@lannguyensi/harness 0.53.0 → 0.55.0

package/dist/cli/init/templates.js

@@ -213,8 +213,8 @@ hooks:
   # f2d2a29): every \`harness policy intercept\` hook below down through
   # \`risk-gate\` carries \`budget_ms: 15000\`, i.e. a Claude Code outer
   # kill-timeout of \`ceil(15000/1000) = 15\` seconds (generate-settings.ts's
-  # \`hookTimeoutSeconds\`). This is deliberately UNIFORM across all eleven of
-  # them, for two independent reasons:
+  # \`hookTimeoutSeconds\`). This is deliberately UNIFORM across all thirteen
+  # of them, for two independent reasons:
   #
   # 1. FAIL-CLOSED MARGIN. \`harness policy intercept\` evaluates its FULL
   #    \`policies:\` list against the incoming event (src/runtime/intercept.ts,
@@ -257,7 +257,7 @@ hooks:
   #    and reintroduce exactly the redundant-invocation cost the dedup
   #    exists to avoid — on top of leaving whichever entry keeps a low
   #    timeout still exposed to the fail-open risk above. Keeping all
-  #    eleven at the identical 15000ms budget_ms preserves the existing
+  #    thirteen at the identical 15000ms budget_ms preserves the existing
   #    one-invocation-per-matcher-group collapse (previously they all
   #    collapsed onto the shared 2s floor; now they collapse onto 15s).
   - name: require-review-evidence
@@ -281,6 +281,31 @@ hooks:
     blocking: hard
     budget_ms: 15000
 
+  # The two OTHER agent-tasks verbs that land a PR (task 2699b476).
+  # \`pull_requests_merge\` is not the only merge surface the MCP server
+  # exposes: \`task_merge\` merges the PR attached to a task, and
+  # \`task_finish\` with \`autoMerge: true\` merges as part of finishing
+  # (both of its auto-merge modes, the soloMode work claim and the review
+  # claim + approve). Each needs its OWN hook entry because a hook's
+  # \`match\` is what \`harness apply\` projects into settings.json's
+  # tool-name matcher, and a matcher for \`pull_requests_merge\` never
+  # spawns \`harness policy intercept\` for either of these. Same
+  # 15000ms budget_ms as every other blocking intercept hook, for the
+  # same two reasons the note above gives.
+  - name: require-review-evidence-task-merge
+    event: PreToolUse
+    match: "mcp__agent-tasks__task_merge"
+    command: harness policy intercept
+    blocking: hard
+    budget_ms: 15000
+
+  - name: require-review-evidence-task-finish
+    event: PreToolUse
+    match: "mcp__agent-tasks__task_finish"
+    command: harness policy intercept
+    blocking: hard
+    budget_ms: 15000
+
   - name: require-dogfood-evidence
     event: PreToolUse
     match: "Bash"
@@ -472,6 +497,74 @@ policies:
       run:
         - 'harness record review --pr <pr> "<summary>"'
 
+  # The two agent-tasks verbs that ALSO land a PR (task 2699b476, closing
+  # the residual 99f47307 Slice 1 named twice in the CHANGELOG). Same
+  # shape as review-before-merge, three scope notes:
+  #   1. Tag shape: \`review:\${TASK_ID}\` rather than \`review:\${PR_NUMBER}\`.
+  #      Both verbs are task-scoped: they derive owner/repo/PR number from
+  #      the task, so \`taskId\` is the only identifier in the tool payload.
+  #      \`harness record review --pr <pr> --task <id> "<summary>"\` writes
+  #      the PR, branch, base AND task tags in ONE ledger fact, so a single
+  #      recorded review satisfies all four merge gates at once.
+  #   2. task_finish is gated ONLY in its auto-merge mode. The verb is
+  #      polymorphic: a plain \`task_finish\` advances the task and merges
+  #      nothing, while \`autoMerge: true\` merges the PR (both modes do,
+  #      the soloMode work claim and the review claim + approve). Gating
+  #      the whole verb would block the ordinary finish call for no reason;
+  #      \`input_match\` narrows the trigger to the merging mode alone.
+  #      A missing \`autoMerge\` never matches, so an omitted argument
+  #      leaves the gate out of the way rather than arming it.
+  #   3. These sit ALONGSIDE review-before-merge / -bash, same rationale
+  #      as the bash variant above: an operator may use any of the four
+  #      merge surfaces, and each carries its own tag shape.
+  - name: review-before-task-merge
+    description: Block agent-tasks task_merge unless a ledger entry tagged review:<task-id> exists for this session.
+    trigger:
+      event: PreToolUse
+      match: "mcp__agent-tasks__task_merge"
+      extract:
+        TASK_ID: "toolArgs.taskId"
+    requires:
+      ledger_tag: "review:\${TASK_ID}"
+    hook: require-review-evidence-task-merge
+    enforcement: block
+    producers:
+      - kind: mcp
+        verb: mcp__grounding-mcp__ledger_add
+        example: '{sessionId:"\${SESSION_ID}", type:"fact", content:"review:\${TASK_ID}: <verdict + key findings + nits>", source:"Agent(general-purpose) review"}'
+        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the task id. Mirror of the review-before-merge producer for the task-scoped merge surface.
+    ux:
+      cannot: "You cannot merge the PR for task \${TASK_ID} yet."
+      required:
+        - "a recorded review of task \${TASK_ID}"
+      run:
+        - 'harness record review --pr <pr> --task \${TASK_ID} "<summary>"'
+
+  - name: review-before-task-finish-automerge
+    description: 'Block agent-tasks task_finish with autoMerge: true unless a ledger entry tagged review:<task-id> exists for this session.'
+    trigger:
+      event: PreToolUse
+      match: "mcp__agent-tasks__task_finish"
+      input_match:
+        toolArgs.autoMerge: true
+      extract:
+        TASK_ID: "toolArgs.taskId"
+    requires:
+      ledger_tag: "review:\${TASK_ID}"
+    hook: require-review-evidence-task-finish
+    enforcement: block
+    producers:
+      - kind: mcp
+        verb: mcp__grounding-mcp__ledger_add
+        example: '{sessionId:"\${SESSION_ID}", type:"fact", content:"review:\${TASK_ID}: <verdict + key findings + nits>", source:"Agent(general-purpose) review"}'
+        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the task id. Same evidence the task_merge gate reads, so one recorded review opens both.
+    ux:
+      cannot: "You cannot finish task \${TASK_ID} with autoMerge yet."
+      required:
+        - "a recorded review of task \${TASK_ID}"
+      run:
+        - 'harness record review --pr <pr> --task \${TASK_ID} "<summary>"'
+
   - name: dogfood-before-release
     description: Block npm publish / git tag v* without a recent dogfood ledger entry.
     trigger:
@@ -1080,6 +1173,73 @@ risk:
         - pattern: 'terraform(?:\\s+-\\S+(?:\\s+(?!destroy\\b)(?!-)\\S+)?)*\\s+destroy'
           categories: [destructive, infrastructure_change]
           severity: critical
+        # Task 2929c5b7: unclassified commands no longer trivially
+        # satisfy risk.severity_at_least: critical (see when-eval.ts and
+        # docs/risk-gate.md's "Unclassified actions and the fail-close
+        # rule") — kept in lockstep with docs/examples/full-manifest.yaml
+        # by tests/cli/init-full-template-parity.test.ts.
+        #
+        # These patterns are the OPERATOR-EDITABLE MIRROR of the built-in
+        # destructive floor (src/runtime/destructive-shell-floor.ts),
+        # not the only line of defence: the floor ships in the binary and
+        # already classifies these heads for an EXISTING manifest that
+        # never adopts the patterns below. Edit, narrow, or raise these
+        # freely: an operator pattern composes with the floor under
+        # highest-severity-wins, so it can only add. The floor is
+        # argv-aware where a regex cannot be (path-qualified and wrapped
+        # spellings: /bin/dd, sudo dd, sh -c "dd ...", git -C <dir> push
+        # -f), so a few spellings are caught by the floor alone; the
+        # parity test in tests/runtime/destructive-shell-floor.test.ts
+        # pins that everything caught HERE is also caught THERE, at the
+        # same severity or higher.
+        - pattern: '\\bdd\\s[^\\n]*\\bof='
+          categories: [destructive, data_loss]
+          severity: critical
+        - pattern: '\\btruncate\\b[^\\n]*(\\s-[a-zA-Z]*s|--size)'
+          categories: [destructive, data_loss]
+          severity: critical
+        - pattern: '\\bshred\\b'
+          categories: [destructive, data_loss, irreversible_action]
+          severity: critical
+        - pattern: '\\bmkfs(\\.\\w+)?\\b'
+          categories: [destructive, data_loss, infrastructure_change]
+          severity: critical
+        - pattern: '\\bfind\\b[^\\n]*-delete\\b'
+          categories: [destructive, data_loss]
+          severity: critical
+        - pattern: '\\bfind\\b[^\\n]*-exec(dir)?\\s+rm\\b'
+          categories: [destructive, data_loss]
+          severity: critical
+        - pattern: '\\bgit\\s+reset\\b[^\\n]*--hard\\b'
+          categories: [destructive, data_loss]
+          severity: high
+        - pattern: '\\bgit\\s+push\\b[^\\n]*(--force(-with-lease)?\\b|\\s-f\\b)'
+          categories: [destructive, production_mutation, deployment_change]
+          severity: high
+        - pattern: '\\bgit\\s+clean\\b[^\\n]*(--force\\b|\\s-[a-zA-Z]*f[a-zA-Z]*\\b)'
+          categories: [destructive, data_loss]
+          severity: high
+        - pattern: '\\bgit\\s+checkout\\s+--\\s+\\.'
+          categories: [destructive, data_loss]
+          severity: high
+        - pattern: '\\bgit\\s+restore\\s+\\.(\\s|$)'
+          categories: [destructive, data_loss]
+          severity: high
+        - pattern: '\\b(chmod|chown)\\b[^\\n]*(\\s-[a-zA-Z]*R|--recursive\\b)'
+          categories: [mass_update]
+          severity: high
+        - pattern: '\\bcurl\\b[^\\n]*(-X\\s*|--request[\\s=])(?![Gg][Ee][Tt]\\b)(?![Hh][Ee][Aa][Dd]\\b)[A-Za-z]'
+          categories: [production_mutation, network_exfiltration]
+          severity: high
+        - pattern: '\\bcurl\\b[^\\n]*(\\s-[a-zA-Z]*[dFT]|--data\\b|--json\\b|--form(-string)?\\b|--upload-file\\b)'
+          categories: [production_mutation, network_exfiltration]
+          severity: high
+        - pattern: '\\bcurl\\b[^\\n]*(\\s-[a-zA-Z]*[oODcK]|--output(-dir)?\\b|--remote-name\\b|--remote-header-name\\b|--dump-header\\b|--cookie-jar\\b|--config\\b|--create-dirs\\b|--etag-save\\b|--trace(-ascii)?\\b|--stderr\\b|(\\s-[a-zA-Z]*w\\b|--write-out\\b)[^\\n]*%output)'
+          categories: [destructive, data_loss]
+          severity: high
+        - pattern: '\\bsed\\b[^\\n]*(\\s-[a-zA-Z]*i[a-zA-Z]*\\b|--in-place\\b)'
+          categories: [destructive, data_loss]
+          severity: high
 
 environments:
   resolvers:

package/dist/cli/init/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,kEAAkE;AAClE,sEAAsE;AACtE,0DAA0D;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sEAAsE,CAAC;AAEhH,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA43B3B,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0KrB,CAAC;AAEF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,wBAAuD,CAAC;AAC5D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,wBAAwB,GAAG,QAAQ,CAAC,QAAQ;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAsBD,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,IAAI,+BAA8E,CAAC;AACnF,MAAM,UAAU,0BAA0B;IACxC,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,+BAA+B,GAAG,OAAO,CAAC;IAC5C,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/cli/init/templates.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,kEAAkE;AAClE,sEAAsE;AACtE,0DAA0D;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sEAAsE,CAAC;AAEhH,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAy9B3B,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6OrB,CAAC;AAEF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI7D,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,wBAAuD,CAAC;AAC5D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,wBAAwB,GAAG,QAAQ,CAAC,QAAQ;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAsBD,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,IAAI,+BAA8E,CAAC;AACnF,MAAM,UAAU,0BAA0B;IACxC,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,+BAA+B,GAAG,OAAO,CAAC;IAC5C,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.js

@@ -36,14 +36,29 @@
 //     failed capture, through the same `persistStdinReport` the operator
 //     path uses. That log is what the block envelope's malformed-sections
 //     notice is rendered from, so the per-capture write is deliberate.
+//
+// FOLLOW-UP (agent-tasks 49d1ee41) adds the second report channel the
+// ADR's "Report capture under `-p`" fallback describes: a report-bound
+// delegation (one `harness delegate --report <path>` minted) is verified
+// against the CONVENTIONAL launcher-report path
+// (`delegationReportPathFor`, a plain function of the child session id,
+// never a value read from the payload), and on success that file's
+// content is persisted the same way a transcript hit is: adopted once
+// (this time keyed by the report's CONTENT hash, in the same
+// `.delegation-adoptions/` ledger, so the same launcher report cannot
+// mint a second marker once the first one expires), persisted `pending`
+// via `persistStdinReport`, and left for the auto path below to consume.
+// The transcript scan never runs for a report-bound delegation: the two
+// channels are mutually exclusive per delegation, decided by whether
+// `verifyDelegation` returns a `reportPathHash`.
 import { appendFileSync, existsSync, lstatSync, mkdirSync } from "node:fs";
 import * as path from "node:path";
 import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
 import { queryLedgerByTag, } from "../../policies/index.js";
 import { renderProducers } from "../../policies/producers.js";
-import { ADOPTION_LEDGER_DIRNAME, CLAUDE_CODE_HARNESS, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, delegationMarkerPathFor, harnessAllowed, listPersistedReports, matchLedgerEntries, parseAutoApprove, readActiveClaim, recordPermissionModeObservation, selectNewestStrictSessionReport, verifyDelegation, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { ADOPTION_LEDGER_DIRNAME, CLAUDE_CODE_HARNESS, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, delegationMarkerPathFor, delegationReportPathFor, harnessAllowed, listPersistedReports, matchLedgerEntries, parseAutoApprove, readActiveClaim, recordPermissionModeObservation, selectNewestStrictSessionReport, verifyDelegation, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveMode, toPackageMode, } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { signingKeyExists } from "../../runtime/approval-signing.js";
+import { sha256Hex, signingKeyExists } from "../../runtime/approval-signing.js";
 import { findLatestParseError, renderMalformedSectionsNotice } from "../approve/understanding.js";
 import { persistStdinReport } from "../approve/stdin-report.js";
 import { attemptAutoApproval, AUTO_APPROVE_LEDGER_SOURCE } from "./auto-approve-path.js";
@@ -719,6 +734,14 @@ export async function runPackHookPreToolUseCli(opts = {}) {
                 stderr.write("harness pack hook: delegation present but signing key absent; not verified\n");
             }
             else {
+                // The conventional launcher-report path (a plain function of
+                // `childSessionId`, never a value read from the payload or from
+                // the delegation file itself): offered unconditionally, exactly
+                // as `verifyDelegation` expects. It only affects the outcome when
+                // the delegation actually binds a `report=` segment; for every
+                // other delegation it is read and then never consulted (see the
+                // `reportPathHash !== undefined` guard inside `verifyDelegation`).
+                const launcherReportPath = delegationReportPathFor(generatedDir, childSessionId);
                 const verified = verifyDelegation({
                     generatedDir,
                     childSessionId,
@@ -735,31 +758,39 @@ export async function runPackHookPreToolUseCli(opts = {}) {
                     // so there is no resolved value to reuse without widening that
                     // shared runtime's return shape for one caller.
                     taskId: readActiveClaim(generatedDir),
+                    launcherReportPath,
                 });
                 if (!verified.ok) {
-                    if (verified.reason === "report_path_mismatch") {
-                        // This hook never passes `launcherReportPath` to
-                        // `verifyDelegation`, so a delegation that binds one (the
-                        // `--report` fallback shape) is refused here every time,
-                        // not merely on a path/content mismatch. Name the actual
-                        // limitation instead of the generic `report_path_mismatch`
-                        // wording `verified.detail` carries: the fallback shape is
-                        // issued and signature-verifiable by `harness delegate`, it
-                        // is just not yet consumed by THIS hook (a named
-                        // follow-up); the transcript scan below is the only report
-                        // channel this hook acts on today.
-                        stderr.write(`harness pack hook: delegation for ${childSessionId} refused: it binds a launcher-supplied report file (the --report fallback shape), which is issued and verifiable but not yet consumed by the child hook (a named follow-up); the transcript scan is the only report channel this hook acts on\n`);
-                    }
-                    else {
-                        stderr.write(`harness pack hook: delegation for ${childSessionId} refused: ${verified.reason}: ${verified.detail}\n`);
-                    }
+                    // An absent, moved, or content-modified launcher report surfaces
+                    // here through the verifier's own distinct reasons
+                    // (`report_missing` / `report_path_mismatch` /
+                    // `report_content_mismatch`), same as every other refusal: no
+                    // special-casing needed now that this hook actually checks the
+                    // fallback shape against a file. `verified.detail` names the
+                    // expected path for the three file-state cases this hook can
+                    // actually reach (absent / wrong path / wrong bytes). Two of
+                    // `verifyDelegation`'s binding-shape branches are unreachable
+                    // from here for different reasons, so their details are worth
+                    // spelling out separately rather than lumping them together:
+                    // "no report path offered" never fires from this call site,
+                    // since this hook always offers the conventional path
+                    // (`launcherReportPath` above is unconditional); "no
+                    // reportContentHash to check against" IS reachable here, just
+                    // not from a delegation this hook itself minted, since
+                    // `writeDelegationMarker` refuses to produce that half-binding
+                    // shape (a hand-signed marker can still carry it, as the
+                    // half-binding test in
+                    // understanding-before-execution-delegation.test.ts shows), and
+                    // its detail names the delegation marker's own path, not the
+                    // report path, since there is no report path yet to name.
+                    stderr.write(`harness pack hook: delegation for ${childSessionId} refused: ${verified.reason}: ${verified.detail}\n`);
                 }
                 else {
                     delegation = { parentSessionId: verified.parentSessionId };
                     // Key two: the child's own report. Already on disk and pending
                     // (the child was denied once and its report has since been
-                    // captured) means there is nothing to scan for, so the
-                    // transcript is not read at all.
+                    // captured) means there is nothing to scan for, so neither
+                    // channel below is read at all.
                     // `childSessionId`, not the outer `sessionId`: this whole block
                     // decides the PAYLOAD's session, and the two only coincide
                     // because the env fallback never wins on a path that carries a
@@ -767,93 +798,184 @@ export async function runPackHookPreToolUseCli(opts = {}) {
                     // branch looks for bound to the same session the delegation,
                     // the scan and the adoption ledger are all keyed by.
                     const existing = selectNewestStrictSessionReport(listPersistedReports(reportsDir), childSessionId);
+                    // A report-bound delegation (the `--report` fallback shape,
+                    // `verified.reportPathHash !== undefined`) never falls through
+                    // to the transcript scan: the launcher already supplied and
+                    // proved (via the verify call above) the report the child would
+                    // otherwise have to emit into its own transcript, so scanning
+                    // for a second copy would be pointless and would let a
+                    // report-bound delegation ALSO be satisfied by whatever the
+                    // child happens to write, which defeats the point of the
+                    // launcher fixing the content.
                     if (existing === null || existing.approvalStatus !== "pending") {
-                        const transcriptPath = typeof event.transcript_path === "string" && event.transcript_path.length > 0
-                            ? event.transcript_path
-                            : null;
-                        // The once-per-session adoption ledger, read only on the path
-                        // that can actually capture something.
-                        const adoptedPath = adoptedEntriesPathFor(generatedDir, childSessionId);
-                        const adopted = transcriptPath === null
-                            ? { ok: true, ids: new Set() }
-                            : readAdoptedEntries(adoptedPath);
-                        if (transcriptPath === null) {
-                            stderr.write(`harness pack hook: delegation for ${childSessionId} is valid but the payload carries no transcript_path; the child's report cannot be captured\n`);
-                        }
-                        else if (!adopted.ok) {
-                            // Fail closed: without the ledger we cannot tell a fresh
-                            // report from one this session already spent.
-                            stderr.write(`harness pack hook: the adopted-entry ledger at ${adoptedPath} could not be read (${adopted.detail}); refusing to capture a transcript entry that may already have been adopted for session ${childSessionId}\n`);
-                        }
-                        else {
-                            const scan = await scanTranscriptForReport({
-                                transcriptPath,
-                                sessionId: childSessionId,
-                                maxWaitMs: autoCfg.reportScan.maxWaitMs,
-                                adopted: adopted.ids,
-                                ...(opts.reportScanClock?.now !== undefined
-                                    ? { now: opts.reportScanClock.now }
-                                    : {}),
-                                ...(opts.reportScanClock?.sleep !== undefined
-                                    ? { sleep: opts.reportScanClock.sleep }
-                                    : {}),
-                                ...(opts.reportScanClock?.pollMs !== undefined
-                                    ? { pollMs: opts.reportScanClock.pollMs }
-                                    : {}),
-                            });
-                            if (scan.found) {
-                                // RECORD THE ADOPTION FIRST, then persist. In this order a
-                                // failed ledger write costs one blocked call and leaves the
-                                // entry re-scannable, while the reverse order would leave a
-                                // persisted, mintable report behind an unrecorded adoption:
-                                // exactly the replay this ledger exists to stop.
-                                const recorded = recordAdoptedEntry(adoptedPath, scan.entryId);
-                                if (!recorded.ok) {
-                                    stderr.write(`harness pack hook: could not record transcript entry ${scan.entryId} as adopted for session ${childSessionId} (${recorded.detail}); nothing was persisted\n`);
+                        if (verified.reportPathHash !== undefined) {
+                            // The bytes `verifyDelegation` already proved present,
+                            // path-matched, and content-matched against the bound
+                            // hash, returned verbatim on its ok shape. There is NO
+                            // second read of `launcherReportPath` here on purpose: a
+                            // second read would be a second trust decision, reopening
+                            // the exact race (a rewrite between verification and
+                            // persist) that returning the verified bytes closes
+                            // structurally instead of by re-checking a hash.
+                            const reportContent = verified.reportContent;
+                            if (reportContent === undefined) {
+                                // Cannot happen given the invariant `reportContent` is
+                                // set whenever `reportPathHash` is (see the type's own
+                                // doc comment); fail closed rather than persist nothing
+                                // we can vouch for.
+                                stderr.write(`harness pack hook: the launcher-supplied report for session ${childSessionId} at ${launcherReportPath} was verified but no content was returned; nothing was persisted\n`);
+                            }
+                            else {
+                                const contentHash = sha256Hex(reportContent);
+                                // Adoption keyed by the report's CONTENT hash, in the
+                                // SAME once-per-session ledger the transcript scan uses,
+                                // namespaced with a `report:` prefix so the two id shapes
+                                // (`uuid:...` / `digest:...` for a transcript entry,
+                                // `report:...` here) can never collide. Without this a
+                                // launcher report could mint a fresh marker every time an
+                                // earlier one expired, for as long as the delegation
+                                // itself stayed valid: the delegation's TTL would
+                                // silently become the report's own re-mint budget instead
+                                // of a one-shot authorization.
+                                const adoptedPath = adoptedEntriesPathFor(generatedDir, childSessionId);
+                                const adopted = readAdoptedEntries(adoptedPath);
+                                const entryId = `report:${contentHash}`;
+                                if (!adopted.ok) {
+                                    // Fail closed: without the ledger we cannot tell a
+                                    // fresh report from one this session already spent.
+                                    stderr.write(`harness pack hook: the adopted-entry ledger at ${adoptedPath} could not be read (${adopted.detail}); refusing to adopt a launcher-supplied report that may already have been adopted for session ${childSessionId}\n`);
+                                }
+                                else if (adopted.ids.has(entryId)) {
+                                    stderr.write(`harness pack hook: the launcher-supplied report for session ${childSessionId} was already adopted by an earlier mint; refusing to re-mint from the same report (issue a fresh delegation with a new report to authorize another mint)\n`);
                                 }
                                 else {
-                                    // Reuses the SAME persister `harness approve
-                                    // understanding` uses for a heredoc-attached report, so
-                                    // the capture is session-bound, `pending`, and validated
-                                    // by one parser rather than a second one written here.
-                                    // A real `new Date()` on purpose: the persisted report
-                                    // must sort as the newest strict-session report against
-                                    // whatever is already on disk, which a caller-injected
-                                    // clock could not guarantee.
-                                    const persisted = persistStdinReport({
-                                        markdown: scan.markdown,
-                                        reportsDir,
-                                        sessionId: childSessionId,
-                                        now: new Date(),
-                                        mode: toPackageMode(resolveMode(declared).mode),
-                                    });
-                                    if (persisted.ok) {
-                                        stderr.write(`harness pack hook: captured the Understanding Report for session ${childSessionId} from its own transcript (line ${scan.lineIndex}, after ${scan.waitedMs}ms) and persisted it pending at ${persisted.filePath}\n`);
+                                    // RECORD THE ADOPTION FIRST, then persist, same ordering
+                                    // and same reasoning as the transcript-scan path below:
+                                    // a failed ledger write costs one blocked call and
+                                    // leaves the report re-adoptable, while the reverse
+                                    // order would leave a persisted, mintable report behind
+                                    // an unrecorded adoption.
+                                    const recorded = recordAdoptedEntry(adoptedPath, entryId);
+                                    if (!recorded.ok) {
+                                        stderr.write(`harness pack hook: could not record the launcher-supplied report as adopted for session ${childSessionId} (${recorded.detail}); nothing was persisted\n`);
                                     }
                                     else {
-                                        // The entry stays adopted: re-reading a report that
-                                        // does not parse would fail identically forever, so
-                                        // the child needs a NEW one, which is what the block's
-                                        // retry instruction asks for. Set the same flag the
-                                        // timeout branch sets, for that reason: the retry
-                                        // sentence reads correctly for this case too, and
-                                        // without it the block below would ask for a retry
-                                        // implicitly while never saying so.
-                                        reportScanTimedOut = true;
-                                        stderr.write(`harness pack hook: the transcript report for session ${childSessionId} did not parse (${persisted.reason}); nothing was persisted\n`);
+                                        const persisted = persistStdinReport({
+                                            markdown: reportContent,
+                                            reportsDir,
+                                            sessionId: childSessionId,
+                                            now: new Date(),
+                                            mode: toPackageMode(resolveMode(declared).mode),
+                                        });
+                                        if (persisted.ok) {
+                                            stderr.write(`harness pack hook: adopted the launcher-supplied report for session ${childSessionId} from ${launcherReportPath} and persisted it pending at ${persisted.filePath}\n`);
+                                        }
+                                        else {
+                                            // The entry stays adopted: the launcher's report is
+                                            // fixed content, so re-reading it would fail to
+                                            // parse identically forever. Unlike the transcript
+                                            // path this is not recoverable by a child retry
+                                            // (the child does not control the launcher's file),
+                                            // so no retry instruction is set here.
+                                            stderr.write(`harness pack hook: the launcher-supplied report for session ${childSessionId} did not parse (${persisted.reason}); nothing was persisted\n`);
+                                        }
                                     }
                                 }
                             }
-                            else if (scan.reason === "timeout") {
-                                reportScanTimedOut = true;
-                                stderr.write(scan.adoptedOnly === true
-                                    ? `harness pack hook: the newest Understanding Report entry in the transcript for session ${childSessionId} was already adopted; emit a fresh report\n`
-                                    : `harness pack hook: no Understanding Report for session ${childSessionId} reached its transcript within ${autoCfg.reportScan.maxWaitMs}ms (waited ${scan.waitedMs}ms); blocking and asking the child to re-emit and retry\n`);
+                            // The transcript scan below never runs for a report-bound
+                            // delegation: this `if` branch is its own complete
+                            // report-capture attempt.
+                        }
+                        else {
+                            const transcriptPath = typeof event.transcript_path === "string" && event.transcript_path.length > 0
+                                ? event.transcript_path
+                                : null;
+                            // The once-per-session adoption ledger, read only on the path
+                            // that can actually capture something.
+                            const adoptedPath = adoptedEntriesPathFor(generatedDir, childSessionId);
+                            const adopted = transcriptPath === null
+                                ? { ok: true, ids: new Set() }
+                                : readAdoptedEntries(adoptedPath);
+                            if (transcriptPath === null) {
+                                stderr.write(`harness pack hook: delegation for ${childSessionId} is valid but the payload carries no transcript_path; the child's report cannot be captured\n`);
+                            }
+                            else if (!adopted.ok) {
+                                // Fail closed: without the ledger we cannot tell a fresh
+                                // report from one this session already spent.
+                                stderr.write(`harness pack hook: the adopted-entry ledger at ${adoptedPath} could not be read (${adopted.detail}); refusing to capture a transcript entry that may already have been adopted for session ${childSessionId}\n`);
                             }
                             else {
-                                stderr.write(`harness pack hook: the transcript at ${transcriptPath} exists but could not be read; the report for session ${childSessionId} cannot be captured\n`);
+                                const scan = await scanTranscriptForReport({
+                                    transcriptPath,
+                                    sessionId: childSessionId,
+                                    maxWaitMs: autoCfg.reportScan.maxWaitMs,
+                                    adopted: adopted.ids,
+                                    ...(opts.reportScanClock?.now !== undefined
+                                        ? { now: opts.reportScanClock.now }
+                                        : {}),
+                                    ...(opts.reportScanClock?.sleep !== undefined
+                                        ? { sleep: opts.reportScanClock.sleep }
+                                        : {}),
+                                    ...(opts.reportScanClock?.pollMs !== undefined
+                                        ? { pollMs: opts.reportScanClock.pollMs }
+                                        : {}),
+                                });
+                                if (scan.found) {
+                                    // RECORD THE ADOPTION FIRST, then persist. In this order a
+                                    // failed ledger write costs one blocked call and leaves the
+                                    // entry re-scannable, while the reverse order would leave a
+                                    // persisted, mintable report behind an unrecorded adoption:
+                                    // exactly the replay this ledger exists to stop.
+                                    const recorded = recordAdoptedEntry(adoptedPath, scan.entryId);
+                                    if (!recorded.ok) {
+                                        stderr.write(`harness pack hook: could not record transcript entry ${scan.entryId} as adopted for session ${childSessionId} (${recorded.detail}); nothing was persisted\n`);
+                                    }
+                                    else {
+                                        // Reuses the SAME persister `harness approve
+                                        // understanding` uses for a heredoc-attached report, so
+                                        // the capture is session-bound, `pending`, and validated
+                                        // by one parser rather than a second one written here.
+                                        // A real `new Date()` on purpose: the persisted report
+                                        // must sort as the newest strict-session report against
+                                        // whatever is already on disk, which a caller-injected
+                                        // clock could not guarantee.
+                                        const persisted = persistStdinReport({
+                                            markdown: scan.markdown,
+                                            reportsDir,
+                                            sessionId: childSessionId,
+                                            now: new Date(),
+                                            mode: toPackageMode(resolveMode(declared).mode),
+                                        });
+                                        if (persisted.ok) {
+                                            stderr.write(`harness pack hook: captured the Understanding Report for session ${childSessionId} from its own transcript (line ${scan.lineIndex}, after ${scan.waitedMs}ms) and persisted it pending at ${persisted.filePath}\n`);
+                                        }
+                                        else {
+                                            // The entry stays adopted: re-reading a report that
+                                            // does not parse would fail identically forever, so
+                                            // the child needs a NEW one, which is what the block's
+                                            // retry instruction asks for. Set the same flag the
+                                            // timeout branch sets, for that reason: the retry
+                                            // sentence reads correctly for this case too, and
+                                            // without it the block below would ask for a retry
+                                            // implicitly while never saying so.
+                                            reportScanTimedOut = true;
+                                            stderr.write(`harness pack hook: the transcript report for session ${childSessionId} did not parse (${persisted.reason}); nothing was persisted\n`);
+                                        }
+                                    }
+                                }
+                                else if (scan.reason === "timeout") {
+                                    reportScanTimedOut = true;
+                                    stderr.write(scan.adoptedOnly === true
+                                        ? `harness pack hook: the newest Understanding Report entry in the transcript for session ${childSessionId} was already adopted; emit a fresh report\n`
+                                        : `harness pack hook: no Understanding Report for session ${childSessionId} reached its transcript within ${autoCfg.reportScan.maxWaitMs}ms (waited ${scan.waitedMs}ms); blocking and asking the child to re-emit and retry\n`);
+                                }
+                                else {
+                                    stderr.write(`harness pack hook: the transcript at ${transcriptPath} exists but could not be read; the report for session ${childSessionId} cannot be captured\n`);
+                                }
                             }
                         }
+                        // Closes the `if (verified.reportPathHash !== undefined) { ... }
+                        // else { <transcript scan> }` branch opened above.
                     }
                 }
             }