@lannguyensi/harness 0.53.0 → 0.55.0

package/dist/runtime/workflow-policies.js

@@ -14,11 +14,20 @@
  * later index in the same workflow) by a `merge` step. When BOTH
  * `require-review-evidence` and `require-review-evidence-bash` are
  * declared in `manifest.hooks[]`, `deriveWorkflowGatePolicies` returns
- * the SAME policy pair `harness init --template full` would hand-author
+ * the SAME policies `harness init --template full` would hand-author
  * (`src/cli/init/templates.ts` `review-before-merge` /
  * `review-before-merge-bash`), renamed per workflow so the provenance
  * is visible in `harness list policies` / `harness explain`.
  *
+ * Task 2699b476 added the two task-scoped merge surfaces to that set:
+ * `review-before-task-merge` (`mcp__agent-tasks__task_merge`) and
+ * `review-before-task-finish-automerge`
+ * (`mcp__agent-tasks__task_finish` narrowed by `trigger.input_match` to
+ * `autoMerge: true`), each derived only when its own hook
+ * (`require-review-evidence-task-merge` /
+ * `require-review-evidence-task-finish`) is declared. A manifest that
+ * predates those hooks derives exactly the pair it always did.
+ *
  * Deliberately does NOT touch `src/runtime/intercept.ts`: the engine
  * already knows how to evaluate a `Policy`, so the only thing missing
  * was a `Policy` to hand it. `src/cli/loader.ts#loadManifest` calls
@@ -67,6 +76,26 @@
 /** The two hooks templates.ts wires for the hand-authored merge gate. */
 export const REVIEW_EVIDENCE_HOOK_MCP = "require-review-evidence";
 export const REVIEW_EVIDENCE_HOOK_BASH = "require-review-evidence-bash";
+/**
+ * The two hooks templates.ts wires for the task-scoped merge surfaces
+ * (task 2699b476). Unlike the pair above these are NOT part of
+ * `hasWiredMergeGateHooks`: a manifest that predates them still derives
+ * the `pull_requests_merge` / `gh pr merge` gates exactly as before, and
+ * each task-scoped gate is derived only when ITS OWN hook is declared.
+ *
+ * That per-hook gating is not a style choice. A derived policy's `hook:`
+ * must name a declared hook (`ManifestSchema`'s superRefine), and, more
+ * importantly, the hook's `match` is what `harness apply` projects into
+ * settings.json's tool-name matcher: without a matcher for
+ * `mcp__agent-tasks__task_merge`, Claude Code never spawns `harness
+ * policy intercept` for that verb, so a gate derived anyway would be
+ * INERT while looking enforced in `harness list policies` (the exact
+ * "No-Op that LOOKS protective" shape `checkWorkflowGateWiring` exists
+ * to prevent). Deriving nothing until the hook is wired keeps the
+ * absence visible instead of fake-covering it.
+ */
+export const REVIEW_EVIDENCE_HOOK_TASK_MERGE = "require-review-evidence-task-merge";
+export const REVIEW_EVIDENCE_HOOK_TASK_FINISH = "require-review-evidence-task-finish";
 // Exported (review round 2, F5) so `src/cli/validate/checks.ts` can check a
 // declared hook's `match`/`bash_match` against the EXACT surface the
 // derivation binds to, instead of trusting the hook name alone. See
@@ -78,6 +107,25 @@ export const MERGE_MCP_MATCH = "mcp__agent-tasks__pull_requests_merge";
 // by tests/runtime/workflow-policies.test.ts's parity assertion so the
 // two cannot silently drift apart).
 export const MERGE_BASH_MATCH = "(^|\\n|;|\\||&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b";
+// The two task-scoped agent-tasks merge surfaces (task 2699b476), pinned
+// here the same way `MERGE_MCP_MATCH` / `MERGE_BASH_MATCH` are and held
+// byte-identical to templates.ts by this module's parity assertion in
+// tests/runtime/workflow-policies.test.ts.
+export const TASK_MERGE_MCP_MATCH = "mcp__agent-tasks__task_merge";
+export const TASK_FINISH_MCP_MATCH = "mcp__agent-tasks__task_finish";
+/**
+ * The `trigger.input_match` predicate that separates the merging mode of
+ * `task_finish` from the ordinary one. Both auto-merge modes the MCP
+ * server documents (soloMode work claim, review claim + approve) carry
+ * `autoMerge: true`; a plain finish omits the argument entirely, and a
+ * missing path never satisfies an `input_match` entry, so the gate stays
+ * out of the way of the non-merging call.
+ */
+export const TASK_FINISH_AUTOMERGE_INPUT_MATCH = {
+    "toolArgs.autoMerge": true,
+};
+/** `toolArgs.taskId` is the only identifier either task-scoped verb carries. */
+export const TASK_ID_EXTRACT = { TASK_ID: "toolArgs.taskId" };
 /**
  * True when `workflow.steps` contains a `review_subagent` step with
  * `spawn: "required"` at an index earlier than some `merge` step
@@ -118,9 +166,34 @@ function triggerSurfaceKey(policy) {
         event: policy.trigger.event,
         match: policy.trigger.match ?? null,
         bash_match: policy.trigger.bash_match ?? null,
+        input_match: inputMatchKey(policy),
         ledger_tag: policy.requires?.ledger_tag ?? null,
     });
 }
+/**
+ * Canonical form of `trigger.input_match` for the surface key: key-sorted
+ * so authoring order does not change identity, `null` when the policy
+ * declares none.
+ *
+ * `input_match` is part of the SURFACE, not of the extract comparison
+ * (task 2699b476): two policies on `mcp__agent-tasks__task_finish` that
+ * disagree about which `autoMerge` value they gate intercept DIFFERENT
+ * tool calls, so they are no more interchangeable than a policy on a
+ * different tool name would be. Leaving it out of the key would let a
+ * hand-authored `input_match: { toolArgs.autoMerge: false }` policy dedupe
+ * the derived `autoMerge: true` gate away and leave the merging call
+ * ungated while the manifest still reads as covered.
+ */
+function inputMatchKey(policy) {
+    const inputMatch = policy.trigger.input_match;
+    if (inputMatch === undefined)
+        return null;
+    const sorted = {};
+    for (const key of Object.keys(inputMatch).sort()) {
+        sorted[key] = inputMatch[key];
+    }
+    return sorted;
+}
 /**
  * Canonical form of `trigger.extract` for equality: key-sorted so two
  * maps that declare the same variables from the same paths compare equal
@@ -264,6 +337,76 @@ function buildBashMergeGatePolicy(workflowName) {
         },
     };
 }
+/**
+ * The two task-scoped merge gates (task 2699b476), structurally identical
+ * to templates.ts's `review-before-task-merge` /
+ * `review-before-task-finish-automerge` apart from name and description.
+ * They key on `review:${TASK_ID}` rather than the PR number because both
+ * verbs derive owner/repo/PR from the task, so `toolArgs.taskId` is the
+ * only identifier in the payload; `harness record review --pr <pr> --task
+ * <id>` writes both tag families in ONE fact so a single recorded review
+ * opens every merge surface.
+ */
+function buildTaskMergeGatePolicy(workflowName) {
+    return {
+        name: `workflow:${workflowName}:review-before-task-merge`,
+        description: `Derived from workflows[] (workflow "${workflowName}"): a review_subagent step ` +
+            `with spawn: "required" precedes a merge step, so block agent-tasks task_merge ` +
+            "unless a ledger entry tagged review:<task-id> exists for this session.",
+        trigger: {
+            event: "PreToolUse",
+            match: TASK_MERGE_MCP_MATCH,
+            extract: { ...TASK_ID_EXTRACT },
+        },
+        requires: { ledger_tag: "review:${TASK_ID}" },
+        hook: REVIEW_EVIDENCE_HOOK_TASK_MERGE,
+        enforcement: "block",
+        producers: [
+            {
+                kind: "mcp",
+                verb: "mcp__grounding-mcp__ledger_add",
+                example: '{sessionId:"${SESSION_ID}", type:"fact", content:"review:${TASK_ID}: <verdict + key findings + nits>", source:"Agent(general-purpose) review"}',
+                description: "Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the task id. Mirror of the review-before-merge producer for the task-scoped merge surface.",
+            },
+        ],
+        ux: {
+            cannot: "You cannot merge the PR for task ${TASK_ID} yet.",
+            required: ["a recorded review of task ${TASK_ID}"],
+            run: ['harness record review --pr <pr> --task ${TASK_ID} "<summary>"'],
+        },
+    };
+}
+function buildTaskFinishAutoMergeGatePolicy(workflowName) {
+    return {
+        name: `workflow:${workflowName}:review-before-task-finish-automerge`,
+        description: `Derived from workflows[] (workflow "${workflowName}"): a review_subagent step ` +
+            `with spawn: "required" precedes a merge step, so block agent-tasks task_finish ` +
+            "in its auto-merge mode unless a ledger entry tagged review:<task-id> exists for " +
+            "this session.",
+        trigger: {
+            event: "PreToolUse",
+            match: TASK_FINISH_MCP_MATCH,
+            input_match: { ...TASK_FINISH_AUTOMERGE_INPUT_MATCH },
+            extract: { ...TASK_ID_EXTRACT },
+        },
+        requires: { ledger_tag: "review:${TASK_ID}" },
+        hook: REVIEW_EVIDENCE_HOOK_TASK_FINISH,
+        enforcement: "block",
+        producers: [
+            {
+                kind: "mcp",
+                verb: "mcp__grounding-mcp__ledger_add",
+                example: '{sessionId:"${SESSION_ID}", type:"fact", content:"review:${TASK_ID}: <verdict + key findings + nits>", source:"Agent(general-purpose) review"}',
+                description: "Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the task id. Same evidence the task_merge gate reads, so one recorded review opens both.",
+            },
+        ],
+        ux: {
+            cannot: "You cannot finish task ${TASK_ID} with autoMerge yet.",
+            required: ["a recorded review of task ${TASK_ID}"],
+            run: ['harness record review --pr <pr> --task ${TASK_ID} "<summary>"'],
+        },
+    };
+}
 // F7 (review round 2): a registry of every `Policy` object this module has
 // ever handed back from `deriveWorkflowGatePolicies`. `WeakSet` keys on
 // object identity, not value equality, deliberately: two DIFFERENT
@@ -306,6 +449,7 @@ function deriveWorkflowGates(manifest) {
     if (!hasWiredMergeGateHooks(manifest))
         return empty;
     const hand = handAuthoredPolicies(manifest);
+    const declaredHookNames = new Set(manifest.hooks.map((h) => h.name));
     const bySurface = new Map();
     for (const policy of hand) {
         const key = triggerSurfaceKey(policy);
@@ -327,8 +471,21 @@ function deriveWorkflowGates(manifest) {
         const candidates = [
             { policy: buildMcpMergeGatePolicy(workflow.name), surface: MERGE_MCP_MATCH },
             { policy: buildBashMergeGatePolicy(workflow.name), surface: "`gh pr merge` (Bash)" },
+            { policy: buildTaskMergeGatePolicy(workflow.name), surface: TASK_MERGE_MCP_MATCH },
+            {
+                policy: buildTaskFinishAutoMergeGatePolicy(workflow.name),
+                surface: `${TASK_FINISH_MCP_MATCH} (autoMerge: true)`,
+            },
         ];
         for (const { policy: candidate, surface } of candidates) {
+            // A candidate whose own hook is not declared is skipped rather than
+            // derived (task 2699b476): see REVIEW_EVIDENCE_HOOK_TASK_MERGE's
+            // doc for why an unwired hook makes a derived gate inert rather
+            // than enforcing. `hasWiredMergeGateHooks` above already guarantees
+            // this holds for the two pull_requests_merge / gh pr merge
+            // candidates, so their behaviour is unchanged.
+            if (!declaredHookNames.has(candidate.hook))
+                continue;
             const key = triggerSurfaceKey(candidate);
             if (seen.has(key))
                 continue;

package/dist/runtime/workflow-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-policies.js","sourceRoot":"","sources":["../../src/runtime/workflow-policies.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,4EAA4E;AAC5E,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AACzE,mBAAmB;AACnB,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oCAAoC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAkB;IAC1D,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjE,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,MAA4C;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;QAC3B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI;QACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI;QAC7C,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,MAA+B;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,8BAA8B,CAAC,MAAc;IACpD,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,OAAO;QAC9B,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,aAAa,KAAK,IAAI,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO;QAAE,OAAO,gBAAgB,MAAM,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,iCAAiC,CAAC;IACxE,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IAChE,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,UAAkB,EAAE,WAAmB;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,4BAA4B,WAAW,IAAI,MAAM,eAAe,WAAW,IAAI,MAAM,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,sBAAsB;QACpD,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,4EAA4E;YAC5E,iEAAiE;QACnE,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE;SAC5C;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC/C,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,kJAAkJ;gBACpJ,WAAW,EACT,0NAA0N;aAC7N;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,CAAC,uCAAuC,CAAC;YACnD,GAAG,EAAE,CAAC,qDAAqD,CAAC;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAoB;IACpD,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,2BAA2B;QACzD,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,gFAAgF;YAChF,8DAA8D;QAChE,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,gBAAgB;SAC7B;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE;QAC5C,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,+IAA+I;gBACjJ,WAAW,EACT,mMAAmM;aACtM;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,qEAAqE;YAC7E,QAAQ,EAAE,CAAC,kDAAkD,CAAC;YAC9D,GAAG,EAAE,CAAC,6CAA6C,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAU,CAAC;AAEpD,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAqBD;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,MAAM,KAAK,GAA2B,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEnD,MAAM,UAAU,GAA+C;YAC7D,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE;YAC5E,EAAE,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE;SACrF,CAAC;QAEF,KAAK,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnC,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC;aAC5C,CAAC,CAAC,CAAC;YACJ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC3C,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC7C,IAAI,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,QAAQ,CAAC,IAAI;oBAC3B,iBAAiB,EAAE,SAAS,CAAC,IAAI;oBACjC,OAAO;oBACP,cAAc,EAAE,UAAU,CAAC,IAAI;oBAC/B,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC9F,KAAK,MAAM,MAAM,IAAI,eAAe;QAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC9D,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"workflow-policies.js","sourceRoot":"","sources":["../../src/runtime/workflow-policies.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,qCAAqC,CAAC;AAEtF,4EAA4E;AAC5E,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AACzE,mBAAmB;AACnB,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oCAAoC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAExF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAEtF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAkB;IAC1D,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjE,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,MAA4C;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;QAC3B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI;QACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI;QAC7C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,MAA+B;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,MAA+B;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,8BAA8B,CAAC,MAAc;IACpD,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,OAAO;QAC9B,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,aAAa,KAAK,IAAI,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO;QAAE,OAAO,gBAAgB,MAAM,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,iCAAiC,CAAC;IACxE,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IAChE,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,UAAkB,EAAE,WAAmB;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,4BAA4B,WAAW,IAAI,MAAM,eAAe,WAAW,IAAI,MAAM,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,sBAAsB;QACpD,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,4EAA4E;YAC5E,iEAAiE;QACnE,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE;SAC5C;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC/C,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,kJAAkJ;gBACpJ,WAAW,EACT,0NAA0N;aAC7N;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,CAAC,uCAAuC,CAAC;YACnD,GAAG,EAAE,CAAC,qDAAqD,CAAC;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAoB;IACpD,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,2BAA2B;QACzD,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,gFAAgF;YAChF,8DAA8D;QAChE,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,gBAAgB;SAC7B;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE;QAC5C,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,+IAA+I;gBACjJ,WAAW,EACT,mMAAmM;aACtM;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,qEAAqE;YAC7E,QAAQ,EAAE,CAAC,kDAAkD,CAAC;YAC9D,GAAG,EAAE,CAAC,6CAA6C,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAAC,YAAoB;IACpD,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,2BAA2B;QACzD,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,gFAAgF;YAChF,wEAAwE;QAC1E,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,EAAE,GAAG,eAAe,EAAE;SAChC;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE;QAC7C,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,gJAAgJ;gBAClJ,WAAW,EACT,sMAAsM;aACzM;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,kDAAkD;YAC1D,QAAQ,EAAE,CAAC,sCAAsC,CAAC;YAClD,GAAG,EAAE,CAAC,+DAA+D,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,YAAoB;IAC9D,OAAO;QACL,IAAI,EAAE,YAAY,YAAY,sCAAsC;QACpE,WAAW,EACT,uCAAuC,YAAY,6BAA6B;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,eAAe;QACjB,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,EAAE,GAAG,iCAAiC,EAAE;YACrD,OAAO,EAAE,EAAE,GAAG,eAAe,EAAE;SAChC;QACD,QAAQ,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE;QAC7C,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EACL,gJAAgJ;gBAClJ,WAAW,EACT,oMAAoM;aACvM;SACF;QACD,EAAE,EAAE;YACF,MAAM,EAAE,uDAAuD;YAC/D,QAAQ,EAAE,CAAC,sCAAsC,CAAC;YAClD,GAAG,EAAE,CAAC,+DAA+D,CAAC;SACvE;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAU,CAAC;AAEpD,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAqBD;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,MAAM,KAAK,GAA2B,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEnD,MAAM,UAAU,GAA+C;YAC7D,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE;YAC5E,EAAE,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE;YACpF,EAAE,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE;YAClF;gBACE,MAAM,EAAE,kCAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzD,OAAO,EAAE,GAAG,qBAAqB,oBAAoB;aACtD;SACF,CAAC;QAEF,KAAK,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;YACxD,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,oEAAoE;YACpE,2DAA2D;YAC3D,+CAA+C;YAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnC,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC;aAC5C,CAAC,CAAC,CAAC;YACJ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC3C,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC7C,IAAI,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,QAAQ,CAAC,IAAI;oBAC3B,iBAAiB,EAAE,SAAS,CAAC,IAAI;oBACjC,OAAO;oBACP,cAAc,EAAE,UAAU,CAAC,IAAI;oBAC/B,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC9F,KAAK,MAAM,MAAM,IAAI,eAAe;QAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC9D,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC"}

package/dist/schema/extract.d.ts

@@ -3,3 +3,7 @@ export declare const ExtractExpressionSchema: z.ZodEffects<z.ZodString, string,
 export type ExtractExpression = z.infer<typeof ExtractExpressionSchema>;
 export declare const ExtractMapSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>;
 export type ExtractMap = z.infer<typeof ExtractMapSchema>;
+export declare const ToolArgsExtractExpressionSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const InputMatchLiteralSchema: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+export declare const InputMatchMapSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>;
+export type InputMatchMap = z.infer<typeof InputMatchMapSchema>;

package/dist/schema/extract.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ExtractGrammarError, validateExtractGrammar, } from "../io/extract.js";
+import { ExtractGrammarError, parseExtractExpression, validateExtractGrammar, } from "../io/extract.js";
 export const ExtractExpressionSchema = z.string().min(1).superRefine((v, ctx) => {
     try {
         validateExtractGrammar(v);
@@ -20,4 +20,67 @@ const VAR_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 export const ExtractMapSchema = z
     .record(ExtractExpressionSchema)
     .refine((m) => Object.keys(m).every((k) => VAR_NAME_RE.test(k)), { message: "extract variable names must be SCREAMING_SNAKE_CASE" });
+// ---------------------------------------------------------------------------
+// trigger.input_match (task 2699b476)
+// ---------------------------------------------------------------------------
+//
+// Same expression grammar as `trigger.extract`, but restricted to the
+// `toolArgs.` namespace: the predicate answers "did THIS tool call carry
+// this argument value?", and `event` / `session` / `git` are not tool
+// arguments. Rejecting the other three namespaces here (rather than
+// silently never matching them at runtime) is what makes a typo like
+// `event.autoMerge` a loud `harness validate` error instead of a gate
+// that quietly never fires.
+//
+// This is the same layer `bash_match` and `path_match` are declared at
+// (`PolicyTriggerSchema`), so every consumer that parses a manifest,
+// `harness validate`, `apply`, `doctor`, `loadManifest`, the intercept
+// entrypoint, refuses the bad shape, not just the two report verbs.
+export const ToolArgsExtractExpressionSchema = z
+    .string()
+    .min(1)
+    .superRefine((v, ctx) => {
+    let parsed;
+    try {
+        parsed = parseExtractExpression(v);
+    }
+    catch (err) {
+        if (err instanceof ExtractGrammarError) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: err.message.replace(/^extract expression "[^"]*": /, ""),
+            });
+            return;
+        }
+        throw err;
+    }
+    if (parsed.namespace !== "toolArgs") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `input_match keys must read from the toolArgs namespace ` +
+                `(the tool call's own arguments); "${v}" reads from ${parsed.namespace}`,
+        });
+    }
+});
+export const InputMatchLiteralSchema = z.union([z.string(), z.number(), z.boolean()]);
+export const InputMatchMapSchema = z
+    .record(InputMatchLiteralSchema)
+    .superRefine((map, ctx) => {
+    const keys = Object.keys(map);
+    if (keys.length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "trigger.input_match must declare at least one entry; an empty map is a silent no-op",
+        });
+        return;
+    }
+    for (const key of keys) {
+        const result = ToolArgsExtractExpressionSchema.safeParse(key);
+        if (result.success)
+            continue;
+        for (const issue of result.error.issues) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: [key], message: issue.message });
+        }
+    }
+});
 //# sourceMappingURL=extract.js.map

package/dist/schema/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/schema/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IAC9E,IAAI,CAAC;QACH,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,kEAAkE;YAClE,iEAAiE;YACjE,iCAAiC;YACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC,uBAAuB,CAAC;KAC/B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACvD,EAAE,OAAO,EAAE,qDAAqD,EAAE,CACnE,CAAC"}
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/schema/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IAC9E,IAAI,CAAC;QACH,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,kEAAkE;YAClE,iEAAiE;YACjE,iCAAiC;YACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC,uBAAuB,CAAC;KAC/B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACvD,EAAE,OAAO,EAAE,qDAAqD,EAAE,CACnE,CAAC;AAIJ,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,4BAA4B;AAC5B,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,yDAAyD;gBACzD,qCAAqC,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC,uBAAuB,CAAC;KAC/B,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schema/index.d.ts

@@ -431,6 +431,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             match: z.ZodOptional<z.ZodString>;
             path_match: z.ZodOptional<z.ZodString>;
             bash_match: z.ZodOptional<z.ZodString>;
+            input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
             extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
         }, "strict", z.ZodTypeAny, {
             event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
@@ -438,12 +439,14 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         }, {
             event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
             match?: string | undefined;
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         }>;
         requires: z.ZodOptional<z.ZodObject<{
             ledger_tag: z.ZodString;
@@ -609,6 +612,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -658,6 +662,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -707,6 +712,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -756,6 +762,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -805,6 +812,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -854,6 +862,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -2638,6 +2647,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -2954,6 +2964,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -3270,6 +3281,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";
@@ -3586,6 +3598,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             path_match?: string | undefined;
             bash_match?: string | undefined;
             extract?: Record<string, string> | undefined;
+            input_match?: Record<string, string | number | boolean> | undefined;
         };
         hook: string;
         enforcement: "warn" | "block" | "require_approval";

package/dist/schema/policies.d.ts

@@ -4,6 +4,7 @@ export declare const PolicyTriggerSchema: z.ZodObject<{
     match: z.ZodOptional<z.ZodString>;
     path_match: z.ZodOptional<z.ZodString>;
     bash_match: z.ZodOptional<z.ZodString>;
+    input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
     extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
 }, "strict", z.ZodTypeAny, {
     event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
@@ -11,12 +12,14 @@ export declare const PolicyTriggerSchema: z.ZodObject<{
     path_match?: string | undefined;
     bash_match?: string | undefined;
     extract?: Record<string, string> | undefined;
+    input_match?: Record<string, string | number | boolean> | undefined;
 }, {
     event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
     match?: string | undefined;
     path_match?: string | undefined;
     bash_match?: string | undefined;
     extract?: Record<string, string> | undefined;
+    input_match?: Record<string, string | number | boolean> | undefined;
 }>;
 export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn", "require_approval"]>;
 export declare const ProducerSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
@@ -111,6 +114,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         match: z.ZodOptional<z.ZodString>;
         path_match: z.ZodOptional<z.ZodString>;
         bash_match: z.ZodOptional<z.ZodString>;
+        input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
         extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
     }, "strict", z.ZodTypeAny, {
         event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
@@ -118,12 +122,14 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     }, {
         event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
         match?: string | undefined;
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     }>;
     requires: z.ZodOptional<z.ZodObject<{
         ledger_tag: z.ZodString;
@@ -289,6 +295,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -338,6 +345,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -387,6 +395,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -436,6 +445,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -485,6 +495,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         match: z.ZodOptional<z.ZodString>;
         path_match: z.ZodOptional<z.ZodString>;
         bash_match: z.ZodOptional<z.ZodString>;
+        input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
         extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
     }, "strict", z.ZodTypeAny, {
         event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
@@ -492,12 +503,14 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     }, {
         event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStop" | "PreCompact";
         match?: string | undefined;
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     }>;
     requires: z.ZodOptional<z.ZodObject<{
         ledger_tag: z.ZodString;
@@ -663,6 +676,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -712,6 +726,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -761,6 +776,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -810,6 +826,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -859,6 +876,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";
@@ -908,6 +926,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         path_match?: string | undefined;
         bash_match?: string | undefined;
         extract?: Record<string, string> | undefined;
+        input_match?: Record<string, string | number | boolean> | undefined;
     };
     hook: string;
     enforcement: "warn" | "block" | "require_approval";

package/dist/schema/policies.js

@@ -1,15 +1,31 @@
 import { z } from "zod";
 import { MatchableEnvironmentSchema } from "./environments.js";
-import { ExtractMapSchema } from "./extract.js";
+import { ExtractMapSchema, InputMatchMapSchema } from "./extract.js";
 import { HookEventSchema } from "./hooks.js";
 import { RequiresSchema, isBuiltinVariable, referencedVariables } from "./requires.js";
 import { RiskCategorySchema, RiskSeveritySchema } from "./risk.js";
+// `trigger:`: the WHICH-tool-calls filter. Every declared field is
+// ANDed: `match` on the tool name, `path_match` on the edited file path,
+// `bash_match` on the shell command text, and `input_match` (task
+// 2699b476) on the tool call's own arguments.
+//
+// `input_match` exists because the other three cannot express "this MCP
+// verb, but only in the mode that actually does the dangerous thing".
+// `mcp__agent-tasks__task_finish` is the motivating shape: the same verb
+// either merges the PR (`autoMerge: true`) or just advances the task, and
+// a name-only trigger would have to gate both or neither. Keys are
+// `toolArgs.`-namespaced extract expressions (the SAME grammar and parser
+// `extract` uses, `src/schema/extract.ts` + `src/io/extract.ts`), values
+// are literals compared by strict equality; a missing path never matches.
+// See `firstInputMatchMismatch` in `src/io/extract.ts` for the evaluator
+// `policyMatchesEvent` and `harness policy dry-run` both call.
 export const PolicyTriggerSchema = z
     .object({
     event: HookEventSchema,
     match: z.string().min(1).optional(),
     path_match: z.string().min(1).optional(),
     bash_match: z.string().min(1).optional(),
+    input_match: InputMatchMapSchema.optional(),
     extract: ExtractMapSchema.optional(),
 })
     .strict();