@lannguyensi/harness 0.52.0 → 0.54.0

package/dist/cli/pack/upgrade.js

@@ -0,0 +1,273 @@
+// `harness pack upgrade <name>`: text-level insertion of a pack's
+// missing default config block into an existing manifest, WITHOUT
+// parsing and reserializing the operator's YAML (unlike `pack add` /
+// `pack reseed`, which both mutate via the `yaml` Document API). Task
+// 8f637efd: the one upgrade this ships is `auto_approve` for
+// `understanding-before-execution` (D-004,
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Amendment:
+// install default").
+//
+// WHY TEXT-LEVEL, NOT DOCUMENT-LEVEL. The `yaml` package's Document API
+// (`withDocument`, used by `pack reseed`) round-trips comments
+// reasonably well for a single field REPLACEMENT, but this upgrade
+// INSERTS a brand-new key with its own multi-line comment block into an
+// operator manifest that may carry hand edits `pack add` / `reseed`
+// never touch (custom producers, an extra top-level key, a reordered
+// field). Re-serializing the whole document risks reformatting content
+// this verb has no business touching. Insertion by line position,
+// guided by indentation, keeps every byte outside the inserted block
+// untouched.
+//
+// IDEMPOTENT. If `auto_approve:` already exists anywhere inside the
+// pack's `config:` mapping (any indentation), this is a no-op: the
+// output is byte-identical to the input. An operator who already
+// hand-applied the workaround (the ADR's own "Workaround, bereits
+// angewendet" paragraph) gets nothing rewritten out from under them.
+//
+// REFUSES ON AMBIGUITY. Zero or more than one
+// `understanding-before-execution` pack block, more than one `config:`
+// key inside it, or no `config:` key found at all, is a refusal
+// (non-zero exit, a clear message), never a guess at where to insert.
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { atomicWriteFile } from "../../io/atomic-write.js";
+import { unifiedDiff } from "../../io/patch.js";
+import { withFileLock } from "../../io/lock.js";
+import { formatValidationErrors, validateBeforeWrite, } from "../../io/validate-before-write.js";
+import { resolveHomeDir } from "../../runtime/home-dir.js";
+import { renderAutoApproveSnippet } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { EX_FAIL, EX_NOINPUT, HarnessExitError } from "../exit-codes.js";
+const DEFAULT_BASENAME = "harness.yaml";
+const LOCK_BASENAME = ".harness.lock";
+function resolveTargetPath(opts) {
+    if (opts.configPath)
+        return path.resolve(opts.configPath);
+    return path.join(resolveHomeDir({ ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}) }).path, DEFAULT_BASENAME);
+}
+function countLeadingSpaces(line) {
+    return line.length - line.trimStart().length;
+}
+/**
+ * Text-level insertion of the `auto_approve` default snippet into the
+ * `understanding-before-execution` pack's `config:` mapping. Pure: text
+ * in, text (+ a change flag) out, or an error string on ambiguity.
+ * Exported for direct unit testing without going through the CLI/file
+ * layer.
+ */
+/**
+ * The line ending most of `text` uses, so an insertion into a CRLF
+ * manifest does not mix in bare-LF lines (task 8f637efd review round 2
+ * F6): counts `\r\n` occurrences against LF-only ones (every `\n` not
+ * part of a `\r\n` pair) and picks whichever is more common, defaulting
+ * to `\n` on a tie or an all-LF file.
+ */
+function detectDominantEol(text) {
+    const crlfCount = (text.match(/\r\n/g) ?? []).length;
+    const totalLf = (text.match(/\n/g) ?? []).length;
+    const lfOnlyCount = totalLf - crlfCount;
+    return crlfCount > lfOnlyCount ? "\r\n" : "\n";
+}
+export function applyAutoApproveUpgrade(original) {
+    const eol = detectDominantEol(original);
+    // Split on either line ending so every line in `lines` is `\r`-free
+    // (its own trailing `\r`, if any, is consumed by the delimiter, not
+    // left dangling on the line content); the array is rejoined with the
+    // detected `eol` below, so a CRLF manifest stays CRLF end to end
+    // instead of picking up bare-LF lines from the inserted snippet.
+    const lines = original.split(/\r\n|\n/);
+    // Accepts a bare, double-quoted, or single-quoted scalar for the pack
+    // name (task 8f637efd review round 2 F4): `- name: understanding-before-execution`,
+    // `- name: "understanding-before-execution"`, and
+    // `- name: 'understanding-before-execution'` are all schema-valid YAML
+    // for the same value; the bare-only form previously refused the
+    // quoted spellings with "could not find a ... entry".
+    const packNameRe = /^(\s*)-\s*name:\s*(?:"understanding-before-execution"|'understanding-before-execution'|understanding-before-execution)\s*(#.*)?$/;
+    const packMatches = [];
+    for (let i = 0; i < lines.length; i++) {
+        const m = packNameRe.exec(lines[i] ?? "");
+        if (m)
+            packMatches.push({ index: i, indent: (m[1] ?? "").length });
+    }
+    if (packMatches.length === 0) {
+        return {
+            ok: false,
+            error: "could not find a `- name: understanding-before-execution` policy_packs entry in this manifest",
+        };
+    }
+    if (packMatches.length > 1) {
+        return {
+            ok: false,
+            error: `found ${packMatches.length} \`understanding-before-execution\` policy_packs entries; refusing (ambiguous)`,
+        };
+    }
+    const pack = packMatches[0];
+    const itemIndent = pack.indent;
+    function findBoundary(startIdx, indentThreshold) {
+        for (let i = startIdx; i < lines.length; i++) {
+            const line = lines[i] ?? "";
+            if (line.trim() === "")
+                continue;
+            if (countLeadingSpaces(line) <= indentThreshold)
+                return i;
+        }
+        return lines.length;
+    }
+    const packEnd = findBoundary(pack.index + 1, itemIndent);
+    const configIndent = itemIndent + 2;
+    const configRe = /^config:\s*(#.*)?$/;
+    let configIdx = -1;
+    for (let i = pack.index + 1; i < packEnd; i++) {
+        const line = lines[i] ?? "";
+        if (line.trim() === "")
+            continue;
+        if (countLeadingSpaces(line) === configIndent && configRe.test(line.trim())) {
+            if (configIdx !== -1) {
+                return {
+                    ok: false,
+                    error: "found more than one `config:` key in the understanding-before-execution pack block; refusing (ambiguous)",
+                };
+            }
+            configIdx = i;
+        }
+    }
+    if (configIdx === -1) {
+        return {
+            ok: false,
+            error: "could not find a `config:` key in the understanding-before-execution pack block",
+        };
+    }
+    let lastContentIdx = configIdx;
+    let autoApprovePresent = false;
+    for (let i = configIdx + 1; i < packEnd; i++) {
+        const line = lines[i] ?? "";
+        const trimmed = line.trim();
+        if (trimmed === "")
+            continue;
+        const indent = countLeadingSpaces(line);
+        if (indent <= configIndent)
+            break;
+        lastContentIdx = i;
+        // Review round 3, F3: any line whose trimmed form starts with
+        // `auto_approve:` counts as "already present", not only the exact
+        // bare-key spelling `auto_approve:` with nothing else on the line.
+        // That exact-equality check missed a hand-applied flow-style value
+        // (`auto_approve: {when: [bypassPermissions], ...}`) and a bare key
+        // with a trailing comment (`auto_approve:  # already configured`):
+        // both are schema-valid YAML for the same key, but neither passed
+        // `trimmed === "auto_approve:"`, so this verb would insert a SECOND
+        // `auto_approve` key and `parseYaml` below would throw "Map keys
+        // must be unique" uncaught (exit 70, a raw YAML message) instead of
+        // recognizing the upgrade as already applied.
+        // Known limit: a line starting with `auto_approve:` inside a block scalar
+        // under another key would also count as present; the verb then no-ops
+        // (fail-safe, never a corrupted manifest) rather than inserting twice.
+        if (trimmed.startsWith("auto_approve:"))
+            autoApprovePresent = true;
+    }
+    if (autoApprovePresent) {
+        return { ok: true, text: original, changed: false };
+    }
+    const snippetLines = renderAutoApproveSnippet(configIndent + 2).split("\n");
+    const insertAt = lastContentIdx + 1;
+    const next = [...lines.slice(0, insertAt), ...snippetLines, ...lines.slice(insertAt)];
+    return { ok: true, text: next.join(eol), changed: true };
+}
+/**
+ * `parseYaml`, but a parse failure on the PROPOSED (post-insertion) text
+ * surfaces as this verb's own refusal (`HarnessExitError`, `EX_FAIL`,
+ * naming the pack and that the proposed text did not parse) rather than
+ * an uncaught exception (review round 3, F3: before this wrapper, a
+ * proposal `applyAutoApproveUpgrade` mis-recognized as a genuine
+ * insertion (e.g. a duplicate key under a different quoting style this
+ * heuristic does not special-case) reached the operator as a raw
+ * "Map keys must be unique" crash at exit 70 instead of a normal
+ * refusal). `original` is never passed here: it is the operator's own
+ * file, already on disk, and is not re-validated by this verb.
+ */
+function parseProposedYamlOrRefuse(text, name, context) {
+    try {
+        return parseYaml(text);
+    }
+    catch (err) {
+        throw new HarnessExitError(`harness pack upgrade: proposed manifest for pack ${JSON.stringify(name)} did not parse as YAML (${context}): ${err instanceof Error ? err.message : String(err)}`, EX_FAIL);
+    }
+}
+/**
+ * `harness pack upgrade <name>` implementation. `name` is validated
+ * against the (currently one-entry) set of known upgrades before any
+ * file I/O; an unknown name refuses with `EX_FAIL` rather than silently
+ * doing nothing.
+ */
+export async function packUpgrade(name, opts = {}) {
+    if (name !== "understanding-before-execution") {
+        throw new HarnessExitError(`harness pack upgrade does not support ${JSON.stringify(name)} yet; only "understanding-before-execution" (auto_approve default, task 8f637efd) is wired.`, EX_FAIL);
+    }
+    const target = resolveTargetPath(opts);
+    if (!fs.existsSync(target)) {
+        throw new HarnessExitError(`harness manifest not found at ${target}; run \`harness init\` first`, EX_NOINPUT);
+    }
+    const original = fs.readFileSync(target, "utf8");
+    const result = applyAutoApproveUpgrade(original);
+    if (!result.ok) {
+        throw new HarnessExitError(`harness pack upgrade: ${result.error}`, EX_FAIL);
+    }
+    const diff = unifiedDiff({
+        fileName: path.basename(target),
+        oldText: original,
+        newText: result.text,
+        oldHeader: "current",
+        newHeader: "proposed",
+    });
+    if (!result.changed) {
+        return { path: target, name, diff, applied: false, alreadyPresent: true };
+    }
+    // Schema gate before ever touching disk, mirroring `pack add` / `pack
+    // reseed`: catches an insertion that would somehow produce an invalid
+    // manifest (e.g. a config: key this heuristic mis-located) before it
+    // reaches the operator's file.
+    const schemaResult = validateBeforeWrite(parseProposedYamlOrRefuse(result.text, name, "post-insertion validation"));
+    if (!schemaResult.ok) {
+        throw new HarnessExitError(`proposed manifest fails schema validation:\n${formatValidationErrors(schemaResult.errors)}`, EX_FAIL);
+    }
+    if (opts.dryRun) {
+        return { path: target, name, diff, applied: false, alreadyPresent: false };
+    }
+    const lockPath = path.join(path.dirname(target), LOCK_BASENAME);
+    // Review round 3, F4: whether the locked callback actually WROTE is
+    // tracked here rather than assumed. The pre-lock read above can be
+    // stale by the time the lock is acquired: if a concurrent writer
+    // already inserted the block, the callback below returns early
+    // (`recomputed.changed === false`) without writing anything, and the
+    // result reported to the caller/CLI must say so (`applied: false,
+    // alreadyPresent: true`, so `harness pack upgrade` prints the
+    // "already carries this upgrade" message) instead of the hardcoded
+    // `applied: true` this used to return unconditionally.
+    let wroteUnderLock = false;
+    await withFileLock(lockPath, () => {
+        // Re-read and recompute under the lock (mirrors `pack add`): a
+        // concurrent writer may have inserted the block (or changed the
+        // file entirely) between the pre-lock read above and now.
+        const current = fs.readFileSync(target, "utf8");
+        const recomputed = applyAutoApproveUpgrade(current);
+        if (!recomputed.ok) {
+            throw new HarnessExitError(`harness pack upgrade: ${recomputed.error}`, EX_FAIL);
+        }
+        if (!recomputed.changed)
+            return; // raced: someone else already inserted it
+        const recheck = validateBeforeWrite(parseProposedYamlOrRefuse(recomputed.text, name, "post-insertion validation after lock acquisition"));
+        if (!recheck.ok) {
+            throw new HarnessExitError(`proposed manifest fails schema validation after lock acquisition:\n${formatValidationErrors(recheck.errors)}`, EX_FAIL);
+        }
+        atomicWriteFile(target, recomputed.text);
+        wroteUnderLock = true;
+    });
+    return {
+        path: target,
+        name,
+        diff,
+        applied: wroteUnderLock,
+        alreadyPresent: !wroteUnderLock,
+    };
+}
+//# sourceMappingURL=upgrade.js.map

package/dist/cli/pack/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/cli/pack/upgrade.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,6DAA6D;AAC7D,2CAA2C;AAC3C,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,wEAAwE;AACxE,+DAA+D;AAC/D,mEAAmE;AACnE,wEAAwE;AACxE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,qEAAqE;AACrE,aAAa;AACb,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,8CAA8C;AAC9C,uEAAuE;AACvE,gEAAgE;AAChE,sEAAsE;AAEtE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sEAAsE,CAAC;AAChH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAqBzE,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,iBAAiB,CAAC,IAAwB;IACjD,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;AAC/C,CAAC;AAMD;;;;;;GAMG;AACH;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;IACxC,OAAO,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,iEAAiE;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAExC,sEAAsE;IACtE,oFAAoF;IACpF,kDAAkD;IAClD,uEAAuE;IACvE,gEAAgE;IAChE,sDAAsD;IACtD,MAAM,UAAU,GACd,kIAAkI,CAAC;IACrI,MAAM,WAAW,GAAwC,EAAE,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,+FAA+F;SAClG,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,SAAS,WAAW,CAAC,MAAM,gFAAgF;SACnH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAE/B,SAAS,YAAY,CAAC,QAAgB,EAAE,eAAuB;QAC7D,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,eAAe;gBAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EACH,0GAA0G;iBAC7G,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iFAAiF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,YAAY;YAAE,MAAM;QAClC,cAAc,GAAG,CAAC,CAAC;QACnB,8DAA8D;QAC9D,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,8CAA8C;QAC9C,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,kBAAkB,GAAG,IAAI,CAAC;IACrE,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,cAAc,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;IAC5E,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,OAAO,MACxG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,OAA2B,EAAE;IAE7B,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6FAA6F,EAC1J,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,MAAM,8BAA8B,EACrE,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,+BAA+B;IAC/B,MAAM,YAAY,GAAG,mBAAmB,CACtC,yBAAyB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAC1E,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAC5F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,8DAA8D;IAC9D,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,+DAA+D;QAC/D,gEAAgE;QAChE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,CAAC,0CAA0C;QAC3E,MAAM,OAAO,GAAG,mBAAmB,CACjC,yBAAyB,CACvB,UAAU,CAAC,IAAI,EACf,IAAI,EACJ,kDAAkD,CACnD,CACF,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACzC,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,cAAc;QACvB,cAAc,EAAE,CAAC,cAAc;KAChC,CAAC;AACJ,CAAC"}

package/dist/cli/record/index.d.ts

@@ -42,6 +42,14 @@ export interface RecordReviewOptions extends RecordCommonOptions {
     base?: string;
     /** Explicit branch override (otherwise resolved via resolveGitContext(cwd)). */
     branch?: string;
+    /**
+     * agent-tasks task id for the `review:<task-id>` tag the two task-scoped
+     * merge gates read (`review-before-task-merge` /
+     * `review-before-task-finish-automerge`, task 2699b476). Optional: the
+     * PR/branch/base tags are what the pull_requests_merge and `gh pr merge`
+     * gates read, and an operator on those surfaces has no task id to pass.
+     */
+    task?: string;
     /** Free-form review summary — required, non-empty. */
     summary: string;
 }

package/dist/cli/record/index.js

@@ -29,6 +29,11 @@ import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
 import { resolveReadSessionId, } from "../../runtime/session-id.js";
 import { EX_FAIL, EX_USAGE } from "../exit-codes.js";
 import { loadManifest } from "../loader.js";
+// U+2014 EM DASH, written as an escape so the literal never appears in
+// source. The emitted fact content is byte-identical to what `harness
+// record review` has always written; every gate reads the tags before it,
+// never this separator.
+const TAG_SUMMARY_SEPARATOR = "\u2014";
 const LEDGER_SOURCE_REVIEW = "harness-record-review";
 const LEDGER_SOURCE_REVIEW_SUBAGENT = "harness-record-review-subagent";
 const LEDGER_SOURCE_DOGFOOD = "harness-record-dogfood";
@@ -80,6 +85,20 @@ function initRecordVerb(opts, verbName) {
     };
     return { note, cwd: opts.cwd ?? process.cwd(), sessionId: resolveSession(opts) };
 }
+/**
+ * The one shared "this flag was misused" failure shape: warn on stderr and
+ * hand back the ready-to-`return` EX_USAGE `RecordResult`. Extracted when
+ * `optionalTagValue` (task 2699b476) grew the second copy of this
+ * five-line construction and the duplication fitness function
+ * (`scripts/check-duplication.mjs`) flagged it.
+ */
+function usageFailure(reason, sessionId, note) {
+    note(reason);
+    return {
+        ok: false,
+        result: { exitCode: EX_USAGE, wrote: false, content: "", sessionId, branch: "", reason },
+    };
+}
 /**
  * Trim `value` and refuse it if empty (a required flag / positional
  * argument left blank). Returns the ready-to-`return`ed EX_USAGE
@@ -90,12 +109,25 @@ function initRecordVerb(opts, verbName) {
 function requireNonEmpty(value, flagLabel, sessionId, note) {
     const trimmed = (value ?? "").trim();
     if (trimmed.length === 0) {
-        const reason = `${flagLabel} must not be empty`;
-        note(reason);
-        return {
-            ok: false,
-            result: { exitCode: EX_USAGE, wrote: false, content: "", sessionId, branch: "", reason },
-        };
+        return usageFailure(`${flagLabel} must not be empty`, sessionId, note);
+    }
+    return { ok: true, value: trimmed };
+}
+/**
+ * An OPTIONAL tag value: absent stays absent, present must be a non-empty
+ * token with no internal whitespace. The shape check is deliberately loose
+ * (task 2699b476): the id only namespaces a ledger tag, so anything the
+ * gate's `${TASK_ID}` substitution can compare against is acceptable, but
+ * a value carrying whitespace would split into two tags in the fact
+ * content and silently satisfy a gate keyed on the first half.
+ */
+function optionalTagValue(value, flagLabel, sessionId, note) {
+    if (value === undefined)
+        return { ok: true, value: undefined };
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || /\s/.test(trimmed)) {
+        return usageFailure(`${flagLabel} must be a non-empty value with no whitespace ` +
+            `(it namespaces one ledger tag); got ${JSON.stringify(value)}`, sessionId, note);
     }
     return { ok: true, value: trimmed };
 }
@@ -177,8 +209,24 @@ export async function runRecordReview(opts) {
     if (!branchResult.ok)
         return branchResult.result;
     const branch = branchResult.branch;
+    const taskResult = optionalTagValue(opts.task, "--task", sessionId, note);
+    if (!taskResult.ok)
+        return taskResult.result;
+    const task = taskResult.value;
     const base = resolveBase(cwd, opts.base, note);
-    const content = `review:${pr} review:${branch}${base ? ` review:${base}` : ""} — ${summary}`;
+    // One fact, every tag family a merge/PR gate can key on: the PR number,
+    // the working branch, the base branch, and (task 2699b476) the
+    // agent-tasks task id the two task-scoped merge gates read. Recording a
+    // review once therefore satisfies whichever surface actually fires,
+    // instead of asking the operator to predict it (docs/CLI.md, "The
+    // merge-surface trap"). TAG_SUMMARY_SEPARATOR keeps the emitted content
+    // byte-identical to what this verb has always written.
+    const tags = [`review:${pr}`, `review:${branch}`];
+    if (base !== undefined)
+        tags.push(`review:${base}`);
+    if (task !== undefined)
+        tags.push(`review:${task}`);
+    const content = `${tags.join(" ")} ${TAG_SUMMARY_SEPARATOR} ${summary}`;
     return finishRecordWrite(opts, sessionId, branch, LEDGER_SOURCE_REVIEW, content, note);
 }
 export async function runRecordReviewSubagent(opts) {

package/dist/cli/record/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/record/index.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,+DAA+D;AAC/D,gDAAgD;AAChD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AACnE,uEAAuE;AACvE,oEAAoE;AACpE,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,mCAAmC;AACnC,EAAE;AACF,qEAAqE;AACrE,kEAAkE;AAClE,wEAAwE;AACxE,gEAAgE;AAChE,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,6BAA6B;AAE7B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AACjG,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AACvE,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAsCvD,SAAS,cAAc,CAAC,IAAyB;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,OAAe;IAEf,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,mBAAmB,MAAM,MAAM,EAAE,CAAC;QAClF,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,IAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,KAAyB,EACzB,SAAiB,EACjB,SAAiB,EACjB,IAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,SAAS,oBAAoB,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,GAAW,EACX,cAAkC,EAClC,SAAiB,EACjB,IAA2B;IAE3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GACV,qGAAqG,CAAC;QACxG,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;SACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,MAAc,EACd,OAAe,EACf,IAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAW,EACX,YAAgC,EAChC,IAA2B;IAE3B,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,CACF,iEAAiE;QAC/D,6EAA6E;QAC7E,+CAA+C,CAClD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE1B,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,EAAE,WAAW,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;IAE7F,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACzF,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAiC;IAEjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAE9B,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEnC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,mBAAmB,IAAI,oBAAoB,MAAM,YAAY,OAAO,GAClF,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;IAEH,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,SAAS,MAAM,OAAO,EAAE,CAAC;IAEpD,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/record/index.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,+DAA+D;AAC/D,gDAAgD;AAChD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AACnE,uEAAuE;AACvE,oEAAoE;AACpE,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,mCAAmC;AACnC,EAAE;AACF,qEAAqE;AACrE,kEAAkE;AAClE,wEAAwE;AACxE,gEAAgE;AAChE,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,6BAA6B;AAE7B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AACjG,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,wBAAwB;AACxB,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAEvC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AACvE,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAsCvD,SAAS,cAAc,CAAC,IAAyB;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,OAAe;IAEf,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,mBAAmB,MAAM,MAAM,EAAE,CAAC;QAClF,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,IAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAc,EACd,SAAiB,EACjB,IAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;KACzF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,KAAyB,EACzB,SAAiB,EACjB,SAAiB,EACjB,IAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,GAAG,SAAS,oBAAoB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,KAAyB,EACzB,SAAiB,EACjB,SAAiB,EACjB,IAA2B;IAE3B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CACjB,GAAG,SAAS,gDAAgD;YAC1D,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAChE,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,GAAW,EACX,cAAkC,EAClC,SAAiB,EACjB,IAA2B;IAE3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GACV,qGAAqG,CAAC;QACxG,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;SACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,MAAc,EACd,OAAe,EACf,IAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAW,EACX,YAAgC,EAChC,IAA2B;IAE3B,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,CACF,iEAAiE;QAC/D,6EAA6E;QAC7E,+CAA+C,CAClD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE1B,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,wEAAwE;IACxE,+DAA+D;IAC/D,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,qBAAqB,IAAI,OAAO,EAAE,CAAC;IAExE,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACzF,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAiC;IAEjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAE9B,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEnC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,mBAAmB,IAAI,oBAAoB,MAAM,YAAY,OAAO,GAClF,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,EACzC,EAAE,CAAC;IAEH,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;IAEpC,MAAM,OAAO,GAAG,WAAW,SAAS,MAAM,OAAO,EAAE,CAAC;IAEpD,OAAO,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC"}

package/dist/cli/validate/checks.js

@@ -10,7 +10,7 @@ import { PACK_NAME as UNDERSTANDING_BEFORE_EXECUTION_PACK_NAME } from "../../pol
 import { isMeasuredPermissionModeFor, measuredPermissionModeLiteralsFor, } from "../../policy-packs/builtin/understanding-before-execution/measured-permission-modes.js";
 import { AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, } from "../../policy-packs/builtin/understanding-before-execution/auto-approve.js";
 import { DEFAULT_SAFE_DELETION_ROOTS } from "../../schema/risk.js";
-import { deriveWorkflowGatePolicies, findWeakGatePolicyOverlaps, handAuthoredPolicies, MERGE_BASH_MATCH, MERGE_MCP_MATCH, REVIEW_EVIDENCE_HOOK_BASH, REVIEW_EVIDENCE_HOOK_MCP, workflowRequiresMergeGate, } from "../../runtime/workflow-policies.js";
+import { deriveWorkflowGatePolicies, findWeakGatePolicyOverlaps, handAuthoredPolicies, MERGE_BASH_MATCH, MERGE_MCP_MATCH, REVIEW_EVIDENCE_HOOK_BASH, REVIEW_EVIDENCE_HOOK_MCP, REVIEW_EVIDENCE_HOOK_TASK_FINISH, REVIEW_EVIDENCE_HOOK_TASK_MERGE, workflowRequiresMergeGate, } from "../../runtime/workflow-policies.js";
 const DEFAULT_RUNTIME_BUILTINS = [
     "Read",
     "Edit",
@@ -344,17 +344,69 @@ export function checkWorkflowGateWiring(manifest) {
     if (missing.length > 0) {
         problems.unshift(`hooks[] is missing ${missing.join(" and ")}`);
     }
-    if (problems.length === 0)
+    const errors = problems.length === 0
+        ? []
+        : offending.map((wf) => ({
+            severity: "error",
+            path: "workflows",
+            message: `workflow "${wf.name}" declares a review_subagent step with spawn: "required" ` +
+                `followed by a merge step, but the runtime merge gate is not wired: ${problems.join("; ")}. ` +
+                "Without both hooks correctly wired, harness policy intercept never derives this " +
+                "workflow's merge-gate policy and the merge is NOT blocked (silent non-enforcement). " +
+                "See docs/for-agents.md, or src/cli/init/templates.ts's require-review-evidence / " +
+                'require-review-evidence-bash entries, or drop spawn: "required".',
+        }));
+    return [...errors, ...checkTaskVerbGateWiring(manifest, offending)];
+}
+/**
+ * MEDIUM security (review round 1, task 2699b476 round 2): a manifest can
+ * wire the ORIGINAL pair of review-evidence hooks
+ * (`require-review-evidence` / `require-review-evidence-bash`, gating
+ * `mcp__agent-tasks__pull_requests_merge` and `gh pr merge`) without ever
+ * adding the two task-scoped ones task 2699b476 introduced
+ * (`require-review-evidence-task-merge` / `require-review-evidence-task-finish`,
+ * gating `mcp__agent-tasks__task_merge` and `task_finish { autoMerge: true }`).
+ * `deriveWorkflowGatePolicies` derives the task-scoped gate ONLY when its
+ * own hook is present (same "quietly returns nothing" shape
+ * `checkWorkflowGateWiring` already guards for the original pair), so a
+ * manifest predating that task keeps the two newer verbs completely
+ * uncovered: a PR can be merged via `task_merge` or an auto-merging
+ * `task_finish` with no recorded review at all, while `harness validate`
+ * stayed silent about it. This is a `warning`, not an `error`, because the
+ * ORIGINAL surfaces (`pull_requests_merge`, `gh pr merge`) are still
+ * enforced when this fires: the gap is narrower than the fully-unwired
+ * case above, but still silent non-enforcement for the two verbs it names.
+ */
+function checkTaskVerbGateWiring(manifest, offending) {
+    const mcpHook = manifest.hooks.find((h) => h.name === REVIEW_EVIDENCE_HOOK_MCP);
+    const bashHook = manifest.hooks.find((h) => h.name === REVIEW_EVIDENCE_HOOK_BASH);
+    if (!mcpHook || !bashHook)
+        return [];
+    const taskMergeHook = manifest.hooks.find((h) => h.name === REVIEW_EVIDENCE_HOOK_TASK_MERGE);
+    const taskFinishHook = manifest.hooks.find((h) => h.name === REVIEW_EVIDENCE_HOOK_TASK_FINISH);
+    const uncoveredVerbs = [];
+    const missingHookNames = [];
+    if (!taskMergeHook) {
+        uncoveredVerbs.push("mcp__agent-tasks__task_merge");
+        missingHookNames.push(`"${REVIEW_EVIDENCE_HOOK_TASK_MERGE}"`);
+    }
+    if (!taskFinishHook) {
+        uncoveredVerbs.push("mcp__agent-tasks__task_finish (autoMerge: true)");
+        missingHookNames.push(`"${REVIEW_EVIDENCE_HOOK_TASK_FINISH}"`);
+    }
+    if (uncoveredVerbs.length === 0)
         return [];
     return offending.map((wf) => ({
-        severity: "error",
+        severity: "warning",
         path: "workflows",
-        message: `workflow "${wf.name}" declares a review_subagent step with spawn: "required" ` +
-            `followed by a merge step, but the runtime merge gate is not wired: ${problems.join("; ")}. ` +
-            "Without both hooks correctly wired, harness policy intercept never derives this " +
-            "workflow's merge-gate policy and the merge is NOT blocked (silent non-enforcement). " +
-            "See docs/for-agents.md, or src/cli/init/templates.ts's require-review-evidence / " +
-            'require-review-evidence-bash entries, or drop spawn: "required".',
+        message: `workflow "${wf.name}" wires the review-evidence gate for mcp__agent-tasks__pull_requests_merge ` +
+            `and gh pr merge, but not for ${uncoveredVerbs.join(" or ")}: ` +
+            `hooks[] is missing ${missingHookNames.join(" and ")}. ` +
+            "Without them harness policy intercept never derives the task-scoped merge gate (task 2699b476) " +
+            "and a PR can be merged through those verbs with no recorded review, even though the original " +
+            "pull_requests_merge / gh pr merge surfaces are still gated. See docs/for-agents.md, or " +
+            "src/cli/init/templates.ts's require-review-evidence-task-merge / " +
+            "require-review-evidence-task-finish entries.",
     }));
 }
 /**