@lannguyensi/harness 0.56.0 → 0.58.0

package/dist/runtime/git-context.js

@@ -21,6 +21,7 @@
 // signal; those exotic overrides are out of scope.
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { isValidProjectName } from "../io/project-name.js";
 const EMPTY = { repo: "", branch: "", sha: "" };
 // A `.git` *file* (linked worktree / submodule) points at the real git
 // dir: `gitdir: <path>`.
@@ -248,7 +249,19 @@ export function resolveCommonDir(gitDir) {
     try {
         const raw = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
         if (raw.length > 0) {
-            return path.isAbsolute(raw) ? raw : path.resolve(gitDir, raw);
+            // `path.normalize` on the absolute branch (review round 3,
+            // decision D-028's security finding): the relative branch already
+            // normalizes via `path.resolve`, but an absolute `commondir`
+            // value was returned verbatim, `..` segments and all. A crafted
+            // `.git` FILE pointing at a private gitdir whose `commondir` file
+            // holds an absolute path ending in unresolved `..` segments (e.g.
+            // `<gitDir>/../..`) then reached `deriveProjectName` below with
+            // those segments still literally present, `path.basename` textually
+            // returning `..` instead of the intended ancestor directory's real
+            // name. Normalizing here closes that off at the source, before
+            // either caller (`resolveOriginHeadBase`, `deriveProjectName`)
+            // ever sees the raw value.
+            return path.isAbsolute(raw) ? path.normalize(raw) : path.resolve(gitDir, raw);
         }
     }
     catch {
@@ -256,4 +269,154 @@ export function resolveCommonDir(gitDir) {
     }
     return gitDir;
 }
+// ---------------------------------------------------------------------------
+// Repository-identity derivation for per-repo config scoping (task
+// c88461c1, review round 2, decision D-021a).
+//
+// Round 1 fed `resolveGitContext(cwd).repo` (the WORK-TREE basename)
+// into the `session_start_preflight.setup` project-layer lookup. That
+// is wrong for a linked worktree: `git worktree add ../foo` gives the
+// linked checkout its OWN directory name, so two worktrees of the SAME
+// repository resolved two DIFFERENT project layers, and neither one
+// matched the name an operator would naturally pick for the shared
+// project override file. `repo` stays exactly as-is for its existing
+// consumer (the `preflight:${REPO}` ledger tag, `src/cli/session-start/
+// index.ts`), a ledger tag namespaced per CHECKOUT is a defensible,
+// unrelated design choice, and changing it is out of this task's scope.
+// This is a SEPARATE derivation for a SEPARATE purpose: naming the
+// `<home>/projects/<name>/harness.overrides.yaml` layer that should
+// apply to every linked worktree of one repository alike.
+// ---------------------------------------------------------------------------
+/**
+ * Derive the project-layer name for `cwd`: the basename of the
+ * directory that CONTAINS the repository's shared git common dir (the
+ * main checkout), so every linked worktree of one repository resolves
+ * the same name, unlike `resolveGitContext(cwd).repo`, which names the
+ * checkout directory itself and therefore differs per worktree. Feeds
+ * `LoaderOptions.project` (the same seam every command's own
+ * `--project <name>` flag already uses) for `harness session-start
+ * preflight`, `harness explain-policy`, and `harness doctor` alike (one
+ * helper, three consumers, so the three cannot silently disagree on
+ * what "this repository's project name" means).
+ *
+ * Resolution:
+ *  - `findGitEntry(cwd)` walks up to the `.git` entry, exactly like
+ *    `resolveGitContext`.
+ *  - `resolveCommonDir(entry.gitDir)` follows a linked worktree's
+ *    `commondir` file to the shared common dir (a no-op for the main
+ *    checkout, which has none).
+ *  - The COMMON DIR's basename is normally literally `.git` (a
+ *    directory or, in a linked worktree's private gitdir, the resolved
+ *    target of a `.git` FILE): in that shape the project name is one
+ *    level further up, the basename of the directory THAT CONTAINS the
+ *    common dir, i.e. the main checkout's own directory name.
+ *  - For a BARE repository (`git init --bare`, or a linked worktree
+ *    created FROM one), there is no `.git` wrapper at all, the common
+ *    dir IS the bare directory itself (its basename is not `.git`), so
+ *    that basename is the project name directly, with no extra `..`
+ *    step. This is the one shape where going up an extra level would
+ *    be wrong (it would name the bare directory's PARENT instead), and
+ *    the `.git` SUFFIX in a conventionally-named bare directory (e.g.
+ *    `myrepo.git`) is kept, not stripped.
+ *  - A SUBMODULE checkout (`git submodule add`) derives the submodule's
+ *    OWN name, not its superproject's: a submodule's `.git` FILE points
+ *    at a private gitdir under the superproject's `.git/modules/<name>/`
+ *    tree, which has no `commondir` file of its own (that mechanism is
+ *    for linked worktrees, not submodules), so `resolveCommonDir` is a
+ *    no-op and the submodule's own checkout directory basename applies
+ *    directly, same as a normal (non-worktree) repo.
+ *  - A `git init --separate-git-dir=<dir>` checkout derives the GIT
+ *    DIR's own basename, NOT the work tree's: the `.git` file at the
+ *    work tree root points at `<dir>` with no `commondir` file either
+ *    (again a linked-worktree-only mechanism), so `resolveCommonDir` is
+ *    a no-op and `<dir>`'s own basename (e.g. `sepgit.git`) is the
+ *    derived name, exactly like the bare-repository shape above; the
+ *    work tree's own directory name never enters into it.
+ *
+ * Returns `null` when `cwd` is not inside a git work tree (mirrors
+ * `resolveGitContext`'s "" for the same case), when `entry.gitDir`
+ * could not be resolved at all (an unreadable `.git` FILE, see
+ * `findGitEntry`'s doc comment; in that case this falls back to the
+ * checkout directory's own basename, the same value `repo` would
+ * carry, rather than guessing at a common dir it has no path to), or
+ * when the resolved name fails {@link isValidProjectName} (review
+ * round 3, decision D-028's security finding: an untrusted on-disk
+ * `commondir`/`.git` FILE value must never hand a caller a name like
+ * `""`, `"."`, `".."`, or one containing a path separator, since every
+ * consumer joins it straight into a filesystem path,
+ * `resolvePaths`/`src/cli/loader.ts`; task `e904f25a` extended the same
+ * exit to a name containing a control character, which no consumer could
+ * render safely). A rejection here is silent by design: no project
+ * override layer resolves for that repository and the base/machine value
+ * applies, exactly as for a repository that simply has no layer on disk.
+ * Never throws.
+ *
+ * REALPATH (task c88461c1, review round 3 residual; task `1c4eb3ea`
+ * of the batch-44 follow-up run): the common dir is resolved through
+ * `fs.realpathSync` BEFORE taking its basename, so a checkout reached
+ * through a symlink (an operator's own convenience symlink, or a
+ * second clone path) derives the SAME project name as the real
+ * directory it points at, matching D-021a's "repository identity is
+ * the common dir" rule: two paths to one repository must resolve one
+ * project layer, not two. Best-effort: `realpathSync` failing (a
+ * dangling symlink, a permissions error) falls back to the
+ * un-resolved common dir rather than throwing, so a repository that
+ * was reachable before this change stays reachable.
+ */
+export function deriveProjectName(cwd) {
+    if (typeof cwd !== "string" || cwd.length === 0)
+        return null;
+    const entry = findGitEntry(cwd);
+    if (!entry)
+        return null;
+    if (!entry.gitDir) {
+        const fallback = path.basename(entry.worktreeRoot);
+        return isValidProjectName(fallback) ? fallback : null;
+    }
+    let commonDir = resolveCommonDir(entry.gitDir);
+    try {
+        commonDir = fs.realpathSync(commonDir);
+    }
+    catch {
+        /* dangling symlink or unreadable target, keep the un-resolved commonDir */
+    }
+    const commonDirBase = path.basename(commonDir);
+    const projectDir = commonDirBase === ".git" ? path.dirname(commonDir) : commonDir;
+    const name = path.basename(projectDir);
+    return isValidProjectName(name) ? name : null;
+}
+/**
+ * Shared `opts.project ?? deriveProjectName(cwd) ?? fallback` resolution,
+ * used by two of the three producers of a per-repo-scoped
+ * `session_start_preflight` project name: `harness doctor`'s second,
+ * project-scoped load and the `session_start_preflight` producer. Both
+ * surfaces agree on the first two terms (an explicit `--project`, then
+ * the cwd-derived name); only the fallback differs by call site, and
+ * this helper takes it as an explicit argument so that difference is
+ * named rather than duplicated inline. The third producer,
+ * `harness explain-policy` (`src/cli/explain-policy.ts`), keeps its own
+ * copy of the same expression with a third fallback (`undefined`);
+ * folding it into this helper is deliberately out of scope of task
+ * `f1eb1c5c`. No observable behaviour change versus either surface's
+ * own prior inline expression, other than doctor's `cwd` expression
+ * now being evaluated eagerly (see the call site): this only extracts
+ * the shared shape.
+ */
+export function resolveScopedProjectName(opts) {
+    return opts.project ?? deriveProjectName(opts.cwd) ?? opts.fallback;
+}
+/**
+ * `{project}` value validation and safe display now live in
+ * `src/io/project-name.ts` (task `b5e6ccb0`): `buildLockEntries`
+ * (`src/io/harness-lock.ts`) is itself a `{project}` sink, and `io/` may
+ * not import from `runtime/` (`io-no-upward-imports`,
+ * `.dependency-cruiser.cjs`), so the shared logic moved down rather than
+ * `harness-lock.ts` re-implementing it. Re-exported here so every
+ * existing consumer that imports `isValidProjectName` /
+ * `sanitizeProjectForDisplay` from `../runtime/git-context.js` keeps
+ * working unchanged; see `src/io/project-name.ts` for the doc comments
+ * (the sink inventory, the two-screen rationale, the display-stripping
+ * invariant).
+ */
+export { isValidProjectName, sanitizeProjectForDisplay } from "../io/project-name.js";
 //# sourceMappingURL=git-context.js.map

package/dist/runtime/git-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/runtime/git-context.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,mDAAmD;AAEnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBlC,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEhE,uEAAuE;AACvE,yBAAyB;AACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,sEAAsE;AACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,KAAK;oBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAChE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,uDAAuD;gBACvD,wDAAwD;gBACxD,cAAc;gBACd,GAAG,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,iDAAiD;AACjD,yEAAyE;AACzE,oEAAoE;AACpE,yEAAyE;AACzE,qEAAqE;AACrE,iEAAiE;AACjE,iEAAiE;AACjE,mBAAmB;AACnB,8EAA8E;AAE9E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE;aACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAC5E,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChD,IAAI,GAAG,KAAK,oBAAoB;gBAAE,OAAO,GAAG,GAAG,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACnE,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"git-context.js","sourceRoot":"","sources":["../../src/runtime/git-context.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,aAAa;AACb,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,gEAAgE;AAChE,mDAAmD;AAEnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAsB3D,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEhE,uEAAuE;AACvE,yBAAyB;AACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,sEAAsE;AACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACnB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,KAAK;oBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QAC3D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAChE,IAAI,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,uDAAuD;gBACvD,wDAAwD;gBACxD,cAAc;gBACd,GAAG,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,iDAAiD;AACjD,yEAAyE;AACzE,oEAAoE;AACpE,yEAAyE;AACzE,qEAAqE;AACrE,iEAAiE;AACjE,iEAAiE;AACjE,mBAAmB;AACnB,8EAA8E;AAE9E,oEAAoE;AACpE,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE;aACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;aAC5E,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChD,IAAI,GAAG,KAAK,oBAAoB;gBAAE,OAAO,GAAG,GAAG,CAAC;;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACnE,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,2DAA2D;YAC3D,kEAAkE;YAClE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,+DAA+D;YAC/D,2BAA2B;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IACD,IAAI,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAI,IAAwC;IAClF,OAAO,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/runtime/index.d.ts

@@ -3,7 +3,7 @@ export { evaluateWhen, type WhenClauseKey, type WhenClauseResult, type WhenConte
 export { recordPolicyDecision, recordPolicyDecisionOnSession, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, decisionSortKey, type LedgerRecordOptions, type PolicyDecisionPayload, } from "../io/ledger-record.js";
 export { resolveSessionId } from "./session-id.js";
 export { buildAgentFacingBlock, formatAgentFacingMessage, renderAgentFacing, type AgentFacingBlock, } from "./agent-facing.js";
-export { resolveGitContext, type GitRepoContext } from "./git-context.js";
+export { resolveGitContext, deriveProjectName, isValidProjectName, resolveScopedProjectName, type GitRepoContext, type ResolveScopedProjectNameOptions, } from "./git-context.js";
 export { buildActionEnvelope, type ActionEnvelope, type ActionEnvelopeRuntime, type ActionEnvelopeSession, type EnvelopeContext, } from "./action-envelope.js";
 export { classifyRisk, type RiskConfidence, type RiskProfile, } from "./risk-classifier.js";
 export { resolveDeletionTarget, type DeletionTargetVerdict, } from "./deletion-target-resolve.js";

package/dist/runtime/index.js

@@ -3,7 +3,7 @@ export { evaluateWhen, } from "./when-eval.js";
 export { recordPolicyDecision, recordPolicyDecisionOnSession, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, decisionSortKey, } from "../io/ledger-record.js";
 export { resolveSessionId } from "./session-id.js";
 export { buildAgentFacingBlock, formatAgentFacingMessage, renderAgentFacing, } from "./agent-facing.js";
-export { resolveGitContext } from "./git-context.js";
+export { resolveGitContext, deriveProjectName, isValidProjectName, resolveScopedProjectName, } from "./git-context.js";
 export { buildActionEnvelope, } from "./action-envelope.js";
 export { classifyRisk, } from "./risk-classifier.js";
 export { resolveDeletionTarget, } from "./deletion-target-resolve.js";

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GASvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAKpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,GAInB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,GAGd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GASvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,GAKpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,GAInB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,GAGd,MAAM,iBAAiB,CAAC"}

package/dist/runtime/task-providers/agent-tasks.d.ts

@@ -0,0 +1,90 @@
+export declare const AGENT_TASKS_MCP_PREFIX = "mcp__agent-tasks__";
+export declare const TASK_START_TOOL = "mcp__agent-tasks__task_start";
+export declare const TASK_FINISH_TOOL = "mcp__agent-tasks__task_finish";
+export declare const TASK_ABANDON_TOOL = "mcp__agent-tasks__task_abandon";
+export declare const TASKS_TRANSITION_TOOL = "mcp__agent-tasks__tasks_transition";
+export declare const TASK_MERGE_TOOL = "mcp__agent-tasks__task_merge";
+export declare const PULL_REQUESTS_MERGE_TOOL = "mcp__agent-tasks__pull_requests_merge";
+export declare const ACTIVE_CLAIM_TOOL_NAMES: readonly ["mcp__agent-tasks__task_start", "mcp__agent-tasks__task_finish", "mcp__agent-tasks__task_abandon", "mcp__agent-tasks__tasks_transition", "mcp__agent-tasks__task_merge"];
+export declare const DEFAULT_BOUNDARY_TOOL_NAMES: readonly ["mcp__agent-tasks__task_finish", "mcp__agent-tasks__task_abandon", "mcp__agent-tasks__pull_requests_merge", "mcp__agent-tasks__tasks_transition"];
+export declare const DEFAULT_PROTECTED_COMPLETION_TOOLS: readonly ["task_finish", "task_submit_pr", "task_merge", "pull_requests_merge"];
+export declare const TASK_FINISH_AUTOMERGE_INPUT_MATCH: Record<string, boolean>;
+export declare const TASK_ID_EXTRACT: Record<string, string>;
+export declare const PR_NUMBER_EXTRACT: Record<string, string>;
+export declare function taskIdFromInput(input: unknown): string;
+export declare function tasksTransitionStatusFromInput(input: unknown): string;
+export declare function tasksTransitionReleasesClaim(input: unknown): boolean;
+/**
+ * Read the resulting status off a task_finish tool RESULT (not the
+ * request), unwrapping whichever transport shape it arrived in (see
+ * `unwrapToolResponseEnvelope`). Returns `null` when the result is
+ * absent, malformed, or carries no string status, so a caller can tell
+ * "the task landed on a known non-review status" apart from "we could
+ * not tell" (task c86e3c4a).
+ */
+export declare function taskFinishResultingStatus(toolResponse: unknown): string | null;
+/**
+ * Read the acted-on task id off a task_finish (or any agent-tasks) tool
+ * RESULT, unwrapping the same shapes as `taskFinishResultingStatus`.
+ * Used as a fallback when the tool_input did not carry a `taskId` (task
+ * c86e3c4a, id-equality guard on release verbs).
+ */
+export declare function taskIdFromToolResponse(toolResponse: unknown): string;
+/**
+ * Diagnostic-only companion to `claimEffectForAgentTasksTool`: was a
+ * task_finish's resulting status actually readable? This does NOT feed
+ * back into the release/keep decision (that stays the classifier's
+ * alone) -- it lets `hook-track-active-claim.ts` label its stderr line
+ * so a silent fail-safe fallback release does not look identical to an
+ * intentional `done` release in the operator's own trail (task
+ * c86e3c4a).
+ */
+export declare function taskFinishReleaseIsUnreadable(toolResponse: unknown): boolean;
+/**
+ * Coarse shape label for a tool_response, for the same stderr diagnostic
+ * above -- never used to decide anything, only to name what shape a
+ * fail-safe release fell back from.
+ */
+export declare function describeToolResponseShape(toolResponse: unknown): "array" | "string" | "object" | "absent";
+export declare function agentTasksToolName(verb: string): string;
+/** Alias-aware for runtime events, including mcp__server.verb variants. */
+export declare function matchesAgentTasksRuntimeVerb(toolName: string, verbs: readonly string[]): boolean;
+/** Strict canonical parsing for Solution Acceptance's deliberately narrow gate. */
+export declare function canonicalAgentTasksVerb(toolName: string, verbs: readonly string[]): string | null;
+export type ClaimEffect = "acquire" | "release" | "none";
+/**
+ * Claim lifecycle is separate from approval boundaries: only a completed
+ * legacy transition releases a claim, while abandon and merge always do.
+ *
+ * task_finish is decided from the RESULT, not the verb (task c86e3c4a):
+ * agent-tasks's own v2 semantics clear the work claim going to `done`
+ * and keep it going to `review`, so `toolResponse` (the tool RESULT
+ * envelope, optional third parameter -- the caller's PostToolUse event
+ * carries this alongside `tool_input`) is read via
+ * `taskFinishResultingStatus`. A resulting status of `review` returns
+ * `none` (keep); `done`, any other resolvable status, and an
+ * unresolvable result (no `toolResponse`, or a malformed one) all
+ * return `release`.
+ *
+ * Fail-safe rationale (task c86e3c4a -- corrected from an earlier
+ * wording of this comment that was wrong about what the marker feeds):
+ * the active-claim file
+ * this classifier feeds is read by the FAIL-CLOSED completion gate
+ * (`src/cli/pack/hook-solution-acceptance.ts`'s `readActiveClaim` call)
+ * to derive the verdict id it gates `task_finish` / `task_submit_pr` /
+ * `task_merge` / `pull_requests_merge` / `git push` on. Release-on-
+ * unreadable is chosen because a KEPT marker for a task that actually
+ * finished would fail OPEN: until the next `task_start` overwrites it,
+ * post-done completion-gated actions (git push, task_merge, PR merge)
+ * would pass on that finished task's already-accepted verdict, and the
+ * marker would override SOLUTION_VERDICT_ID. Releasing fails CLOSED
+ * instead, at the cost of a possible wedge (the gate refuses with "no
+ * active-claim task id recorded" until a fresh `task_start` or an
+ * operator clears the file). It is not costless, and it is not merely
+ * giving up an "ergonomic shortcut".
+ *
+ * This is the ONE place that decision is made: callers (e.g.
+ * `hook-track-active-claim.ts`) do not re-derive it locally.
+ */
+export declare function claimEffectForAgentTasksTool(toolName: string, input: unknown, toolResponse?: unknown): ClaimEffect;
+export declare function resolveProtectedCompletionTools(config: unknown): string[];

package/dist/runtime/task-providers/agent-tasks.js

@@ -0,0 +1,231 @@
+// Internal agent-tasks runtime adapter. Consumers keep their own event and
+// diagnostic handling; this module owns provider-specific semantics only.
+import { expandToolNameAliases } from "../tool-name-aliases.js";
+export const AGENT_TASKS_MCP_PREFIX = "mcp__agent-tasks__";
+export const TASK_START_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_start`;
+export const TASK_FINISH_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_finish`;
+export const TASK_ABANDON_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_abandon`;
+export const TASKS_TRANSITION_TOOL = `${AGENT_TASKS_MCP_PREFIX}tasks_transition`;
+export const TASK_MERGE_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_merge`;
+export const PULL_REQUESTS_MERGE_TOOL = `${AGENT_TASKS_MCP_PREFIX}pull_requests_merge`;
+export const ACTIVE_CLAIM_TOOL_NAMES = [
+    TASK_START_TOOL,
+    TASK_FINISH_TOOL,
+    TASK_ABANDON_TOOL,
+    TASKS_TRANSITION_TOOL,
+    TASK_MERGE_TOOL,
+];
+export const DEFAULT_BOUNDARY_TOOL_NAMES = [
+    TASK_FINISH_TOOL,
+    TASK_ABANDON_TOOL,
+    PULL_REQUESTS_MERGE_TOOL,
+    TASKS_TRANSITION_TOOL,
+];
+export const DEFAULT_PROTECTED_COMPLETION_TOOLS = [
+    "task_finish",
+    "task_submit_pr",
+    "task_merge",
+    "pull_requests_merge",
+];
+export const TASK_FINISH_AUTOMERGE_INPUT_MATCH = {
+    "toolArgs.autoMerge": true,
+};
+export const TASK_ID_EXTRACT = { TASK_ID: "toolArgs.taskId" };
+export const PR_NUMBER_EXTRACT = { PR_NUMBER: "toolArgs.prNumber" };
+function inputRecord(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+        return null;
+    return input;
+}
+export function taskIdFromInput(input) {
+    const taskId = inputRecord(input)?.["taskId"];
+    return typeof taskId === "string" ? taskId : "";
+}
+export function tasksTransitionStatusFromInput(input) {
+    const status = inputRecord(input)?.["status"];
+    return typeof status === "string" ? status : "";
+}
+export function tasksTransitionReleasesClaim(input) {
+    return tasksTransitionStatusFromInput(input) === "done";
+}
+/**
+ * Best-effort recursive unwrap of a task_finish tool RESULT into the
+ * mcp-server receipt object it ultimately carries, tolerating every
+ * transport shape observed or plausible for a PostToolUse event (task
+ * c86e3c4a: an earlier version of this function read only shape (a)
+ * below and was inert against the shape Claude Code actually sends):
+ *
+ *   (a) the receipt object itself, `{ ok, task: { id, status } }` -- both
+ *       the small default receipt and the `include:["task"]` full-object
+ *       variant, since both nest the task under `task` and this function
+ *       only reads that key, not the rest of the shape;
+ *   (b) Claude Code's REAL PostToolUse `tool_response` for an MCP tool
+ *       (live capture, claude 2.1.280): a content-block array
+ *       `[{ type: "text", text: "<json>" }, ...]` -- the first `text`
+ *       block is located and its `text` is JSON-parsed, then unwrapped
+ *       again as (a). See `tests/fixtures/track-active-claim/
+ *       real-posttooluse-task-finish-2.1.280.json` for the verbatim
+ *       redacted capture;
+ *   (c) an MCP `CallToolResult` object, `{ content: [{ type: "text",
+ *       text: "<json>" }] }` -- plausible on Codex, UNMEASURED here (no
+ *       Codex capture exists in this run; see
+ *       `docs/policy-packs/understanding-before-execution.md`), handled
+ *       defensively the same way as (b);
+ *   (d) a bare JSON string -- parsed once, then unwrapped again.
+ *
+ * Anything else, a `JSON.parse` failure at any step, or a nesting depth
+ * past a small guard, returns `null` so the caller fails safe rather
+ * than throwing or silently misreading.
+ */
+function unwrapToolResponseEnvelope(toolResponse, depth = 0) {
+    if (depth > 4)
+        return null;
+    if (typeof toolResponse === "string") {
+        let parsed;
+        try {
+            parsed = JSON.parse(toolResponse);
+        }
+        catch {
+            return null;
+        }
+        return unwrapToolResponseEnvelope(parsed, depth + 1);
+    }
+    if (Array.isArray(toolResponse)) {
+        const textBlock = toolResponse.find((block) => {
+            const rec = inputRecord(block);
+            return rec !== null && rec["type"] === "text" && typeof rec["text"] === "string";
+        });
+        const text = inputRecord(textBlock)?.["text"];
+        return typeof text === "string" ? unwrapToolResponseEnvelope(text, depth + 1) : null;
+    }
+    const record = inputRecord(toolResponse);
+    if (record === null)
+        return null;
+    if (Array.isArray(record["content"])) {
+        return unwrapToolResponseEnvelope(record["content"], depth + 1);
+    }
+    return record;
+}
+/**
+ * Read the resulting status off a task_finish tool RESULT (not the
+ * request), unwrapping whichever transport shape it arrived in (see
+ * `unwrapToolResponseEnvelope`). Returns `null` when the result is
+ * absent, malformed, or carries no string status, so a caller can tell
+ * "the task landed on a known non-review status" apart from "we could
+ * not tell" (task c86e3c4a).
+ */
+export function taskFinishResultingStatus(toolResponse) {
+    const task = unwrapToolResponseEnvelope(toolResponse)?.["task"];
+    const status = inputRecord(task)?.["status"];
+    return typeof status === "string" && status.length > 0 ? status : null;
+}
+/**
+ * Read the acted-on task id off a task_finish (or any agent-tasks) tool
+ * RESULT, unwrapping the same shapes as `taskFinishResultingStatus`.
+ * Used as a fallback when the tool_input did not carry a `taskId` (task
+ * c86e3c4a, id-equality guard on release verbs).
+ */
+export function taskIdFromToolResponse(toolResponse) {
+    const task = unwrapToolResponseEnvelope(toolResponse)?.["task"];
+    const id = inputRecord(task)?.["id"];
+    return typeof id === "string" ? id : "";
+}
+/**
+ * Diagnostic-only companion to `claimEffectForAgentTasksTool`: was a
+ * task_finish's resulting status actually readable? This does NOT feed
+ * back into the release/keep decision (that stays the classifier's
+ * alone) -- it lets `hook-track-active-claim.ts` label its stderr line
+ * so a silent fail-safe fallback release does not look identical to an
+ * intentional `done` release in the operator's own trail (task
+ * c86e3c4a).
+ */
+export function taskFinishReleaseIsUnreadable(toolResponse) {
+    return taskFinishResultingStatus(toolResponse) === null;
+}
+/**
+ * Coarse shape label for a tool_response, for the same stderr diagnostic
+ * above -- never used to decide anything, only to name what shape a
+ * fail-safe release fell back from.
+ */
+export function describeToolResponseShape(toolResponse) {
+    if (toolResponse === undefined || toolResponse === null)
+        return "absent";
+    if (Array.isArray(toolResponse))
+        return "array";
+    if (typeof toolResponse === "string")
+        return "string";
+    return "object";
+}
+export function agentTasksToolName(verb) {
+    return `${AGENT_TASKS_MCP_PREFIX}${verb}`;
+}
+/** Alias-aware for runtime events, including mcp__server.verb variants. */
+export function matchesAgentTasksRuntimeVerb(toolName, verbs) {
+    const expected = new Set(verbs.map(agentTasksToolName));
+    return expandToolNameAliases(toolName).some((alias) => expected.has(alias));
+}
+/** Strict canonical parsing for Solution Acceptance's deliberately narrow gate. */
+export function canonicalAgentTasksVerb(toolName, verbs) {
+    if (!toolName.startsWith(AGENT_TASKS_MCP_PREFIX))
+        return null;
+    const verb = toolName.slice(AGENT_TASKS_MCP_PREFIX.length);
+    return verbs.includes(verb) ? verb : null;
+}
+/**
+ * Claim lifecycle is separate from approval boundaries: only a completed
+ * legacy transition releases a claim, while abandon and merge always do.
+ *
+ * task_finish is decided from the RESULT, not the verb (task c86e3c4a):
+ * agent-tasks's own v2 semantics clear the work claim going to `done`
+ * and keep it going to `review`, so `toolResponse` (the tool RESULT
+ * envelope, optional third parameter -- the caller's PostToolUse event
+ * carries this alongside `tool_input`) is read via
+ * `taskFinishResultingStatus`. A resulting status of `review` returns
+ * `none` (keep); `done`, any other resolvable status, and an
+ * unresolvable result (no `toolResponse`, or a malformed one) all
+ * return `release`.
+ *
+ * Fail-safe rationale (task c86e3c4a -- corrected from an earlier
+ * wording of this comment that was wrong about what the marker feeds):
+ * the active-claim file
+ * this classifier feeds is read by the FAIL-CLOSED completion gate
+ * (`src/cli/pack/hook-solution-acceptance.ts`'s `readActiveClaim` call)
+ * to derive the verdict id it gates `task_finish` / `task_submit_pr` /
+ * `task_merge` / `pull_requests_merge` / `git push` on. Release-on-
+ * unreadable is chosen because a KEPT marker for a task that actually
+ * finished would fail OPEN: until the next `task_start` overwrites it,
+ * post-done completion-gated actions (git push, task_merge, PR merge)
+ * would pass on that finished task's already-accepted verdict, and the
+ * marker would override SOLUTION_VERDICT_ID. Releasing fails CLOSED
+ * instead, at the cost of a possible wedge (the gate refuses with "no
+ * active-claim task id recorded" until a fresh `task_start` or an
+ * operator clears the file). It is not costless, and it is not merely
+ * giving up an "ergonomic shortcut".
+ *
+ * This is the ONE place that decision is made: callers (e.g.
+ * `hook-track-active-claim.ts`) do not re-derive it locally.
+ */
+export function claimEffectForAgentTasksTool(toolName, input, toolResponse) {
+    if (matchesAgentTasksRuntimeVerb(toolName, ["task_start"]))
+        return "acquire";
+    if (matchesAgentTasksRuntimeVerb(toolName, ["task_finish"])) {
+        return taskFinishResultingStatus(toolResponse) === "review" ? "none" : "release";
+    }
+    if (matchesAgentTasksRuntimeVerb(toolName, ["task_abandon", "task_merge"])) {
+        return "release";
+    }
+    if (matchesAgentTasksRuntimeVerb(toolName, ["tasks_transition"]) &&
+        tasksTransitionReleasesClaim(input)) {
+        return "release";
+    }
+    return "none";
+}
+export function resolveProtectedCompletionTools(config) {
+    if (Array.isArray(config) &&
+        config.length > 0 &&
+        config.every((verb) => typeof verb === "string" && verb.length > 0)) {
+        return config;
+    }
+    return [...DEFAULT_PROTECTED_COMPLETION_TOOLS];
+}
+//# sourceMappingURL=agent-tasks.js.map

package/dist/runtime/task-providers/agent-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tasks.js","sourceRoot":"","sources":["../../../src/runtime/task-providers/agent-tasks.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAE1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,sBAAsB,YAAY,CAAC;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,sBAAsB,aAAa,CAAC;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,cAAc,CAAC;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,sBAAsB,kBAAkB,CAAC;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,sBAAsB,YAAY,CAAC;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,sBAAsB,qBAAqB,CAAC;AAEvF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;CACP,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,gBAAgB;IAChB,iBAAiB;IACjB,wBAAwB;IACxB,qBAAqB;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAA2B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;AAE5F,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,0BAA0B,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAqB;IAC7D,MAAM,IAAI,GAAG,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAqB;IAC1D,MAAM,IAAI,GAAG,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAqB;IACjE,OAAO,yBAAyB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAqB;IAErB,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,sBAAsB,GAAG,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,KAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,KAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,KAAc,EACd,YAAsB;IAEtB,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,yBAAyB,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IACD,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5D,4BAA4B,CAAC,KAAK,CAAC,EACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAe;IAC7D,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,MAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC"}

package/dist/runtime/workflow-policies.d.ts

@@ -112,6 +112,7 @@ export declare const TASK_FINISH_MCP_MATCH = "mcp__agent-tasks__task_finish";
 export declare const TASK_FINISH_AUTOMERGE_INPUT_MATCH: Record<string, boolean>;
 /** `toolArgs.taskId` is the only identifier either task-scoped verb carries. */
 export declare const TASK_ID_EXTRACT: Record<string, string>;
+export declare const PR_NUMBER_EXTRACT: Record<string, string>;
 /**
  * True when `workflow.steps` contains a `review_subagent` step with
  * `spawn: "required"` at an index earlier than some `merge` step

package/dist/runtime/workflow-policies.js

@@ -1,3 +1,4 @@
+import { TASK_FINISH_AUTOMERGE_INPUT_MATCH as ADAPTER_TASK_FINISH_AUTOMERGE_INPUT_MATCH, TASK_FINISH_TOOL, TASK_ID_EXTRACT as ADAPTER_TASK_ID_EXTRACT, TASK_MERGE_TOOL, PULL_REQUESTS_MERGE_TOOL, PR_NUMBER_EXTRACT as ADAPTER_PR_NUMBER_EXTRACT, } from "./task-providers/agent-tasks.js";
 /**
  * Runtime enforcement for `workflows:` (99f47307, Slice 1).
  *
@@ -101,7 +102,7 @@ export const REVIEW_EVIDENCE_HOOK_TASK_FINISH = "require-review-evidence-task-fi
 // derivation binds to, instead of trusting the hook name alone. See
 // `checkWorkflowGateWiring`'s header for the "right name, wrong trigger"
 // gap this closes.
-export const MERGE_MCP_MATCH = "mcp__agent-tasks__pull_requests_merge";
+export const MERGE_MCP_MATCH = PULL_REQUESTS_MERGE_TOOL;
 // Byte-identical to templates.ts's `review-before-merge-bash` trigger
 // (verified against the parsed FULL_TEMPLATE at authoring time; pinned
 // by tests/runtime/workflow-policies.test.ts's parity assertion so the
@@ -111,8 +112,8 @@ export const MERGE_BASH_MATCH = "(^|\\n|;|\\||&|\\()\\s*(\\w+=\\S+\\s+)*gh pr me
 // here the same way `MERGE_MCP_MATCH` / `MERGE_BASH_MATCH` are and held
 // byte-identical to templates.ts by this module's parity assertion in
 // tests/runtime/workflow-policies.test.ts.
-export const TASK_MERGE_MCP_MATCH = "mcp__agent-tasks__task_merge";
-export const TASK_FINISH_MCP_MATCH = "mcp__agent-tasks__task_finish";
+export const TASK_MERGE_MCP_MATCH = TASK_MERGE_TOOL;
+export const TASK_FINISH_MCP_MATCH = TASK_FINISH_TOOL;
 /**
  * The `trigger.input_match` predicate that separates the merging mode of
  * `task_finish` from the ordinary one. Both auto-merge modes the MCP
@@ -121,11 +122,10 @@ export const TASK_FINISH_MCP_MATCH = "mcp__agent-tasks__task_finish";
  * missing path never satisfies an `input_match` entry, so the gate stays
  * out of the way of the non-merging call.
  */
-export const TASK_FINISH_AUTOMERGE_INPUT_MATCH = {
-    "toolArgs.autoMerge": true,
-};
+export const TASK_FINISH_AUTOMERGE_INPUT_MATCH = ADAPTER_TASK_FINISH_AUTOMERGE_INPUT_MATCH;
 /** `toolArgs.taskId` is the only identifier either task-scoped verb carries. */
-export const TASK_ID_EXTRACT = { TASK_ID: "toolArgs.taskId" };
+export const TASK_ID_EXTRACT = ADAPTER_TASK_ID_EXTRACT;
+export const PR_NUMBER_EXTRACT = ADAPTER_PR_NUMBER_EXTRACT;
 /**
  * True when `workflow.steps` contains a `review_subagent` step with
  * `spawn: "required"` at an index earlier than some `merge` step
@@ -288,7 +288,7 @@ function buildMcpMergeGatePolicy(workflowName) {
         trigger: {
             event: "PreToolUse",
             match: MERGE_MCP_MATCH,
-            extract: { PR_NUMBER: "toolArgs.prNumber" },
+            extract: { ...PR_NUMBER_EXTRACT },
         },
         requires: { ledger_tag: "review:${PR_NUMBER}" },
         hook: REVIEW_EVIDENCE_HOOK_MCP,