@lannguyensi/harness 0.51.0 → 0.53.0

package/dist/cli/pack/transcript-report-scan.js

@@ -0,0 +1,359 @@
+// Session-scoped, role-aware transcript scan for the child's own
+// Understanding Report: slice 3 of
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md ("Report capture
+// under `-p`", agent-tasks 37ad0b05).
+//
+// WHY THIS EXISTS. Under `claude -p` there is no operator to run
+// `harness approve understanding`, and the Stop hook fires only at the
+// end of the run, so neither channel can supply key two (the child's own
+// report) at the instant the first gated tool call is decided. The
+// session transcript is the remaining channel, and it LAGS: at the
+// PreToolUse instant the report the agent just emitted is not in the
+// JSONL yet; it lands tens of milliseconds later (measured, see
+// `docs/okf/understanding-gate-auto-mode-signals.md` and
+// `dogfood/ug-auto-mode-signals/`). This module is the bounded poll the
+// ADR chose over a lone block-and-retry: it waits for the flush itself,
+// for at most `auto_approve.report_scan.max_wait`, and then gives up.
+//
+// FAIL CLOSED. There is no branch here that turns an absent report into
+// anything but `found: false`. The caller blocks on that; the timeout is
+// a block, never an allow.
+//
+// WHAT IT WILL NOT DO, AND WHY EACH REFUSAL IS LOAD-BEARING:
+//
+//   - It opens exactly ONE file, the `transcript_path` the payload names,
+//     and never a directory. A directory scan could reach another
+//     session's transcript, and (per the ADR's subagent measurement) the
+//     separate `agent-<agent_id>.jsonl` a subagent's turns live in.
+//   - Only `type: "assistant"` entries count. A report the agent quoted
+//     back inside a user message is the PROMPT's text, not the model's
+//     own report, and adopting it would let the launcher's prompt supply
+//     key two.
+//   - Only entries whose own `sessionId` equals the session being decided
+//     count. The payload names the file, but a file can hold entries from
+//     more than one session id (a resumed / forked transcript), and an
+//     entry stamped with a foreign id is not this session's report.
+//   - `isSidechain: true` entries are excluded. The measured shape never
+//     puts one in the payload's own transcript (subagent turns live in a
+//     separate file), so this is defence in depth against a shape the
+//     measurement did not produce, not the mechanism the separation
+//     relies on.
+//   - EACH TRANSCRIPT ENTRY IS ADOPTED AT MOST ONCE PER SESSION: the
+//     caller passes the entry ids it has already spent (`adopted`) and
+//     this scan returns the newest NON-adopted hit, so one report cannot
+//     mint a second marker after the first one expired or a task boundary
+//     cleared it. Without that rule the delegation's TTL would silently
+//     replace the marker's, which is the lifetime the ADR's two-key
+//     design deliberately keeps short.
+//
+// HOW IT READS. The first poll reads the whole file; every later poll
+// reads only the bytes appended since the previous one, carrying a
+// partial trailing line over, and keeps the best hit found so far. A
+// transcript that SHRANK between polls (truncated or replaced by a
+// shorter file), or whose underlying file identity changed (inode/device,
+// from `fs.fstatSync`, even when the new file is the same size or LARGER,
+// as in a rename swapping in a different file in place), resets the
+// reader and it is re-read from the top. Size alone cannot catch the
+// second case: a same-size-or-larger replacement passes the size check
+// but its bytes at the old offset are not a continuation of anything
+// this reader has seen.
+//
+// The clock and the sleep are injected so the tests drive the poll
+// deterministically and never sleep for real.
+import * as fs from "node:fs";
+import { sha256Hex } from "../../runtime/approval-signing.js";
+/**
+ * The report heading the scan looks for, anchored to a whole line.
+ *
+ * ANY heading level, `#` through `######`: the deny text the child is
+ * given (`renderReportSchemaHint`) says "any heading level (#, ##, ###)"
+ * and shows a `##` example, so a scan that accepted only `#` would refuse
+ * exactly the shape its own instruction asked for.
+ *
+ * Deliberately `[ \t]` rather than `\s` around the words: `\s` matches
+ * newlines, so `^#\s*Understanding Report\s*$` under the `m` flag would
+ * also match a bare `#` on one line followed by the words on the next,
+ * which is not a heading. Case-insensitive on the words themselves (an
+ * agent that writes `# UNDERSTANDING REPORT` has still emitted the
+ * section the deny text asked for); a trailing `\r` is tolerated for a
+ * CRLF-written transcript.
+ */
+const REPORT_HEADING = /^#{1,6}[ \t]*understanding[ \t]+report[ \t]*\r?$/i;
+/**
+ * The text blocks of one entry's `message.content`, in order. A string
+ * `content` counts as exactly one text block; in the array shape only
+ * `{ type: "text", text: <string> }` blocks contribute, so `tool_use` and
+ * `thinking` blocks are ignored (a report the model only ever "thought"
+ * is not a report it emitted).
+ */
+function textBlocksOf(entry) {
+    const message = entry.message;
+    if (message === null || typeof message !== "object" || Array.isArray(message))
+        return [];
+    const content = message.content;
+    if (typeof content === "string")
+        return [content];
+    if (!Array.isArray(content))
+        return [];
+    const blocks = [];
+    for (const block of content) {
+        if (block === null || typeof block !== "object" || Array.isArray(block))
+            continue;
+        const b = block;
+        if (b.type !== "text")
+            continue;
+        if (typeof b.text !== "string")
+            continue;
+        blocks.push(b.text);
+    }
+    return blocks;
+}
+/** The report markdown inside one text block, or null when it carries no heading. */
+function reportInBlock(block) {
+    const lines = block.split("\n");
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+        if (REPORT_HEADING.test(lines[i])) {
+            return lines.slice(i).join("\n");
+        }
+    }
+    return null;
+}
+/** Longest `uuid` accepted verbatim as an adoption id; anything longer falls back to the digest. */
+const ENTRY_UUID_MAX_LENGTH = 200;
+/**
+ * Stable identity of one adopted entry. The transcript's own `uuid` is
+ * preferred (Claude Code stamps one on every entry, and it survives the
+ * file being rewritten or resumed); a value that is missing, empty,
+ * over-long, or carries a line break (all of which would corrupt the
+ * caller's one-id-per-line ledger) falls back to a digest of the adopted
+ * markdown plus its line index. The two forms are namespaced so a crafted
+ * `uuid` cannot impersonate a digest id.
+ */
+function entryIdFor(entry, markdown, lineIndex) {
+    const uuid = entry.uuid;
+    if (typeof uuid === "string" &&
+        uuid.length > 0 &&
+        uuid.length <= ENTRY_UUID_MAX_LENGTH &&
+        !/[\r\n]/.test(uuid)) {
+        return `uuid:${uuid}`;
+    }
+    return `sha256:${sha256Hex(`${lineIndex}\n${markdown}`)}`;
+}
+/**
+ * The eligible report on ONE JSONL line, or null. Unparseable and blank
+ * lines yield null rather than aborting the scan: a transcript being
+ * written while it is read can end in a half-flushed line, and refusing
+ * the whole file for that would turn a routine race into a block.
+ */
+function reportHitInLine(line, lineIndex, sessionId) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return null;
+    let entry;
+    try {
+        entry = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+        return null;
+    if (entry.type !== "assistant")
+        return null;
+    if (entry.isSidechain === true)
+        return null;
+    if (entry.sessionId !== sessionId)
+        return null;
+    const blocks = textBlocksOf(entry);
+    for (let b = blocks.length - 1; b >= 0; b -= 1) {
+        const markdown = reportInBlock(blocks[b]);
+        if (markdown !== null) {
+            return { markdown, lineIndex, entryId: entryIdFor(entry, markdown, lineIndex) };
+        }
+    }
+    return null;
+}
+const DEFAULT_POLL_MS = 50;
+const NEWLINE = 0x0a;
+const CLOSING_BRACE = 0x7d;
+const EMPTY_ADOPTED = new Set();
+function newScanState() {
+    return {
+        offset: 0,
+        carry: Buffer.alloc(0),
+        lineIndex: 0,
+        best: null,
+        tentative: null,
+        adoptedSkipped: false,
+        ino: null,
+        dev: null,
+    };
+}
+/** A hit the caller may still take: skips (and records) an already-adopted one. */
+function eligible(hit, adopted, state) {
+    if (hit === null)
+        return null;
+    if (adopted.has(hit.entryId)) {
+        state.adoptedSkipped = true;
+        return null;
+    }
+    return hit;
+}
+/** Read `length` bytes from `offset`, tolerating a short `readSync`. */
+function readAt(fd, offset, length) {
+    const buf = Buffer.allocUnsafe(length);
+    let read = 0;
+    while (read < length) {
+        const n = fs.readSync(fd, buf, read, length - read, offset + read);
+        if (n <= 0)
+            break;
+        read += n;
+    }
+    return read === length ? buf : buf.subarray(0, read);
+}
+/**
+ * The trailing, newline-less bytes as a PROVISIONAL hit for this poll
+ * only. A writer that has flushed a complete JSONL entry but not yet its
+ * newline is the one case the append-only reader would otherwise miss
+ * until the next flush, and the whole-file reader this replaced did see
+ * it. Only attempted when the carry ends in `}`, which both keeps the
+ * cost off every poll's partial line and guarantees the decoded bytes end
+ * on a character boundary.
+ */
+function scanCarry(state, sessionId, adopted) {
+    const carry = state.carry;
+    if (carry.length === 0 || carry[carry.length - 1] !== CLOSING_BRACE)
+        return;
+    state.tentative = eligible(reportHitInLine(carry.toString("utf8"), state.lineIndex, sessionId), adopted, state);
+}
+/**
+ * Consume everything appended to the transcript since the previous poll,
+ * updating `state` in place.
+ *
+ * ENOENT is "not there YET": under `-p` the hook can fire before the
+ * transcript file exists, and it may appear inside the bound. Every other
+ * failure, and anything at that path that is not a regular file, means
+ * something IS there and cannot be read as a transcript, which is a
+ * distinct, immediately-reported condition rather than something waiting
+ * will fix.
+ */
+function pollTranscript(transcriptPath, state, sessionId, adopted) {
+    // Provisional only for the poll that produced it: a file that vanished
+    // (or shrank) between polls must not leave a hit behind.
+    state.tentative = null;
+    let fd;
+    try {
+        fd = fs.openSync(transcriptPath, "r");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return "absent";
+        return "unreadable";
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return "unreadable";
+        // Identity change: the file at this path was replaced (rename, or a
+        // recreate) between polls. Checked BEFORE the size comparison and
+        // independently of it, because a replacement can be the same size or
+        // larger, which the size check alone would read straight through as
+        // ordinary growth.
+        const identityChanged = state.ino !== null && (stat.ino !== state.ino || stat.dev !== state.dev);
+        if (identityChanged || stat.size < state.offset) {
+            // The file shrank, or was replaced in place: truncated, or a
+            // different file now sits at this path. The bytes the offset
+            // pointed past are stale (shrink) or belong to a different file
+            // entirely (identity change), so start over from the top.
+            Object.assign(state, newScanState());
+        }
+        state.ino = stat.ino;
+        state.dev = stat.dev;
+        if (stat.size > state.offset) {
+            const chunk = readAt(fd, state.offset, stat.size - state.offset);
+            state.offset += chunk.length;
+            const data = state.carry.length > 0 ? Buffer.concat([state.carry, chunk]) : chunk;
+            let start = 0;
+            for (;;) {
+                const nl = data.indexOf(NEWLINE, start);
+                if (nl === -1)
+                    break;
+                const hit = eligible(reportHitInLine(data.subarray(start, nl).toString("utf8"), state.lineIndex, sessionId), adopted, state);
+                if (hit !== null)
+                    state.best = hit;
+                state.lineIndex += 1;
+                start = nl + 1;
+            }
+            state.carry = start < data.length ? Buffer.from(data.subarray(start)) : Buffer.alloc(0);
+        }
+        scanCarry(state, sessionId, adopted);
+        return "ok";
+    }
+    catch {
+        return "unreadable";
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * Poll the payload's own transcript for this session's Understanding
+ * Report until it appears or `maxWaitMs` elapses. See the module header
+ * for the filters and why each one is there.
+ *
+ * The poll timer is deliberately NOT `unref`'d. A hook process whose
+ * stdin has been drained has no other ref'd handle, so an unref'd timer
+ * lets Node exit mid-poll: the process would end with an empty stdout,
+ * which Claude Code reads as ALLOW: a silent fail-open on precisely the
+ * delegation path this scan exists for. The loop is bounded twice over
+ * (`maxWaitMs`, itself capped by the config's 5 s ceiling, and the
+ * `maxPolls` count below), so it can never hold the process open beyond
+ * the bound.
+ */
+export async function scanTranscriptForReport(args) {
+    const now = args.now ?? (() => Date.now());
+    const sleep = args.sleep ?? defaultSleep;
+    const pollMs = args.pollMs !== undefined && args.pollMs > 0 ? args.pollMs : DEFAULT_POLL_MS;
+    const maxWaitMs = Number.isFinite(args.maxWaitMs) && args.maxWaitMs > 0 ? args.maxWaitMs : 0;
+    const adopted = args.adopted ?? EMPTY_ADOPTED;
+    const start = now();
+    // Belt and braces against a clock that does not advance (an injected
+    // one that forgets to, a suspended VM): the poll count is bounded on
+    // its own, so this can never become an unbounded loop inside a hook.
+    // Generous enough that it never pre-empts the real time bound.
+    const maxPolls = Math.ceil(maxWaitMs / pollMs) + 2;
+    const state = newScanState();
+    for (let poll = 0;; poll += 1) {
+        const outcome = pollTranscript(args.transcriptPath, state, args.sessionId, adopted);
+        if (outcome === "unreadable") {
+            return { found: false, reason: "unreadable", waitedMs: now() - start };
+        }
+        // The provisional trailing-line hit is newer than any complete one.
+        const hit = state.tentative ?? state.best;
+        if (hit !== null) {
+            return {
+                found: true,
+                markdown: hit.markdown,
+                lineIndex: hit.lineIndex,
+                entryId: hit.entryId,
+                waitedMs: now() - start,
+            };
+        }
+        const elapsed = now() - start;
+        if (elapsed >= maxWaitMs || poll >= maxPolls) {
+            return {
+                found: false,
+                reason: "timeout",
+                ...(state.adoptedSkipped ? { adoptedOnly: true } : {}),
+                waitedMs: elapsed,
+            };
+        }
+        await sleep(pollMs);
+    }
+}
+//# sourceMappingURL=transcript-report-scan.js.map

package/dist/cli/pack/transcript-report-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript-report-scan.js","sourceRoot":"","sources":["../../../src/cli/pack/transcript-report-scan.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,mCAAmC;AACnC,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,yEAAyE;AACzE,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,gEAAgE;AAChE,yDAAyD;AACzD,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,2BAA2B;AAC3B,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,kEAAkE;AAClE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,iBAAiB;AACjB,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,uCAAuC;AACvC,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,mEAAmE;AACnE,8CAA8C;AAE9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAsE3E;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QAClF,MAAM,CAAC,GAAG,KAA2C,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,oGAAoG;AACpG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAA0B,EAAE,QAAgB,EAAE,SAAiB;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,qBAAqB;QACpC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,SAAS,CAAC,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAwB,IAAI,GAAG,EAAU,CAAC;AAqC7D,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtB,SAAS,EAAE,CAAC;QACZ,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,KAAK;QACrB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CACf,GAAqB,EACrB,OAA4B,EAC5B,KAAgB;IAEhB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,EAAU,EAAE,MAAc,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAClB,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAgB,EAAE,SAAiB,EAAE,OAA4B;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO;IAC5E,KAAK,CAAC,SAAS,GAAG,QAAQ,CACxB,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EACnE,OAAO,EACP,KAAK,CACN,CAAC;AACJ,CAAC;AAID;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACrB,cAAsB,EACtB,KAAgB,EAChB,SAAiB,EACjB,OAA4B;IAE5B,uEAAuE;IACvE,yDAAyD;IACzD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACtE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,YAAY,CAAC;QACxC,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,oEAAoE;QACpE,mBAAmB;QACnB,MAAM,eAAe,GACnB,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,eAAe,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAChD,6DAA6D;YAC7D,6DAA6D;YAC7D,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClF,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,SAAS,CAAC;gBACR,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACxC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAAE,MAAM;gBACrB,MAAM,GAAG,GAAG,QAAQ,CAClB,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EACtF,OAAO,EACP,KAAK,CACN,CAAC;gBACF,IAAI,GAAG,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;gBACnC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;gBACrB,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACzE,CAAC;QACD,oEAAoE;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK;aACxB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;QAC9B,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC7C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,SAAS;gBACjB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/cli/pack/upgrade.d.ts

@@ -0,0 +1,32 @@
+/** Pack names this verb knows how to upgrade. Grows as more upgrades ship. */
+export type PackUpgradeName = "understanding-before-execution";
+export interface PackUpgradeOptions {
+    configPath?: string;
+    homeDir?: string;
+    dryRun?: boolean;
+}
+export interface PackUpgradeResult {
+    path: string;
+    name: string;
+    diff: string;
+    /** True when the manifest was actually written. */
+    applied: boolean;
+    /** True when the block was already present: a byte-identical no-op. */
+    alreadyPresent: boolean;
+}
+export type ApplyAutoApproveUpgradeResult = {
+    ok: true;
+    text: string;
+    changed: boolean;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function applyAutoApproveUpgrade(original: string): ApplyAutoApproveUpgradeResult;
+/**
+ * `harness pack upgrade <name>` implementation. `name` is validated
+ * against the (currently one-entry) set of known upgrades before any
+ * file I/O; an unknown name refuses with `EX_FAIL` rather than silently
+ * doing nothing.
+ */
+export declare function packUpgrade(name: string, opts?: PackUpgradeOptions): Promise<PackUpgradeResult>;