@lannguyensi/harness 0.56.0 → 0.58.0

package/dist/cli/doctor/session-start-preflight-setup-version.js

@@ -0,0 +1,114 @@
+// Doctor finding for task 6993d9b5 (tracker id, harness repo): warns
+// when `session_start_preflight.setup: true` is set but the resolved
+// `preflight` binary is below the release that made `--setup` build
+// code, not just install dependencies (agent-preflight 0.6.0, tag
+// v0.6.0). On 0.5.0 `--setup` is dependency-install only, so an
+// operator who enabled the knob against that version pays install time
+// plus the `--setup` trust exposure (see session-start-preflight.ts's
+// SECURITY note) for zero build benefit, with nothing today telling
+// them so.
+//
+// Deliberately independent of the `git-preflight` manifest hook's own
+// `min_version`/`version_command` (checked generically by
+// `checkHookVersion` in ./index.ts): that floor is whatever the
+// operator's own manifest declares, and existing manifests generated
+// before task 6993d9b5 still carry the pre-existing 0.2.0 floor (bumped
+// to `GIT_PREFLIGHT_HOOK_MIN_VERSION`, src/cli/init/templates.ts, in the
+// `init` template only going forward, task 6993d9b5's second commit).
+// This check hardcodes the build-capable floor so an operator on an
+// unregenerated manifest still gets the warning the moment they flip
+// `setup: true`, rather than only after re-running `harness init`.
+//
+// BY DESIGN: on a freshly generated manifest with `setup: true` probed
+// against a stale preflight, this check and the generic `hooks[]`
+// `min_version` walk both fire and both count toward `warningCount` (see
+// `docs/CLI.md`'s VERSION CAVEAT). The two are not a duplicate of the
+// same finding: the hook floor guards the `git-preflight` hook itself,
+// this check guards the `--setup` build-step feature specifically, and
+// a stale preflight breaks both independently.
+//
+// SPLIT FROM THE HOOK FLOOR (task 65952a0c, docs/decisions/2026-09-08-
+// preflight-floors.md): this check's floor,
+// `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION`, and the hook
+// floor above, `GIT_PREFLIGHT_HOOK_MIN_VERSION`, were ONE shared
+// constant through task 6993d9b5. Both are `"0.6.0"` today and can
+// diverge on a future bump that applies to only one rationale; see the
+// ADR for the bump rule each carries.
+//
+// Silent (returns `undefined`) whenever `session_start_preflight.setup`
+// is `false`/absent: the trust exposure and the install/build cost only
+// exist once the knob is actually on, mirroring every other advisory
+// doctor check's "no opinion when the feature isn't in use" gate.
+import { parseProbedVersion, compareVersionFloor } from "../../io/version-compare.js";
+import { PREFLIGHT_BIN } from "../session-start/index.js";
+import { SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION } from "../../schema/session-start-preflight.js";
+/**
+ * The probe command run against the `preflight` binary on PATH. Matches
+ * the `version_command` the shipped `git-preflight` hook template
+ * declares (src/cli/init/templates.ts), same binary and `--version`
+ * flag, but is not read FROM the manifest's hook entry: an operator
+ * could rename/remove that hook while `session_start_preflight.setup`
+ * stays on, and the check should still probe the binary the producer
+ * (`harness session-start preflight`) actually spawns.
+ */
+export const PREFLIGHT_SETUP_VERSION_COMMAND = [PREFLIGHT_BIN, "--version"];
+/**
+ * Pure: manifest + versionProbe in, a finding out (or `undefined` when
+ * there is nothing to flag). Mirrors `checkHookVersion`'s probe/parse
+ * idiom (src/cli/doctor/index.ts) so the warning vocabulary
+ * (`below_floor` / `probe_failed` / `parse_failed`) and version-regex
+ * parsing stay consistent across both checks, without importing from
+ * index.ts (which would create a cycle back into this module's own
+ * caller).
+ *
+ * `projectName` (task c88461c1, review round 3 residual; task
+ * `1c4eb3ea`): OPTIONAL third argument, carried onto every returned finding
+ * unchanged (see {@link SessionStartPreflightSetupVersionFinding.projectName}'s
+ * doc comment). `doctor()` always passes it (the SAME name it derived
+ * for its own scoped load, or `null`); every pre-existing direct call
+ * to this pure function in its own unit tests omits it, so those
+ * findings' shape is unchanged.
+ */
+export function checkSessionStartPreflightSetupVersion(manifest, versionProbe, projectName) {
+    if (!manifest.session_start_preflight.setup)
+        return undefined;
+    const withProjectName = (finding) => projectName !== undefined ? { ...finding, projectName } : finding;
+    const required = SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION;
+    const stdout = versionProbe(PREFLIGHT_SETUP_VERSION_COMMAND);
+    if (stdout === null) {
+        return withProjectName({
+            kind: "probe_failed",
+            actualVersion: null,
+            requiredVersion: required,
+            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
+                `be determined (probe for "${PREFLIGHT_SETUP_VERSION_COMMAND.join(" ")}" failed); the ` +
+                `build step needs preflight >= ${required}`,
+        });
+    }
+    // parseProbedVersion/compareVersionFloor (not plain compareNumericVersions):
+    // a preflight release candidate of the floor (e.g. "0.6.0-rc.1") must not
+    // count as build-capable. See docs/decisions/2026-09-08-preflight-floors.md.
+    const parsed = parseProbedVersion(stdout);
+    if (!parsed) {
+        return withProjectName({
+            kind: "parse_failed",
+            actualVersion: null,
+            requiredVersion: required,
+            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
+                `be parsed from "${stdout.trim()}"; the build step needs preflight >= ${required}`,
+        });
+    }
+    const { version: actual, isPrerelease, token } = parsed;
+    if (compareVersionFloor(actual, isPrerelease, required) < 0) {
+        return withProjectName({
+            kind: "below_floor",
+            actualVersion: actual,
+            requiredVersion: required,
+            message: `session_start_preflight.setup is enabled but installed preflight v${token} < ${required}: ` +
+                `--setup on v${token} is dependency-install only (no build step); upgrade preflight ` +
+                `(npm i -g @lannguyensi/agent-preflight) or set session_start_preflight.setup: false`,
+        });
+    }
+    return undefined;
+}
+//# sourceMappingURL=session-start-preflight-setup-version.js.map

package/dist/cli/doctor/session-start-preflight-setup-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start-preflight-setup-version.js","sourceRoot":"","sources":["../../../src/cli/doctor/session-start-preflight-setup-version.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,0DAA0D;AAC1D,gEAAgE;AAChE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,4CAA4C;AAC5C,kEAAkE;AAClE,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAElE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,+CAA+C,EAAE,MAAM,yCAAyC,CAAC;AAG1G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,aAAa,EAAE,WAAW,CAAU,CAAC;AAyDrF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAkB,EAClB,YAAuD,EACvD,WAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,eAAe,GAAG,CACtB,OAAsE,EAC5B,EAAE,CAC5C,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpE,MAAM,QAAQ,GAAG,+CAA+C,CAAC;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,6BAA6B,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB;gBACvF,iCAAiC,QAAQ,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,mBAAmB,MAAM,CAAC,IAAI,EAAE,wCAAwC,QAAQ,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACxD,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,MAAM;YACrB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,qEAAqE,KAAK,MAAM,QAAQ,IAAI;gBAC5F,eAAe,KAAK,iEAAiE;gBACrF,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli/doctor/types.d.ts

@@ -15,6 +15,7 @@ import type { UgInflightSection } from "./ug-inflight.js";
 import type { SettingsDriftSection } from "./settings-drift.js";
 import type { AutoApproveModeWarning } from "./auto-approve-mode.js";
 import type { BypassWithoutAutoApproveFinding } from "./bypass-without-auto-approve.js";
+import type { SessionStartPreflightSetupVersionFinding } from "./session-start-preflight-setup-version.js";
 import type { CodexConfigDriftSection } from "./codex-config-drift.js";
 /**
  * Phase 6 #6 follow-up — doctor target identifier. Distinct from
@@ -84,7 +85,21 @@ export type HookVersionReport = {
      * classifies its outcome, so there is no warn case without one.
      */
     kind: "below_floor" | "probe_failed" | "parse_failed";
-    /** Parsed installed version, when the probe succeeded. Null when the probe failed or its stdout didn't parse. */
+    /**
+     * Parsed installed version, when the probe succeeded. Null when
+     * the probe failed or its stdout didn't parse. Always the
+     * NUMERIC run (`parseProbedVersion`'s `version` field, e.g.
+     * "0.6.0"), never the probed prerelease/build suffix: for a
+     * `below_floor` finding caused by a prerelease of the floor
+     * (e.g. probed "0.6.0-rc.1" against a "0.6.0" `min_version`),
+     * `actualVersion` therefore equals `hook.min_version` even
+     * though `kind` is `"below_floor"`: the numeric components tie,
+     * and `compareVersionFloor`'s prerelease tie-break is what
+     * actually failed the floor. `message` carries the full probed
+     * token (including the suffix) for the human-facing distinction;
+     * this field's JSON shape does not gain a new field for it. See
+     * docs/decisions/2026-09-08-preflight-floors.md.
+     */
     actualVersion: string | null;
     message: string;
 };
@@ -171,6 +186,12 @@ export interface PolicyPackConfigIssue {
 export interface PolicyPackVersionGapReport {
     name: string;
     declaredMinVersion: string;
+    /**
+     * Numeric run only (never the prerelease or build suffix), so a
+     * `below_floor` gap from a prerelease of the floor shows an
+     * `actualVersion` equal to `declaredMinVersion`; `message` carries the
+     * full probed token. Same trap as `HookVersionReport.actualVersion`.
+     */
     actualVersion: string | null;
     message: string;
 }
@@ -435,6 +456,15 @@ export interface DoctorReport {
      * bypass-without-auto-approve.ts.
      */
     ugBypassWithoutAutoApprove?: BypassWithoutAutoApproveFinding;
+    /**
+     * `session_start_preflight.setup: true` against a `preflight` binary
+     * below the build-capable release (task 6993d9b5). Present only when
+     * `setup` is enabled AND the probed/parsed version is below
+     * `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION` (or the probe
+     * failed/could not be parsed); always a warning (`⚠`) when present,
+     * see session-start-preflight-setup-version.ts.
+     */
+    sessionStartPreflightSetupVersion?: SessionStartPreflightSetupVersionFinding;
     /**
      * `auto_approve` configured without `mode: grill_me` (agent-tasks
      * abfad738, follow-up of ADR
@@ -565,14 +595,15 @@ export interface DoctorReport {
     warningCount: number;
 }
 export type { NpmBinReport } from "./npm-bin-path.js";
-export type { ClaudeMcpRegistrationSection, ClaudeMcpEntryReport } from "./claude-mcp.js";
+export type { SessionStartPreflightSetupVersionFinding } from "./session-start-preflight-setup-version.js";
+export type { ClaudeMcpRegistrationSection, ClaudeMcpEntryReport, } from "./claude-mcp.js";
 export type { UnderstandingModeEnvDivergence } from "./understanding-mode-env.js";
-export type { UgAutoApprovalsSection, AutoApprovalListingEntry } from "./ug-auto-approvals.js";
+export type { UgAutoApprovalsSection, AutoApprovalListingEntry, } from "./ug-auto-approvals.js";
 export type { UgDelegationsSection } from "./ug-delegations.js";
 export type { UgInflightSection } from "./ug-inflight.js";
 export type { AutoApproveModeWarning } from "./auto-approve-mode.js";
 export type { BypassWithoutAutoApproveFinding } from "./bypass-without-auto-approve.js";
 export type { SettingsDriftSection } from "./settings-drift.js";
 export type { CodexConfigDriftSection } from "./codex-config-drift.js";
-export type { ToolchainParitySection, ToolchainParityPeerReport } from "./toolchain-parity.js";
+export type { ToolchainParitySection, ToolchainParityPeerReport, } from "./toolchain-parity.js";
 export type { Manifest, McpProbeResult, MemoryReport, StaleMemory, CodexTargetReport, RogueLedgerDb, };

package/dist/cli/doctor/types.js

@@ -8,6 +8,7 @@
  */
 export const KNOWN_DOCTOR_TARGETS = ["codex", "opencode"];
 export function isDoctorTarget(value) {
-    return typeof value === "string" && KNOWN_DOCTOR_TARGETS.includes(value);
+    return (typeof value === "string" &&
+        KNOWN_DOCTOR_TARGETS.includes(value));
 }
 //# sourceMappingURL=types.js.map

package/dist/cli/doctor/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/doctor/types.ts"],"names":[],"mappings":"AAmBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAC;AAGnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/doctor/types.ts"],"names":[],"mappings":"AAoBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAU,CAAC;AAGnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/ug-delegations.js

@@ -58,6 +58,15 @@ const SESSION_ID_BASENAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 export function buildUgDelegations(generatedDir, opts = {}) {
     const now = opts.now ?? new Date();
     const dir = path.join(generatedDir, DELEGATION_MARKER_DIRNAME);
+    let dirStat;
+    try {
+        dirStat = fs.lstatSync(dir);
+    }
+    catch {
+        return emptySection();
+    }
+    if (!dirStat.isDirectory())
+        return emptySection();
     let dirents;
     try {
         dirents = fs.readdirSync(dir, { withFileTypes: true });

package/dist/cli/doctor/ug-delegations.js.map

@@ -1 +1 @@
-{"version":3,"file":"ug-delegations.js","sourceRoot":"","sources":["../../../src/cli/doctor/ug-delegations.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iEAAiE;AACjE,gEAAgE;AAChE,wEAAwE;AACxE,qEAAqE;AACrE,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,4DAA4D;AAC5D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,qCAAqC;AAErC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oEAAoE,CAAC;AAa5E,SAAS,YAAY;IACnB,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAE/D,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,6DAA6D;QAC7D,kEAAkE;QAClE,mEAAmE;QACnE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAEnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACnD,iEAAiE;QACjE,8DAA8D;QAC9D,uCAAuC;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtF,SAAS;QACX,CAAC;QACD,KAAK,EAAE,CAAC;QACR,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"ug-delegations.js","sourceRoot":"","sources":["../../../src/cli/doctor/ug-delegations.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,iEAAiE;AACjE,gEAAgE;AAChE,wEAAwE;AACxE,qEAAqE;AACrE,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,4DAA4D;AAC5D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,qCAAqC;AAErC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oEAAoE,CAAC;AAa5E,SAAS,YAAY;IACnB,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAE/D,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;QAAE,OAAO,YAAY,EAAE,CAAC;IAElD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,6DAA6D;QAC7D,kEAAkE;QAClE,mEAAmE;QACnE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAEnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACnD,iEAAiE;QACjE,8DAA8D;QAC9D,uCAAuC;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtF,SAAS;QACX,CAAC;QACD,KAAK,EAAE,CAAC;QACR,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACrE,CAAC"}

package/dist/cli/explain-policy.d.ts

@@ -15,7 +15,44 @@ export interface ExplainPolicyOptions extends EventInputSeams, LoaderOptions {
     kubeContext?: string;
     /** Inject the kube namespace (tests); bypasses `~/.kube/config`. */
     kubeNamespace?: string;
+    /**
+     * cwd `session_start_preflight.setup`'s per-repo project layer is
+     * derived from when `opts.project` is absent (task c88461c1, review
+     * round 2, decision D-021b): the same `deriveProjectName` helper
+     * `harness session-start preflight` and `harness doctor` also feed
+     * their own `loadManifest` call from, so all three consumers agree on
+     * which project layer applies to a given cwd instead of `explain-
+     * policy` silently reporting the base/machine value for a repo whose
+     * producer is actually reading a project layer. Defaults to
+     * `process.cwd()`; tests inject a fixture repo dir to stay hermetic
+     * against the real cwd.
+     */
+    cwd?: string;
 }
+/**
+ * Which resolved layer decided `session_start_preflight.setup` (task
+ * c88461c1): "project" when the resolved project-override layer
+ * itself declares the key, "machine" when a resolved machine-override
+ * layer declares it (and no project layer does), "base" otherwise
+ * (the base manifest, or the schema default when nothing declares the
+ * key at all). Mirrors the loader's own last-wins precedence
+ * (`applyLayers(baseRaw, ...machineLayers, projectLayer)`,
+ * `src/overrides/merge.ts`): the project layer is checked first since
+ * it is the highest-precedence layer, then machine layers from the
+ * last-applied (highest-precedence) one back to the first.
+ *
+ * "unresolvable" (task c88461c1, review round 3 residual; task
+ * `1c4eb3ea` of the batch-44 follow-up run): the cwd-derived project-scoped SECOND
+ * load itself threw (a malformed project layer, an unreadable file).
+ * Deliberately NOT "base": the base/machine values were never actually
+ * re-read on this path (the plain load above them; see the round-3
+ * comment this residual corrected), so attributing the result to
+ * "base" would claim a value the base layer may not carry. `setup`
+ * degrades to `false` alongside it, matching the producer's own
+ * `setupEnabled` catch (`src/cli/session-start/index.ts`), so the two
+ * agree on a scoped-load failure instead of only on a healthy load.
+ */
+export type SessionStartPreflightLayerSource = "base" | "machine" | "project" | "unresolvable";
 interface ExplainPolicyProjection {
     policy: string;
     description: string;
@@ -31,6 +68,36 @@ interface ExplainPolicyProjection {
     /** Static deletion-target verdict (task d03af8f6); null when the
      *  event's command is not a recognized deletion verb. */
     deletion_target: DeletionTargetVerdict | null;
+    /**
+     * Resolved `session_start_preflight` config (task 30183330), shown
+     * only when the explained policy is one of the init-generated
+     * `preflight-before-*` gates (name starts with `preflight-before-`):
+     * this is the knob that decides whether the `harness session-start
+     * preflight` / `harness preflight` producer passes `--setup` to the
+     * `preflight run` invocation whose `ready:true` result these policies
+     * gate on. Omitted for every other policy; it has no bearing on
+     * their evaluation (review round 3 residual; task `1c4eb3ea`: the
+     * scoped SECOND load below this field's assignment site runs ONLY
+     * when this condition is already true, so a policy this block is
+     * never rendered for never pays for that extra load either).
+     * `source` (task c88461c1) names which resolved layer decided the
+     * value: `"base"` (also covers an injected `opts.manifest`, which
+     * carries no per-layer provenance to attribute), `"machine"`,
+     * `"project"` (the cwd-derived per-repo layer), or `"unresolvable"`
+     * (review round 3 residual; task `1c4eb3ea`: the scoped load itself
+     * threw, `setup` degrades to `false` alongside it). This function
+     * derives that project name itself, from `opts.cwd`, via the SAME
+     * `deriveProjectName` helper `harness session-start preflight` feeds
+     * through `LoaderOptions.project` (review round 2, decision D-021b:
+     * without this, an operator running `explain-policy` with no
+     * `--project` in a repo that DOES have a project layer would see the
+     * base/machine value while the producer itself reads the project
+     * layer, see src/cli/session-start/index.ts).
+     */
+    session_start_preflight?: {
+        setup: boolean;
+        source: SessionStartPreflightLayerSource;
+    };
     when: {
         declared: false;
     } | {

package/dist/cli/explain-policy.js

@@ -12,13 +12,63 @@
 // Distinct from `harness explain <policy> --trace`: that replays the
 // LAST recorded decision from the evidence ledger; `explain-policy`
 // evaluates a hypothetical event live and reads nothing from the ledger.
-import { stringify as stringifyYaml } from "yaml";
-import { classifyRisk, evaluateWhen, policyMatchesEvent, resolveDeletionTarget, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
+import * as fs from "node:fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { classifyRisk, deriveProjectName, evaluateWhen, policyMatchesEvent, resolveDeletionTarget, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
 import { extractShellCommand } from "../runtime/tool-name-aliases.js";
 import { DEFAULT_SAFE_DELETION_ROOTS } from "../schema/risk.js";
 import { loadEventEnvelope } from "./event-input.js";
 import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
 import { loadManifest } from "./loader.js";
+/**
+ * Does `filePath`'s raw YAML explicitly declare `session_start_preflight.setup`?
+ *
+ * "Declare" means KEY PRESENCE, not "holds a boolean" (review round 2,
+ * finding: a tombstone, `session_start_preflight: null` or `{setup:
+ * null}`, both honoured by `mergeValue` in src/overrides/merge.ts as
+ * "delete whatever a lower layer set, falling back to the schema
+ * default", is exactly as much a deliberate declaration by THIS layer
+ * as `setup: true`/`false` is; it just resolves to a different final
+ * value. Attributing a tombstoned layer's decision to whichever lower
+ * layer happens to also declare the key (or to "base" when none does)
+ * would name the WRONG layer as the one that decided the merged
+ * result.
+ */
+function layerDeclaresSetup(filePath) {
+    try {
+        const raw = fs.readFileSync(filePath, "utf8");
+        const parsed = parseYaml(raw);
+        if (parsed === null || typeof parsed !== "object")
+            return false;
+        if (!("session_start_preflight" in parsed))
+            return false;
+        const block = parsed.session_start_preflight;
+        if (block === null)
+            return true; // whole-block tombstone
+        if (typeof block !== "object" || Array.isArray(block))
+            return false;
+        return "setup" in block;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Re-reads the resolved layer files (independent of the already-merged
+ * `manifest` object, which no longer carries per-layer provenance once
+ * `applyLayers` has folded them together) to attribute the decided
+ * `session_start_preflight.setup` value to the layer that set it.
+ */
+function resolveSessionStartPreflightSource(resolved) {
+    if (resolved.projectLayer !== null && layerDeclaresSetup(resolved.projectLayer)) {
+        return "project";
+    }
+    for (let i = resolved.machineLayers.length - 1; i >= 0; i--) {
+        if (layerDeclaresSetup(resolved.machineLayers[i]))
+            return "machine";
+    }
+    return "base";
+}
 /**
  * Explain whether `policyName` applies to the event at `opts.eventPath`.
  *
@@ -27,12 +77,93 @@ import { loadManifest } from "./loader.js";
  * `loadEventEnvelope`) when the event file is missing or malformed.
  */
 export function explainPolicy(policyName, opts) {
-    const manifest = opts.manifest ?? loadManifest(opts).manifest;
+    // `resolved` is only available on the real `loadManifest(opts)` path:
+    // an injected `opts.manifest` already IS the merged result and
+    // carries no per-layer provenance, so `session_start_preflight.source`
+    // falls back to "base" in that case (see the field's doc comment).
+    //
+    // PLAIN load (task c88461c1, review round 3, decision D-028): every
+    // check this verb performs against `manifest` below -- finding the
+    // named policy, trigger matching, the Risk Classifier, environment
+    // resolution, deletion-target resolution, and the `when:` evaluation
+    // -- reads the base/machine/explicit-`--project` manifest only, an
+    // explicit `opts.project` still wins outright but NOTHING is derived
+    // from cwd here. This mirrors `harness policy intercept`
+    // (src/cli/policy/intercept.ts) and `harness dry-run`
+    // (src/cli/dry-run.ts), the two enforcement-facing verbs that decide
+    // a policy's real trigger verdict: neither ever consults a derived
+    // project layer, so this manifest must not either, or an operator's
+    // "would this apply" answer could disagree with what actually
+    // enforces. Only `session_start_preflight.setup` (and its `source`
+    // attribution) below get a project-scoped SECOND load: routing a
+    // derived layer through THIS one, unrelated load would let it
+    // silently reach the policy engine this verb evaluates, for zero
+    // benefit to the one key that needs it.
+    let manifest;
+    let resolvedPaths;
+    if (opts.manifest) {
+        manifest = opts.manifest;
+    }
+    else {
+        const loaded = loadManifest(opts);
+        manifest = loaded.manifest;
+        resolvedPaths = loaded.resolved;
+    }
     const policy = manifest.policies.find((p) => p.name === policyName);
     if (!policy) {
         const available = manifest.policies.map((p) => p.name).join(", ") || "(none)";
         throw new HarnessExitError(`no policy named "${policyName}" declared; available: ${available}`, EX_USAGE);
     }
+    // `session_start_preflight.setup` / `source` (task c88461c1, review
+    // round 2 decision D-021b; scope narrowed to this one key, review
+    // round 3 decision D-028; gated on the name-prefix check below,
+    // review round 3 residual, task `1c4eb3ea`): an explicit
+    // `opts.project` still wins outright; otherwise derive the project
+    // name from `opts.cwd` (defaulting to `process.cwd()`) via the SAME
+    // `deriveProjectName` the two other producers reach through
+    // `resolveScopedProjectName` (src/runtime/git-context.ts; this verb keeps
+    // its own copy with an `undefined` fallback, task f1eb1c5c), so this
+    // verb's `setup`/`source` reflect the layer the producer would read for
+    // this cwd, WITHOUT letting that derived layer reach the policy evaluation above. An injected
+    // `opts.manifest` carries no per-layer provenance to re-derive from
+    // and always reports "base" (unchanged from before this task).
+    //
+    // ONLY COMPUTED FOR `preflight-before-*` POLICIES (moved behind this
+    // check, review round 3 residual, task `1c4eb3ea`): the block below
+    // is rendered into the projection ONLY for those policies (see
+    // `ExplainPolicyProjection.session_start_preflight`'s doc comment),
+    // so a caller explaining any OTHER policy no longer pays for a
+    // second manifest load whose result it can never see.
+    let sessionStartPreflightSetup = false;
+    let sessionStartPreflightSource = "base";
+    if (policy.name.startsWith("preflight-before-")) {
+        sessionStartPreflightSetup = manifest.session_start_preflight.setup;
+        sessionStartPreflightSource = resolvedPaths
+            ? resolveSessionStartPreflightSource(resolvedPaths)
+            : "base";
+        if (!opts.manifest) {
+            try {
+                const scoped = loadManifest({
+                    ...opts,
+                    project: opts.project ?? deriveProjectName(opts.cwd ?? process.cwd()) ?? undefined,
+                });
+                sessionStartPreflightSetup = scoped.manifest.session_start_preflight.setup;
+                sessionStartPreflightSource = resolveSessionStartPreflightSource(scoped.resolved);
+            }
+            catch {
+                // Review round 3 residual, task `1c4eb3ea`: degrade to
+                // setup:false / source:"unresolvable" rather than keeping the
+                // plain load's values, matching the producer's own
+                // `setupEnabled` catch (`src/cli/session-start/index.ts`),
+                // which degrades to `setup: false` on the identical failure
+                // instead of falling back to a base/machine value it never
+                // actually re-read on this path. "base" would misattribute
+                // the result to a layer this function never consulted here.
+                sessionStartPreflightSetup = false;
+                sessionStartPreflightSource = "unresolvable";
+            }
+        }
+    }
     const { event, envelope } = loadEventEnvelope(opts.eventPath, opts, "explain-policy");
     // Kube seams resolve together: if either is injected, skip the
     // `~/.kube/config` read entirely — same contract as `resolve-env`.
@@ -73,6 +204,12 @@ export function explainPolicy(policyName, opts) {
         classifier,
         environment,
         deletion_target: deletionTarget,
+        ...(policy.name.startsWith("preflight-before-") && {
+            session_start_preflight: {
+                setup: sessionStartPreflightSetup,
+                source: sessionStartPreflightSource,
+            },
+        }),
         when: whenEval
             ? {
                 declared: true,

package/dist/cli/explain-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAiD/D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAC3C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAClB,mBAAmB,KAAK,IAAI;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CACnB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,2BAA2B,CACjE,CAAC;IAER,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAA0C,MAAM,aAAa,CAAC;AAuDnF;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAiD,CAAC;QAC9E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,CAAC,CAAC,yBAAyB,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,OAAO,IAAK,KAAiC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,QAAuB;IAEvB,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5D,IAAI,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA6DD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,sEAAsE;IACtE,+DAA+D;IAC/D,uEAAuE;IACvE,mEAAmE;IACnE,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,yDAAyD;IACzD,sDAAsD;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,8DAA8D;IAC9D,iEAAiE;IACjE,wCAAwC;IACxC,IAAI,QAAkB,CAAC;IACvB,IAAI,aAAwC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,gEAAgE;IAChE,yDAAyD;IACzD,mEAAmE;IACnE,oEAAoE;IACpE,4DAA4D;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,8FAA8F;IAC9F,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,+DAA+D;IAC/D,sDAAsD;IACtD,IAAI,0BAA0B,GAAG,KAAK,CAAC;IACvC,IAAI,2BAA2B,GAAqC,MAAM,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,0BAA0B,GAAG,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACpE,2BAA2B,GAAG,aAAa;YACzC,CAAC,CAAC,kCAAkC,CAAC,aAAa,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,GAAG,IAAI;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,SAAS;iBACnF,CAAC,CAAC;gBACH,0BAA0B,GAAG,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBAC3E,2BAA2B,GAAG,kCAAkC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,8DAA8D;gBAC9D,mDAAmD;gBACnD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0BAA0B,GAAG,KAAK,CAAC;gBACnC,2BAA2B,GAAG,cAAc,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAC3C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAClB,mBAAmB,KAAK,IAAI;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CACnB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,2BAA2B,CACjE,CAAC;IAER,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI;YACjD,uBAAuB,EAAE;gBACvB,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,2BAA2B;aACpC;SACF,CAAC;QACF,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/gc/index.js

@@ -86,6 +86,15 @@ function ageDays(nowMs, thenMs) {
 }
 /** Plain files in `dir` whose mtime is older than `cutoffMs`. */
 function staleFilesByMtime(dir, cutoffMs, nowMs, category) {
+    let dirStat;
+    try {
+        dirStat = fs.lstatSync(dir);
+    }
+    catch {
+        return { candidates: [], kept: 0 };
+    }
+    if (!dirStat.isDirectory())
+        return { candidates: [], kept: 0 };
     let names;
     try {
         names = fs.readdirSync(dir);
@@ -205,13 +214,24 @@ function sweepDelegations(generatedDir, cutoffMs, nowMs) {
     // and session-id-shaped, so the ledger pass below can tell "expired"
     // from "absent" from "still valid" without re-reading the file.
     const statusBySessionId = new Map();
-    let delegationNames;
-    try {
-        delegationNames = fs.readdirSync(delegationsDir);
-    }
-    catch {
-        delegationNames = [];
-    }
+    const readRootNames = (dir) => {
+        let dirStat;
+        try {
+            dirStat = fs.lstatSync(dir);
+        }
+        catch {
+            return [];
+        }
+        if (!dirStat.isDirectory())
+            return [];
+        try {
+            return fs.readdirSync(dir);
+        }
+        catch {
+            return [];
+        }
+    };
+    const delegationNames = readRootNames(delegationsDir);
     for (const name of delegationNames) {
         if (!SESSION_ID_BASENAME_RE.test(name))
             continue;
@@ -229,13 +249,7 @@ function sweepDelegations(generatedDir, cutoffMs, nowMs) {
             kept += 1;
         }
     }
-    let ledgerNames;
-    try {
-        ledgerNames = fs.readdirSync(ledgerDir);
-    }
-    catch {
-        ledgerNames = [];
-    }
+    const ledgerNames = readRootNames(ledgerDir);
     for (const name of ledgerNames) {
         if (!SESSION_ID_BASENAME_RE.test(name))
             continue;