@lannguyensi/harness 0.52.0 → 0.54.0

package/dist/policy-packs/builtin/understanding-before-execution/delegation-markers.js

@@ -54,6 +54,36 @@ import { sha256Hex, signMarker, signingKeyExists, signingKeyPathFor, verifyMarke
 import { rejectMalformedSessionId } from "../../../runtime/reject-malformed-session-id.js";
 /** Directory holding delegation markers, a sibling of `.approvals/` under `generatedDir`. */
 export const DELEGATION_MARKER_DIRNAME = ".delegations";
+/**
+ * Directory holding the per-child ADOPTED-ENTRY ledgers (once-per-session
+ * transcript-capture bookkeeping written by the PreToolUse hook,
+ * `hook-pre-tool-use.ts`), a SIBLING of `.delegations/` itself rather than
+ * a subdirectory of it: `<generatedDir>/.delegation-adoptions/<sid>`.
+ *
+ * Defined here (not in `hook-pre-tool-use.ts`, the only writer) so that a
+ * reader that never writes a ledger, such as `harness gc`'s delegation
+ * sweep, can name the directory without importing a `cli/` module: this
+ * file already owns `DELEGATION_MARKER_DIRNAME`, the sibling constant an
+ * adoption-ledger reader also needs, and both dirnames traveling together
+ * keeps `.delegations/` and its ledger sibling from drifting apart.
+ */
+export const ADOPTION_LEDGER_DIRNAME = ".delegation-adoptions";
+/**
+ * Directory holding the CONVENTIONAL launcher-report copies for the
+ * `--report` fallback shape, a SIBLING of `.delegations/` and
+ * `.delegation-adoptions/` (same reasoning: a reader that only needs the
+ * path convention, such as a future gc sweep, has no business importing
+ * the CLI module that writes into it). `harness delegate --report` copies
+ * the operator's file here, at `<childSessionId>.md`, and the child's own
+ * PreToolUse hook reads back from exactly this path (never the operator's
+ * original `--report` argument, which the hook has no way to learn): the
+ * conventional path is what lets both sides derive the SAME location from
+ * nothing but the child session id, closing the gap that used to leave a
+ * report-bound delegation issued and signature-verifiable but never
+ * actually checked against a file (agent-tasks 49d1ee41, follow-up to
+ * slice 3, agent-tasks 37ad0b05).
+ */
+export const DELEGATION_REPORT_DIRNAME = ".delegation-reports";
 /** Prefix of the signed markerId, mirroring `task-<id>` for task markers. */
 const DELEGATION_MARKER_ID_PREFIX = "delegation-";
 /** The `approvedBy` segment carrying the parent linkage. Colon-separated, unlike the `key=value` segments after it. */
@@ -88,6 +118,21 @@ export function delegationMarkerPathFor(generatedDir, childSessionId) {
     rejectMalformedSessionId(childSessionId);
     return path.join(generatedDir, DELEGATION_MARKER_DIRNAME, childSessionId);
 }
+/**
+ * Filesystem path of a child session's CONVENTIONAL launcher-report copy:
+ * `<generatedDir>/.delegation-reports/<childSessionId>.md`. Always `.md`,
+ * regardless of the extension the operator's original `--report` file
+ * carried: the point of the convention is that both `harness delegate`
+ * (the writer) and the child's PreToolUse hook (the reader) derive the
+ * SAME path from nothing but the child session id, so a preserved
+ * extension would only reintroduce a value the hook has no way to learn.
+ * Rejects a malformed session id the same way {@link delegationMarkerPathFor}
+ * does (the value lands in a `path.join` verbatim).
+ */
+export function delegationReportPathFor(generatedDir, childSessionId) {
+    rejectMalformedSessionId(childSessionId);
+    return path.join(generatedDir, DELEGATION_REPORT_DIRNAME, `${childSessionId}.md`);
+}
 /**
  * sha256 hex of a filesystem path, canonicalized through `realpathSync`
  * when the path exists and through `path.resolve` when it does not.
@@ -580,6 +625,10 @@ export function verifyDelegation(opts) {
             };
         }
     }
+    // Set only inside the `reportPathHash !== undefined` branch below, and
+    // only after the content hash has matched: the exact bytes returned to
+    // the caller in the ok shape's `reportContent`.
+    let reportContent;
     if (reportPathHash !== undefined) {
         if (opts.launcherReportPath === undefined) {
             return {
@@ -620,6 +669,11 @@ export function verifyDelegation(opts) {
                 detail: `launcher-supplied report at ${opts.launcherReportPath} does not match the bound content hash (bound ${boundContentHash}, got ${actualContentHash})`,
             };
         }
+        // The exact bytes this call just hashed and matched against the
+        // bound hash: returned so the caller persists THESE bytes rather
+        // than opening the file a second time (a second read would be a
+        // second trust decision, and the very race this closes).
+        reportContent = reportRead.content;
     }
     return {
         ok: true,
@@ -627,7 +681,7 @@ export function verifyDelegation(opts) {
         expiresAt,
         boundCwdHash: cwdHash,
         boundTaskId: taskId,
-        ...(reportPathHash !== undefined ? { reportPathHash } : {}),
+        ...(reportPathHash !== undefined ? { reportPathHash, reportContent: reportContent } : {}),
     };
 }
 //# sourceMappingURL=delegation-markers.js.map

package/dist/policy-packs/builtin/understanding-before-execution/delegation-markers.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-markers.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/delegation-markers.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,0DAA0D;AAC1D,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,oEAAoE;AACpE,0EAA0E;AAC1E,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,6DAA6D;AAC7D,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,6DAA6D;AAC7D,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,SAAS;AACT,EAAE;AACF,sFAAsF;AACtF,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uDAAuD;AAEvD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAExD,6EAA6E;AAC7E,MAAM,2BAA2B,GAAG,aAAa,CAAC;AAElD,uHAAuH;AACvH,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAE9C,iGAAiG;AACjG,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,0EAA0E;AAC1E,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,mEAAmE;AACnE,yEAAyE;AACzE,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,OAAO,GAAG,2BAA2B,GAAG,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,cAAsB;IAClF,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAeD,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,0DAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa;IACvD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAkC;IAC1E,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAC/E,wDAAwD;IACxD,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAC1C,wBAAwB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,IAAI;QAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS;QAAE,eAAe,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG;QACf,GAAG,wBAAwB,GAAG,eAAe,EAAE;QAC/C,OAAO,OAAO,IAAI,OAAO,EAAE;QAC3B,QAAQ,MAAM,IAAI,OAAO,EAAE;QAC3B,WAAW,SAAS,EAAE;KACvB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAmB;IAC3D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,6CAA6C,OAAO,UAAU,GAAG;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,eAAmC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACjD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;YACtE,CAAC;YACD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,+DAA+D;YAC/D,uDAAuD;YACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,0DAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;iBAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,sDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,KAAK,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,KAAK;gBACR,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;gBAClF,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACpF,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;gBAC1F,UAAU,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;gBACxF,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR;gBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC/F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAClF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAExF,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yCAAyC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACzD,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EACJ,kJAAkJ;SACrJ,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3E,UAAU,GAAG,yBAAyB,CAAC;YACrC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,IAAI,CAAC,YAAY,CAClB,2GAA2G;SAC7G,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;QACrD,UAAU;QACV,UAAU;QACV,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAClE,CAAC;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,qEAAqE;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,iDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,QAAQ,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,wDAAwD,QAAQ,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,iDAAiD,QAAQ,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,wBAAwB,QAAQ,6GAA6G;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gDAAgD,QAAQ,uBAAuB;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAE/C,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,yBAAyB,iBAAiB,CAChD,YAAY,CACb,uBAAuB,QAAQ,+FAA+F;SAChI,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,+DAA+D;YAC/D,4CAA4C;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,iBAAiB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,EAAE;aAClF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wCAAwC,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;SACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,iBAAiB,QAAQ,mCAAmC,QAAQ,CAAC,MAAM,EAAE;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEvF,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,iBAAiB,QAAQ,wEAAwE;SAC1G,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,oEAAoE;IACpE,+DAA+D;IAC/D,uEAAuE;IACvE,iEAAiE;IACjE,yEAAyE;IACzE,6BAA6B;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5B,CAAC,CAAC,iBAAiB,QAAQ,eAAe,SAAS,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG;gBAC5F,CAAC,CAAC,iBAAiB,QAAQ,mFAAmF,KAAK,GAAG;SACzH,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,iBAAiB,QAAQ,iDAAiD;aACnF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,iBAAiB,QAAQ,uCAAuC,OAAO,SAAS,MAAM,QAAQ,IAAI,CAAC,GAAG,GAAG;aAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,iBAAiB,QAAQ,qBAAqB,MAAM,+BAA+B;aAC5F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,iBAAiB,QAAQ,qBAAqB,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,iBAAiB,QAAQ,kEAAkE;aACpG,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,iBAAiB,QAAQ,8CAA8C,cAAc,SAAS,cAAc,QAAQ,IAAI,CAAC,kBAAkB,GAAG;aACvJ,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,mBAAmB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,iBAAiB,QAAQ,mFAAmF;aACrH,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,+BAA+B,IAAI,CAAC,kBAAkB,uBAAuB,UAAU,CAAC,IAAI,yDAAyD;aAC9J,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,+BAA+B,IAAI,CAAC,kBAAkB,iDAAiD,gBAAgB,SAAS,iBAAiB,GAAG;aAC7J,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,eAAe;QACf,SAAS;QACT,YAAY,EAAE,OAAO;QACrB,WAAW,EAAE,MAAM;QACnB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegation-markers.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/delegation-markers.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,0DAA0D;AAC1D,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,oEAAoE;AACpE,0EAA0E;AAC1E,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,6DAA6D;AAC7D,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,6DAA6D;AAC7D,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,SAAS;AACT,EAAE;AACF,sFAAsF;AACtF,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uDAAuD;AAEvD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,2BAA2B,GAAG,aAAa,CAAC;AAElD,uHAAuH;AACvH,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAE9C,iGAAiG;AACjG,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,0EAA0E;AAC1E,uEAAuE;AACvE,4DAA4D;AAC5D,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,mEAAmE;AACnE,yEAAyE;AACzE,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,OAAO,GAAG,2BAA2B,GAAG,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,cAAsB;IAClF,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,cAAsB;IAClF,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,EAAE,GAAG,cAAc,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAeD,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,0DAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa;IACvD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAkC;IAC1E,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAC/E,wDAAwD;IACxD,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAC1C,wBAAwB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,IAAI;QAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS;QAAE,eAAe,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG;QACf,GAAG,wBAAwB,GAAG,eAAe,EAAE;QAC/C,OAAO,OAAO,IAAI,OAAO,EAAE;QAC3B,QAAQ,MAAM,IAAI,OAAO,EAAE;QAC3B,WAAW,SAAS,EAAE;KACvB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAmB;IAC3D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,6CAA6C,OAAO,UAAU,GAAG;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,eAAmC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACjD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;YACtE,CAAC;YACD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,+DAA+D;YAC/D,uDAAuD;YACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,0DAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;iBAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,sDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,KAAK,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,KAAK;gBACR,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;gBAClF,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACpF,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;gBAC1F,UAAU,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;gBACxF,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR;gBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC/F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAClF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAExF,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yCAAyC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACzD,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EACJ,kJAAkJ;SACrJ,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3E,UAAU,GAAG,yBAAyB,CAAC;YACrC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,IAAI,CAAC,YAAY,CAClB,2GAA2G;SAC7G,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;QACrD,UAAU;QACV,UAAU;QACV,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAClE,CAAC;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE9C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,qEAAqE;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,iDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,QAAQ,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,wDAAwD,QAAQ,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,iDAAiD,QAAQ,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,wBAAwB,QAAQ,6GAA6G;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gDAAgD,QAAQ,uBAAuB;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAE/C,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,yBAAyB,iBAAiB,CAChD,YAAY,CACb,uBAAuB,QAAQ,+FAA+F;SAChI,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,+DAA+D;YAC/D,4CAA4C;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,iBAAiB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,EAAE;aAClF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wCAAwC,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;SACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,iBAAiB,QAAQ,mCAAmC,QAAQ,CAAC,MAAM,EAAE;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEvF,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,iBAAiB,QAAQ,wEAAwE;SAC1G,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,oEAAoE;IACpE,+DAA+D;IAC/D,uEAAuE;IACvE,iEAAiE;IACjE,yEAAyE;IACzE,6BAA6B;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5B,CAAC,CAAC,iBAAiB,QAAQ,eAAe,SAAS,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG;gBAC5F,CAAC,CAAC,iBAAiB,QAAQ,mFAAmF,KAAK,GAAG;SACzH,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,iBAAiB,QAAQ,iDAAiD;aACnF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,iBAAiB,QAAQ,uCAAuC,OAAO,SAAS,MAAM,QAAQ,IAAI,CAAC,GAAG,GAAG;aAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,iBAAiB,QAAQ,qBAAqB,MAAM,+BAA+B;aAC5F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,iBAAiB,QAAQ,qBAAqB,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,aAAiC,CAAC;IACtC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,iBAAiB,QAAQ,kEAAkE;aACpG,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;YACtC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,iBAAiB,QAAQ,8CAA8C,cAAc,SAAS,cAAc,QAAQ,IAAI,CAAC,kBAAkB,GAAG;aACvJ,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,mBAAmB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,iBAAiB,QAAQ,mFAAmF;aACrH,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,+BAA+B,IAAI,CAAC,kBAAkB,uBAAuB,UAAU,CAAC,IAAI,yDAAyD;aAC9J,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EAAE,+BAA+B,IAAI,CAAC,kBAAkB,iDAAiD,gBAAgB,SAAS,iBAAiB,GAAG;aAC7J,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,yDAAyD;QACzD,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC;IACrC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,eAAe;QACf,SAAS;QACT,YAAY,EAAE,OAAO;QACrB,WAAW,EAAE,MAAM;QACnB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,aAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/index.d.ts

@@ -9,7 +9,9 @@ export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, type ApprovalMarker, wr
 export { type PersistedReport, REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, type FindReportOptions, type FindReportSelection, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, type PersistedReportEvidence, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
 export { type ApprovalLifecycle, parseApprovalLifecycle } from "./lifecycle.js";
 export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, type ParsedAutoApprovedBy, parseAutoApprovedBy, autoApprovedLedgerTagFor, type AutoApproveConfig, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, DEFAULT_REPORT_SCAN_MAX_WAIT_MS, REPORT_SCAN_MAX_WAIT_CEILING_MS, parseReportScanMaxWait, } from "./auto-approve.js";
+export { type AutoApproveDefaultConfig, defaultAutoApproveConfig, renderAutoApproveSnippet, } from "./auto-approve-default.js";
+export { PERMISSION_MODE_OBSERVATION_DIRNAME, listPermissionModeObservations, permissionModeObservationPathFor, recordPermissionModeObservation, sanitizeForDisplay, type PermissionModeObservation, type PermissionModeObservationsResult, } from "./permission-mode-observations.js";
 export { APPROVAL_MARKER_TASK_PREFIX, taskApprovalMarkerPathFor, writeTaskApprovalMarker, checkActiveClaimApprovalMarker, type OperatorMarkerApproval, checkOperatorApprovalMarkers, clearTaskApprovalMarker, } from "./task-markers.js";
 export { DEFAULT_BASH_TOOL_NAMES, toolNameMatchesAny, bashCommandMatchesAny, extractBashCommandFromToolInput, extractTaskIdFromToolInput, extractTasksTransitionStatusFromToolInput, type PostToolUseBoundaryMatch, matchPostToolUseBoundary, type ApplyPostToolUseExpiryResult, applyPostToolUseExpiry, describePostToolUseExpiry, } from "./post-tool-use-boundary.js";
 export { ACTIVE_CLAIM_FILENAME, activeClaimPathFor, writeActiveClaim, readActiveClaim, clearActiveClaim, } from "./active-claim.js";
-export { DELEGATION_MARKER_DIRNAME, delegationMarkerIdFor, delegationMarkerPathFor, hashDelegationCwd, type DelegationApprovedByFields, buildDelegationApprovedBy, type ParsedDelegationApprovedBy, type DelegationApprovedByParse, parseDelegationApprovedBy, type WriteDelegationMarkerOptions, type WriteDelegationMarkerResult, writeDelegationMarker, type DelegationRefusalReason, type DelegationVerification, type VerifyDelegationOptions, verifyDelegation, } from "./delegation-markers.js";
+export { DELEGATION_MARKER_DIRNAME, ADOPTION_LEDGER_DIRNAME, DELEGATION_REPORT_DIRNAME, delegationMarkerIdFor, delegationMarkerPathFor, delegationReportPathFor, hashDelegationCwd, type DelegationApprovedByFields, buildDelegationApprovedBy, type ParsedDelegationApprovedBy, type DelegationApprovedByParse, parseDelegationApprovedBy, type WriteDelegationMarkerOptions, type WriteDelegationMarkerResult, writeDelegationMarker, type DelegationRefusalReason, type DelegationVerification, type VerifyDelegationOptions, verifyDelegation, } from "./delegation-markers.js";

package/dist/policy-packs/builtin/understanding-before-execution/index.js

@@ -40,6 +40,23 @@ export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, writeApprovalMarker, ch
 export { REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, expirePersistedReport, checkPersistedReport, } from "./persisted-reports.js";
 export { parseApprovalLifecycle } from "./lifecycle.js";
 export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, parseAutoApprovedBy, autoApprovedLedgerTagFor, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, DEFAULT_REPORT_SCAN_MAX_WAIT_MS, REPORT_SCAN_MAX_WAIT_CEILING_MS, parseReportScanMaxWait, } from "./auto-approve.js";
+// D-004 shipped default (task 8f637efd): the one `auto_approve` snippet
+// `harness init`, `harness pack upgrade understanding-before-execution`
+// and `harness doctor`'s missing-auto_approve finding all render from,
+// see auto-approve-default.ts's module header for why.
+//
+// `AUTO_APPROVE_DEFAULT_WHEN`, `AUTO_APPROVE_DEFAULT_HARNESSES`, and
+// `AUTO_APPROVE_COMMENT_LINES` are deliberately NOT re-exported here
+// (review round 2 F7): every caller outside this module wants the
+// already-assembled `defaultAutoApproveConfig()` / `renderAutoApproveSnippet()`,
+// never the three raw pieces; grepped before dropping them (task
+// 8f637efd, review round 2) and confirmed no consumer outside
+// auto-approve-default.ts itself used the bare re-export.
+export { defaultAutoApproveConfig, renderAutoApproveSnippet, } from "./auto-approve-default.js";
+// Hook-side `permission_mode` observation feeding `harness doctor`'s
+// missing-`auto_approve` finding (task 8f637efd), see
+// permission-mode-observations.ts's module header.
+export { PERMISSION_MODE_OBSERVATION_DIRNAME, listPermissionModeObservations, permissionModeObservationPathFor, recordPermissionModeObservation, sanitizeForDisplay, } from "./permission-mode-observations.js";
 export { APPROVAL_MARKER_TASK_PREFIX, taskApprovalMarkerPathFor, writeTaskApprovalMarker, checkActiveClaimApprovalMarker, checkOperatorApprovalMarkers, clearTaskApprovalMarker, } from "./task-markers.js";
 export { DEFAULT_BASH_TOOL_NAMES, toolNameMatchesAny, bashCommandMatchesAny, extractBashCommandFromToolInput, extractTaskIdFromToolInput, extractTasksTransitionStatusFromToolInput, matchPostToolUseBoundary, applyPostToolUseExpiry, describePostToolUseExpiry, } from "./post-tool-use-boundary.js";
 export { ACTIVE_CLAIM_FILENAME, activeClaimPathFor, writeActiveClaim, readActiveClaim, clearActiveClaim, } from "./active-claim.js";
@@ -50,5 +67,5 @@ export { ACTIVE_CLAIM_FILENAME, activeClaimPathFor, writeActiveClaim, readActive
 // delegation-markers.ts for why). Exported through the shim because the
 // slice's later consumers (the `harness delegate` verb and the child's
 // PreToolUse hook) import every sibling gate symbol through it.
-export { DELEGATION_MARKER_DIRNAME, delegationMarkerIdFor, delegationMarkerPathFor, hashDelegationCwd, buildDelegationApprovedBy, parseDelegationApprovedBy, writeDelegationMarker, verifyDelegation, } from "./delegation-markers.js";
+export { DELEGATION_MARKER_DIRNAME, ADOPTION_LEDGER_DIRNAME, DELEGATION_REPORT_DIRNAME, delegationMarkerIdFor, delegationMarkerPathFor, delegationReportPathFor, hashDelegationCwd, buildDelegationApprovedBy, parseDelegationApprovedBy, writeDelegationMarker, verifyDelegation, } from "./delegation-markers.js";
 //# sourceMappingURL=index.js.map

package/dist/policy-packs/builtin/understanding-before-execution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AActE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAEjB,mBAAmB,EACnB,wBAAwB,EAExB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAE9B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAEjB,yBAAyB,EAGzB,yBAAyB,EAGzB,qBAAqB,EAIrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AActE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAEjB,mBAAmB,EACnB,wBAAwB,EAExB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,iFAAiF;AACjF,iEAAiE;AACjE,8DAA8D;AAC9D,0DAA0D;AAC1D,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,qEAAqE;AACrE,sDAAsD;AACtD,mDAAmD;AACnD,OAAO,EACL,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,EAC/B,kBAAkB,GAGnB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAE9B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EAEjB,yBAAyB,EAGzB,yBAAyB,EAGzB,qBAAqB,EAIrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/permission-mode-observations.d.ts

@@ -0,0 +1,71 @@
+export declare const PERMISSION_MODE_OBSERVATION_DIRNAME = ".permission-mode-observations";
+export interface PermissionModeObservation {
+    sessionId: string;
+    permissionMode: string;
+    observedAt: string;
+}
+/**
+ * `sessionId` is validated with the SAME `rejectMalformedSessionId` used
+ * for the approval marker path (`markers.ts`'s `approvalMarkerPathFor`):
+ * a value carrying `/`, `\`, `..`, or that is empty/blank throws rather
+ * than being joined into the path (review round 3, F1: the earlier
+ * version of this function trusted the caller's own empty-string check
+ * and joined `sessionId` verbatim, letting a crafted `session_id` on the
+ * hook's stdin write outside `<generatedDir>/.permission-mode-observations/`).
+ */
+export declare function permissionModeObservationPathFor(generatedDir: string, sessionId: string): string;
+/**
+ * Best-effort write/update of the per-session observation.
+ *
+ * `permissionMode` must be a non-empty string; any other shape (absent,
+ * non-string, empty) is a silent no-op: there is nothing to observe.
+ * `sessionId` is NOT trusted as pre-validated (review round 3, F1): the
+ * caller (`hook-pre-tool-use.ts`) only rejects an EMPTY session id
+ * before this is reached, and `session_id` on the hook's stdin payload
+ * is otherwise attacker-controllable input to a CLI invocation, not a
+ * value this function may assume is already path-safe. A malformed id
+ * (path separators, `..`, blank) makes `permissionModeObservationPathFor`
+ * throw; that throw is treated exactly like any other write failure
+ * below: one `stderr` warning, never escalated into a block, never
+ * thrown out of this function.
+ */
+export declare function recordPermissionModeObservation(generatedDir: string, sessionId: string, permissionMode: unknown, stderr: {
+    write(s: string): unknown;
+}, now?: () => Date): void;
+export interface PermissionModeObservationsResult {
+    /** Whether `<generatedDir>/.permission-mode-observations/` exists at all. */
+    dirPresent: boolean;
+    /** Newest `windowSize` readable observations, newest `observedAt` first. */
+    entries: PermissionModeObservation[];
+    /** Files present but unparseable / missing a required field. */
+    unreadableCount: number;
+}
+/**
+ * Strip C0/DEL control characters (including ESC, which could otherwise
+ * smuggle an ANSI escape sequence into a terminal) and cap the length,
+ * mirroring `persisted-reports.ts`'s `sanitizeDetailValue` for the same
+ * reason: `bypass-without-auto-approve.ts` embeds an observation's
+ * `sessionId` directly into a doctor finding's `message`, the surface an
+ * operator reads (review round 3, F1). This is independent of
+ * `permissionModeObservationPathFor`'s write-time
+ * `rejectMalformedSessionId` guard: that guard rejects path-traversal
+ * shapes, not control characters, and a directory entry's on-disk
+ * filename (or the `sessionId` field inside it) is never itself
+ * constrained to be display-safe: POSIX filenames may contain any byte
+ * but `/` and NUL, and the JSON body's `sessionId` field is a plain
+ * string with no such constraint either.
+ */
+export declare function sanitizeForDisplay(value: string): string;
+/**
+ * Read-side: the newest `windowSize` per-session observations, newest
+ * first by `observedAt`. Mirrors `ug-auto-approvals.ts`'s own
+ * read-and-window convention (missing dir / empty dir / all-unreadable
+ * all resolve to an empty-ish result, never throw: this is a doctor
+ * read, not a gate decision). Every returned `sessionId` has already
+ * been through {@link sanitizeForDisplay}, so every consumer (today,
+ * `bypass-without-auto-approve.ts`'s finding `message`) gets a
+ * doctor-output-safe value without having to sanitize it itself.
+ */
+export declare function listPermissionModeObservations(generatedDir: string, opts: {
+    windowSize: number;
+}): PermissionModeObservationsResult;

package/dist/policy-packs/builtin/understanding-before-execution/permission-mode-observations.js

@@ -0,0 +1,175 @@
+// Hook-side observation of PreToolUse `permission_mode` (task 8f637efd,
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md's "Amendment:
+// install default"). One small per-session record under
+// `<generatedDir>/.permission-mode-observations/<sessionId>`.
+//
+// WHY A NEW ARTEFACT, NOT THE LEDGER OR THE PERSISTED REPORT. `harness
+// doctor`'s missing-`auto_approve` finding needs to know whether a
+// session actually ran under `bypassPermissions`, and the evidence-ledger
+// trust boundary this pack already enforces for approval
+// (docs/okf/evidence-ledger-trust-boundary.md) applies here too: a fact
+// the AGENT can write (a ledger row, a report field) proves nothing about
+// what the harness process observed. `permission_mode` on the PreToolUse
+// payload is a T1 signal (composed by Claude Code itself, not by the
+// model: same trust class the auto-approval path already relies on,
+// see the ADR's "Signal sources per harness" table), so the write side
+// here is the SAME hook, at the SAME point in its decision order, using
+// the SAME field. The record carries no payload content beyond the
+// mode itself: (sessionId, permissionMode, observedAt), nothing else.
+//
+// WHERE IT IS WRITTEN. `hook-pre-tool-use.ts` calls
+// `recordPermissionModeObservation` once per PreToolUse invocation that
+// reaches the same point `attemptAutoApproval` already runs at
+// (auto-approve-path.ts's module header explains why that point matters:
+// every call that reaches it has already been declined by the signed
+// marker check, the read-only Bash exemption, the recovery-commit
+// exemption, and the escape `ask`: so it is exactly the call that would
+// otherwise need approval). A session whose first tool call already
+// matches a still-valid marker never reaches this point and is therefore
+// never observed for that session; this is an accepted coverage gap
+// (documented at the call site), not a silent failure: the finding this
+// feeds targets the ADR's Mac-mini incident shape (a marker EXPIRED or
+// never existed, the call fell through to the block/auto-approve
+// attempt, and `permission_mode` WAS on the payload at that instant),
+// not perfect per-session coverage.
+//
+// FAIL-OPEN ON WRITE ERRORS. A failed write is one stderr warning line,
+// never escalated into a block: this is telemetry for `harness doctor`,
+// never a gate input, and the write happens on the same fail-open
+// posture every other best-effort write in this pack already uses
+// (`writePendingApproval`, the marker writers).
+//
+// UNSIGNED: ADVISORY ONLY, NOT PROOF (review round 3, F2). Unlike the
+// approval marker (`markers.ts`), this record is NOT HMAC-signed. It is
+// written by the hook PROCESS from whatever `session_id`/`permission_mode`
+// appear on the invocation's PreToolUse payload; that only proves the
+// hook was invoked with that payload, not that any particular session
+// actually ran under that mode: an already-approved session (or anything
+// else able to invoke `harness pack hook pre-tool-use` with crafted
+// stdin) can write, or forge, an observation. That is why
+// `checkBypassWithoutAutoApprove` (bypass-without-auto-approve.ts) is
+// wired as an advisory `harness doctor` finding ONLY: it can never gate a
+// tool call or mint an approval, and the operator who reads the finding
+// is the one who decides what to do about it. Signing the observation
+// was considered and rejected, not deferred: a signature would only
+// prove the hook signed the record, not that the named session actually
+// ran under that mode, and it would open a second, unconditional
+// signing surface for the marker-signing key (not a path to mint an
+// approval marker, which stays namespaced by markerId). See
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md's "Amendment:
+// permission-mode observation stays unsigned" for the full reasoning
+// and the reopen criterion.
+import * as path from "node:path";
+import { atomicWriteFile } from "../../../io/atomic-write.js";
+import { readJsonDirEntriesRejectingSymlinks } from "../../../io/read-json-dir-entries.js";
+import { rejectMalformedSessionId } from "../../../runtime/reject-malformed-session-id.js";
+export const PERMISSION_MODE_OBSERVATION_DIRNAME = ".permission-mode-observations";
+/**
+ * `sessionId` is validated with the SAME `rejectMalformedSessionId` used
+ * for the approval marker path (`markers.ts`'s `approvalMarkerPathFor`):
+ * a value carrying `/`, `\`, `..`, or that is empty/blank throws rather
+ * than being joined into the path (review round 3, F1: the earlier
+ * version of this function trusted the caller's own empty-string check
+ * and joined `sessionId` verbatim, letting a crafted `session_id` on the
+ * hook's stdin write outside `<generatedDir>/.permission-mode-observations/`).
+ */
+export function permissionModeObservationPathFor(generatedDir, sessionId) {
+    rejectMalformedSessionId(sessionId);
+    return path.join(generatedDir, PERMISSION_MODE_OBSERVATION_DIRNAME, sessionId);
+}
+/**
+ * Best-effort write/update of the per-session observation.
+ *
+ * `permissionMode` must be a non-empty string; any other shape (absent,
+ * non-string, empty) is a silent no-op: there is nothing to observe.
+ * `sessionId` is NOT trusted as pre-validated (review round 3, F1): the
+ * caller (`hook-pre-tool-use.ts`) only rejects an EMPTY session id
+ * before this is reached, and `session_id` on the hook's stdin payload
+ * is otherwise attacker-controllable input to a CLI invocation, not a
+ * value this function may assume is already path-safe. A malformed id
+ * (path separators, `..`, blank) makes `permissionModeObservationPathFor`
+ * throw; that throw is treated exactly like any other write failure
+ * below: one `stderr` warning, never escalated into a block, never
+ * thrown out of this function.
+ */
+export function recordPermissionModeObservation(generatedDir, sessionId, permissionMode, stderr, now = () => new Date()) {
+    if (typeof permissionMode !== "string" || permissionMode.length === 0)
+        return;
+    if (sessionId.length === 0)
+        return;
+    const record = {
+        sessionId,
+        permissionMode,
+        observedAt: now().toISOString(),
+    };
+    try {
+        atomicWriteFile(permissionModeObservationPathFor(generatedDir, sessionId), `${JSON.stringify(record)}\n`);
+    }
+    catch (err) {
+        stderr.write(`harness pack hook: failed to write permission-mode observation for session ${sanitizeForDisplay(sessionId)} (${err.message}), continuing.\n`);
+    }
+}
+function isValidObservation(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const obj = value;
+    return (typeof obj["sessionId"] === "string" &&
+        typeof obj["permissionMode"] === "string" &&
+        typeof obj["observedAt"] === "string" &&
+        !Number.isNaN(Date.parse(obj["observedAt"])));
+}
+/** Cap applied to a sanitized `sessionId` before it reaches doctor output. */
+const DISPLAY_VALUE_MAX_LENGTH = 200;
+/**
+ * Strip C0/DEL control characters (including ESC, which could otherwise
+ * smuggle an ANSI escape sequence into a terminal) and cap the length,
+ * mirroring `persisted-reports.ts`'s `sanitizeDetailValue` for the same
+ * reason: `bypass-without-auto-approve.ts` embeds an observation's
+ * `sessionId` directly into a doctor finding's `message`, the surface an
+ * operator reads (review round 3, F1). This is independent of
+ * `permissionModeObservationPathFor`'s write-time
+ * `rejectMalformedSessionId` guard: that guard rejects path-traversal
+ * shapes, not control characters, and a directory entry's on-disk
+ * filename (or the `sessionId` field inside it) is never itself
+ * constrained to be display-safe: POSIX filenames may contain any byte
+ * but `/` and NUL, and the JSON body's `sessionId` field is a plain
+ * string with no such constraint either.
+ */
+export function sanitizeForDisplay(value) {
+    const flattened = value.replace(/[\x00-\x1f\x7f]/g, " ");
+    return flattened.length > DISPLAY_VALUE_MAX_LENGTH
+        ? `${flattened.slice(0, DISPLAY_VALUE_MAX_LENGTH)}...`
+        : flattened;
+}
+/**
+ * Read-side: the newest `windowSize` per-session observations, newest
+ * first by `observedAt`. Mirrors `ug-auto-approvals.ts`'s own
+ * read-and-window convention (missing dir / empty dir / all-unreadable
+ * all resolve to an empty-ish result, never throw: this is a doctor
+ * read, not a gate decision). Every returned `sessionId` has already
+ * been through {@link sanitizeForDisplay}, so every consumer (today,
+ * `bypass-without-auto-approve.ts`'s finding `message`) gets a
+ * doctor-output-safe value without having to sanitize it itself.
+ */
+export function listPermissionModeObservations(generatedDir, opts) {
+    const dir = path.join(generatedDir, PERMISSION_MODE_OBSERVATION_DIRNAME);
+    const { dirPresent, entries: readable, unreadableCount } = readJsonDirEntriesRejectingSymlinks(dir, {
+        parse: (raw) => isValidObservation(raw)
+            ? {
+                ...raw,
+                sessionId: sanitizeForDisplay(raw.sessionId),
+                // `observedAt` only has to satisfy Date.parse, which accepts
+                // parenthesised trailing text, so it is display-sanitised too
+                // (review round 3: a crafted timestamp reached doctor output raw).
+                observedAt: sanitizeForDisplay(raw.observedAt),
+            }
+            : null,
+    });
+    readable.sort((a, b) => Date.parse(b.observedAt) - Date.parse(a.observedAt));
+    return {
+        dirPresent,
+        entries: readable.slice(0, opts.windowSize),
+        unreadableCount,
+    };
+}
+//# sourceMappingURL=permission-mode-observations.js.map

package/dist/policy-packs/builtin/understanding-before-execution/permission-mode-observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-mode-observations.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/permission-mode-observations.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,mEAAmE;AACnE,wDAAwD;AACxD,8DAA8D;AAC9D,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,0EAA0E;AAC1E,yDAAyD;AACzD,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,oDAAoD;AACpD,wEAAwE;AACxE,+DAA+D;AAC/D,yEAAyE;AACzE,qEAAqE;AACrE,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,sEAAsE;AACtE,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,kEAAkE;AAClE,kEAAkE;AAClE,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,oEAAoE;AACpE,0DAA0D;AAC1D,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,iEAAiE;AACjE,oEAAoE;AACpE,4DAA4D;AAC5D,mEAAmE;AACnE,qEAAqE;AACrE,4BAA4B;AAE5B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,+BAA+B,CAAC;AAQnF;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAoB,EACpB,SAAiB;IAEjB,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,SAAiB,EACjB,cAAuB,EACvB,MAAqC,EACrC,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAA8B;QACxC,SAAS;QACT,cAAc;QACd,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;KAChC,CAAC;IACF,IAAI,CAAC;QACH,eAAe,CACb,gCAAgC,CAAC,YAAY,EAAE,SAAS,CAAC,EACzD,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,8EAA8E,kBAAkB,CAAC,SAAS,CAAC,KACxG,GAAa,CAAC,OACjB,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QACzC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,wBAAwB;QAChD,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,KAAK;QACtD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,YAAoB,EACpB,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAEzE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,GACtD,mCAAmC,CAA4B,GAAG,EAAE;QAClE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACb,kBAAkB,CAAC,GAAG,CAAC;YACrB,CAAC,CAAC;gBACE,GAAG,GAAG;gBACN,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC5C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,mEAAmE;gBACnE,UAAU,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;aAC/C;YACH,CAAC,CAAC,IAAI;KACX,CAAC,CAAC;IAEL,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAE7E,OAAO;QACL,UAAU;QACV,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;QAC3C,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/runtime/destructive-shell-floor.d.ts

@@ -0,0 +1,19 @@
+import type { RiskCategory, RiskSeverity } from "../schema/index.js";
+/** One recognised destructive invocation. */
+export interface DestructiveFloorHit {
+    severity: RiskSeverity;
+    categories: readonly RiskCategory[];
+    /** Human-readable, appended to the profile's `reasons`. */
+    reason: string;
+}
+/**
+ * Recognise every built-in destructive invocation in `command`.
+ *
+ * Pure and linear in the length of the command: whitespace tokenisation,
+ * set lookups, and a bounded wrapper peel. No regex with a backtracking
+ * risk runs over the command text (`BOUNDARY_SPLIT_RE` is a character
+ * class), so this may be called on the UNCAPPED command string, which it
+ * must be, so a destructive tail past the classifier's 16 KiB ReDoS cap
+ * cannot be laundered by a long benign head.
+ */
+export declare function classifyDestructiveShellFloor(command: string): DestructiveFloorHit[];