Report for this session", configProducers, configUx, sessionId, escapeHint, latestParseError?.malformedSections)}\n`);
+    stdout.write(`${blockJson(toolName, "no approved Understanding Report for this session", configProducers, configUx, sessionId, escapeHint, latestParseError?.malformedSections, reportScanTimedOut ? DELEGATION_REPORT_RETRY_INSTRUCTION : null)}\n`);
     return {
         exitCode: 0,
         blocked: true,