@lannguyensi/harness 0.59.1 → 0.60.0

package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js

@@ -14,6 +14,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { atomicWriteFile } from "../../../io/atomic-write.js";
 import { safeJsonParse } from "../../../io/safe-json-parse.js";
+import { sha256Hex } from "../../../runtime/approval-signing.js";
 const DEFAULT_REPORTS_DIRNAME = ".understanding-gate";
 const REPORTS_SUBDIR = "reports";
 /**
@@ -86,6 +87,8 @@ function readPersistedReport(filePath, mtimeMs) {
         sessionId: typeof obj["sessionId"] === "string" ? obj["sessionId"] : null,
         approvalStatus: typeof obj["approvalStatus"] === "string" ? obj["approvalStatus"] : null,
         approvedAt: typeof obj["approvedAt"] === "string" ? obj["approvedAt"] : null,
+        expiredBy: typeof obj["expiredBy"] === "string" ? obj["expiredBy"] : null,
+        expiredAt: typeof obj["expiredAt"] === "string" ? obj["expiredAt"] : null,
         createdAt,
         createdAtMs,
     };
@@ -265,7 +268,7 @@ const DETAIL_VALUE_MAX_LENGTH = 120;
  * forge extra `reason:`-looking lines) are replaced with a space and
  * the result is capped so one field cannot blow out the surface.
  */
-function sanitizeDetailValue(value) {
+export function sanitizeDetailValue(value) {
     // Deliberately strips C0/DEL control characters (including newline,
     // which could otherwise forge an extra `reason:`-looking stderr line).
     const flattened = value.replace(/[\x00-\x1f\x7f]/g, " ");
@@ -292,7 +295,7 @@ function sanitizeDetailValue(value) {
  * best-effort cleanup so a missing report dir or unrelated I/O issue
  * does not escalate into a session-breaking hook failure.
  */
-export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
+export function expirePersistedReport(reportsDir, sessionId, now = new Date(), trigger) {
     const reports = listPersistedReports(reportsDir);
     if (reports.length === 0) {
         return { ok: false, reason: `no reports under ${reportsDir}` };
@@ -327,6 +330,13 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
     const previousStatus = typeof parsed["approvalStatus"] === "string" ? parsed["approvalStatus"] : null;
     parsed["approvalStatus"] = "expired";
     parsed["expiredAt"] = now.toISOString();
+    if (trigger !== undefined && trigger !== "") {
+        parsed["expiredBy"] = trigger;
+    }
+    else {
+        // No event to record: drop a stale one from an earlier expiry.
+        delete parsed["expiredBy"];
+    }
     try {
         atomicWriteFile(latest.filePath, `${JSON.stringify(parsed, null, 2)}\n`);
     }
@@ -374,9 +384,11 @@ export function checkPersistedReport(reportsDir, sessionId) {
     }
     const safeFileName = sanitizeDetailValue(path.basename(latest.filePath));
     if (latest.approvalStatus !== "approved") {
+        const boundaryExpiry = describeBoundaryExpiry(latest);
+        const expirySuffix = boundaryExpiry !== undefined ? `; ${boundaryExpiry}` : "";
         return {
             claimsApproved: false,
-            detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}`,
+            detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}${expirySuffix}`,
             report: latest,
         };
     }
@@ -390,4 +402,349 @@ export function checkPersistedReport(reportsDir, sessionId) {
         report: latest,
     };
 }
+/**
+ * `approval expired because <event> at <time>` for a report a PostToolUse
+ * boundary expired (`expirePersistedReport` stamps `expiredBy` and
+ * `expiredAt`), `undefined` for any other report, including an older one or
+ * one a package producer wrote that carries no `expiredBy`. Both values come
+ * from a JSON file the gated agent can write, so both pass
+ * `sanitizeDetailValue`.
+ */
+export function describeBoundaryExpiry(report) {
+    if (report.approvalStatus !== "expired")
+        return undefined;
+    if (report.expiredBy === null || report.expiredBy === "")
+        return undefined;
+    const when = report.expiredAt !== null && report.expiredAt !== ""
+        ? ` at ${sanitizeDetailValue(report.expiredAt)}`
+        : "";
+    return `approval expired because ${sanitizeDetailValue(report.expiredBy)}${when}`;
+}
+/**
+ * Report fields the approval and expiry lifecycles rewrite. They are left
+ * out of {@link canonicalReportHash}: `rewriteReportApproved` flips
+ * `approvalStatus`/`approvedAt`/`approvedBy`, may stamp `sessionId`, and
+ * drops `expiredAt`/`expiredBy`; `expirePersistedReport` later sets
+ * `approvalStatus`/`expiredAt`/`expiredBy` again. The hash must survive all
+ * of that for an untouched report, so it covers only the content the
+ * operator actually reviewed.
+ */
+const LIFECYCLE_REPORT_FIELDS = new Set([
+    "approvalStatus",
+    "approvedAt",
+    "approvedBy",
+    "expiredAt",
+    "expiredBy",
+    "sessionId",
+]);
+/**
+ * Deepest array/object nesting {@link canonicalReportHash} serialises (the
+ * report object itself is level 1). `sortKeysDeep` and `JSON.stringify`
+ * recurse once per level, and any agent-written `*.json` file in the reports
+ * directory reaches them through the gate-read scan, so without a bound a
+ * file nested a few thousand levels deep overflows the stack and the hook
+ * process dies instead of deciding. A real report nests a handful of levels.
+ */
+const MAX_CANONICAL_REPORT_DEPTH = 64;
+/**
+ * Largest report file, in bytes, the canonical hash reads from disk (1 MiB).
+ * Every `*.json` entry of the reports directory reaches the hash through the
+ * gate-read scan, and the agent can write that directory, so without a bound
+ * a planted file of a few hundred megabytes made the hook run out of heap or
+ * past its time budget instead of deciding (a hook that dies or overruns is a
+ * non-blocking error for the runtime). A real report is a few kilobytes, far
+ * below the cap. A file over the cap matches nothing at gate read, and both
+ * producers refuse to approve such a report.
+ */
+export const MAX_HASHED_REPORT_BYTES = 1024 * 1024;
+/**
+ * Iterative walk over the arrays and objects of `value` (the value itself is
+ * level 1) that stops at the first one nested deeper than `max` levels.
+ * Iterative, so the walk itself cannot overflow the stack. Only arrays and
+ * objects are pushed: a scalar child (string, number, boolean, null) cannot
+ * nest, so a wide array of scalars costs no stack slot per element, and
+ * `visited` counts the root plus the containers below it. Exported for tests.
+ */
+export function walkContainerDepth(value, max) {
+    const nodes = [value];
+    const depths = [1];
+    let visited = 0;
+    while (nodes.length > 0) {
+        const node = nodes.pop();
+        const depth = depths.pop() ?? 1;
+        visited += 1;
+        if (node === null || typeof node !== "object")
+            continue;
+        if (depth > max)
+            return { tooDeep: true, visited };
+        for (const child of Array.isArray(node) ? node : Object.values(node)) {
+            if (child !== null && typeof child === "object") {
+                nodes.push(child);
+                depths.push(depth + 1);
+            }
+        }
+    }
+    return { tooDeep: false, visited };
+}
+/** True when `value` nests arrays/objects deeper than `max` levels. */
+function nestsDeeperThan(value, max) {
+    return walkContainerDepth(value, max).tooDeep;
+}
+function sortKeysDeep(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => [k, sortKeysDeep(v)]);
+        // `Object.fromEntries` defines own properties, so a report key named
+        // `__proto__` stays data instead of re-parenting the copy.
+        return Object.fromEntries(entries);
+    }
+    return value;
+}
+/**
+ * The hash an approval marker signs as its `reportContentHash`, and the one
+ * the gate recomputes at read time (task fa423e9b): sha256 over a key-sorted
+ * JSON serialisation of the parsed report with the lifecycle fields in
+ * `LIFECYCLE_REPORT_FIELDS` removed. A raw-bytes hash cannot do this job: the
+ * producers hash before `rewriteReportApproved` re-serialises the file and
+ * `expirePersistedReport` rewrites it again, so the raw bytes of an untouched
+ * report never match what the marker signed. One function on purpose, shared
+ * by both producers (`harness approve understanding`, the auto-approval path)
+ * and the verifier.
+ *
+ * Total: returns null instead of throwing for a report nested deeper than
+ * `MAX_CANONICAL_REPORT_DEPTH`. The verifier counts such a file as one that
+ * matches nothing; both producers refuse to approve such a report, so no
+ * marker is ever signed without a content binding because of it. Report
+ * files reach it only after {@link readReportFileBounded} bounded their type
+ * and size (the gate-read scan and `harness approve understanding` through
+ * {@link hashReportFile}, the auto-approval path directly).
+ */
+export function canonicalReportHash(report) {
+    // `Object.fromEntries` (not `kept[key] = value`): a report key named
+    // `__proto__` must stay hashed data, not re-parent the copy and vanish.
+    const kept = Object.fromEntries(Object.entries(report).filter(([key]) => !LIFECYCLE_REPORT_FIELDS.has(key)));
+    if (nestsDeeperThan(kept, MAX_CANONICAL_REPORT_DEPTH))
+        return null;
+    return sha256Hex(JSON.stringify(sortKeysDeep(kept)));
+}
+function errorCode(err) {
+    const code = err?.code;
+    return typeof code === "string" ? code : String(err);
+}
+/**
+ * Read a report file for hashing, bounded by type and size. This is the one
+ * read every canonical report hash goes through: the gate-read scan (via
+ * {@link hashReportFile}) and both producers. The path is opened once,
+ * read-only and non-blocking (`O_NONBLOCK`: opening a FIFO with no writer
+ * returns at once instead of waiting for one); its type and size come from
+ * `fstat` on that descriptor, and the content is read through the same
+ * descriptor, so nothing can be swapped in between (no separate stat of the
+ * path, which a symlink flipped to a FIFO used to race). Refused without
+ * reading: anything that is not a regular file, and a file larger than
+ * `MAX_HASHED_REPORT_BYTES`. The read stops one byte past the fstat size
+ * (never more than the cap plus one byte); a file that grows into that byte
+ * while being read is refused too. The descriptor is always closed. Never
+ * throws.
+ */
+export function readReportFileBounded(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+    }
+    catch (err) {
+        return { ok: false, reason: "unreadable", detail: `could not be opened (${errorCode(err)})` };
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return { ok: false, reason: "not-regular", detail: "not a regular file" };
+        if (stat.size > MAX_HASHED_REPORT_BYTES) {
+            return {
+                ok: false,
+                reason: "too-large",
+                detail: `${stat.size} bytes, over the ${MAX_HASHED_REPORT_BYTES}-byte cap for hashing its content`,
+            };
+        }
+        const buf = Buffer.allocUnsafe(stat.size + 1);
+        let total = 0;
+        while (total < buf.length) {
+            const n = fs.readSync(fd, buf, total, buf.length - total, null);
+            if (n === 0)
+                break;
+            total += n;
+        }
+        if (total > stat.size)
+            return { ok: false, reason: "grew", detail: "grew while being read" };
+        return { ok: true, raw: buf.toString("utf8", 0, total) };
+    }
+    catch (err) {
+        return { ok: false, reason: "unreadable", detail: `could not be read (${errorCode(err)})` };
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            // Already gone; nothing left to release.
+        }
+    }
+}
+/**
+ * Canonical hash of the report file at `filePath`, read through
+ * {@link readReportFileBounded}, or why it has none: not a regular file, over
+ * `MAX_HASHED_REPORT_BYTES`, unreadable, grown while read, not a JSON object,
+ * or nested too deeply. `harness approve understanding` refuses a report on
+ * any of these (the `detail` is its message); the gate-read scan counts such
+ * a file as one that matches nothing. Never throws.
+ */
+export function hashReportFile(filePath) {
+    const read = readReportFileBounded(filePath);
+    if (!read.ok)
+        return read;
+    const parsed = safeJsonParse(read.raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { ok: false, reason: "not-json-object", detail: "not a JSON object" };
+    }
+    const hash = canonicalReportHash(parsed);
+    if (hash === null) {
+        return { ok: false, reason: "too-deep", detail: "nested too deeply to hash its content" };
+    }
+    return { ok: true, hash };
+}
+/** Canonical hash of the report file at `filePath` ({@link hashReportFile}); null when it has none. */
+export function canonicalReportHashOfFile(filePath) {
+    const hashed = hashReportFile(filePath);
+    return hashed.ok ? hashed.hash : null;
+}
+/**
+ * Hash every `*.json` entry of `dir` (any session, any `approvalStatus`)
+ * through {@link canonicalReportHashOfFile} and report which of the `wanted`
+ * hashes occur. Stops as soon as every wanted hash was found. Every entry
+ * counts as a report file; one that is not a regular file, is larger than
+ * `MAX_HASHED_REPORT_BYTES`, cannot be opened or read, grows while read, is
+ * not a JSON object, or nests too deeply matches nothing. The cost is linear
+ * in the number and size of the report files (each read at most up to the
+ * cap), and the usual allow path scans nearly all of them: the directory
+ * listing comes back in name order and report names start with a timestamp,
+ * so the approved (newest) report tends to come last.
+ */
+function scanReportHashes(dir, wanted) {
+    const scan = { files: 0, matched: new Set() };
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return scan;
+    }
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        const full = path.join(dir, name);
+        scan.files += 1;
+        const hash = canonicalReportHashOfFile(full);
+        if (hash !== null && wanted.has(hash)) {
+            scan.matched.add(hash);
+            if (scan.matched.size === wanted.size)
+                break;
+        }
+    }
+    return scan;
+}
+/**
+ * Gate-read cross-check of a matched approval marker against the persisted
+ * reports (task fa423e9b). Both PreToolUse hooks call it after
+ * `checkOperatorApprovalMarkers` matched, through `verifyMatchedMarkerReport`.
+ *
+ * Rule: a marker with a non-null signed `reportContentHash` is valid iff at
+ * least one parseable report file in `reportsDir` (any session, any
+ * `approvalStatus`) has a canonical hash equal to it. The hash already
+ * leaves the lifecycle fields out, so approving, expiring or re-approving
+ * the report never changes it. The signed hash therefore proves one thing:
+ * the content the operator approved is still on disk unmodified. Editing
+ * that file (in place, by swap, by symlink, by an unparseable rewrite)
+ * removes the only match and the marker stops opening the gate. Comparing
+ * against the session's newest approved report instead would deny
+ * legitimate approvals (a newer report approved for the same claim, two
+ * sessions on one claim) and would let a swap pass by moving the swapped
+ * report out of the selection.
+ *
+ * Bounded input: only a regular file of at most `MAX_HASHED_REPORT_BYTES`
+ * (1 MiB) that parses as a JSON object nested at most 64 levels deep has a
+ * canonical hash, read through {@link readReportFileBounded} (opened
+ * non-blocking, typed and sized by `fstat` on the open descriptor, read
+ * through it). Every other `*.json` entry (a FIFO, a directory, a device, a
+ * symlink to one of them, a file over the cap, an unreadable, unparseable or
+ * too deeply nested file) still counts as a report file but matches nothing,
+ * so it can neither open the gate nor make the scan block, run out of
+ * memory or die instead of deciding.
+ *
+ * Residuals: (1) the check proves only that some file carries the approved
+ * content. Any regular `*.json` file within the size cap whose content
+ * equals it keeps a match, whether it was kept before the edit (a copy) or
+ * re-created after it (the agent wrote that content, so it can write it
+ * again), and the marker still opens the gate. (2) A reports directory that
+ * is empty, unreadable or holds no `*.json` entry at all (every report
+ * deleted, the directory made unreadable, the reports renamed) falls back to
+ * the "no report file" allow, the same as before this check existed. The
+ * marker and the operator's approval itself are untouched in both cases;
+ * only the audit trail loses its claim to be the approved content. (3) The
+ * cap bounds each file, not their number: the scan time grows with the
+ * total volume of report files, so an agent that plants hundreds of
+ * megabytes of files just under the cap can still push one scan past the
+ * hook's time budget, which the runtime treats as a non-blocking error (the
+ * same allow as before this check existed).
+ *
+ * Removing the approved report while other report files remain is a deny:
+ * nothing on disk carries the signed content any more. `harness gc --apply`
+ * can do that legitimately: it ages approved reports out by their createdAt
+ * but markers by their file mtime, so a report written long before its
+ * approval can go while the marker stays. Re-approving recovers.
+ *
+ * `primary` is the marker that satisfied the gate (task-scoped first),
+ * `fallback` a session marker that matched behind a task marker. The
+ * fallback is consulted only when the primary fails the check, so a task
+ * marker signed for another report does not hide a session marker that
+ * verifies. Unchanged behaviour: a null hash on the accepted marker (no
+ * report resolved, or `--force` over a report the producer could not hash:
+ * too deeply nested or over the size cap) and a reports directory with no
+ * `*.json` entry at all both allow. A forced approval of a hashable report
+ * signs its hash and is checked like any other.
+ *
+ * The `detail` is the block reason. It names the failing marker kind and the
+ * one-command fix, which is also the single migration step for a marker
+ * written before the canonical hash existed. It carries no report-derived
+ * value, so nothing in it needs sanitising.
+ */
+export function verifyApprovedReportHash(reportsDir, primary, fallback = null) {
+    if (primary.reportContentHash === null)
+        return { ok: true, kind: primary.kind };
+    if (fallback !== null && fallback.reportContentHash === null) {
+        return { ok: true, kind: fallback.kind };
+    }
+    const wanted = new Set([primary.reportContentHash]);
+    if (fallback !== null && fallback.reportContentHash !== null) {
+        wanted.add(fallback.reportContentHash);
+    }
+    const scan = scanReportHashes(reportsDir, wanted);
+    if (scan.files === 0 || scan.matched.has(primary.reportContentHash)) {
+        return { ok: true, kind: primary.kind };
+    }
+    if (fallback !== null &&
+        fallback.reportContentHash !== null &&
+        scan.matched.has(fallback.reportContentHash)) {
+        return { ok: true, kind: fallback.kind };
+    }
+    const kinds = fallback !== null
+        ? `${primary.kind} and ${fallback.kind} approval markers were`
+        : `${primary.kind} approval marker was`;
+    return {
+        ok: false,
+        detail: `no report in the reports directory matches the content the ${kinds} signed for ` +
+            `(the approved report was changed or removed after approval); re-run \`harness approve understanding\``,
+    };
+}
 //# sourceMappingURL=persisted-reports.js.map

package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js.map

@@ -1 +1 @@
-{"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAqB/D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,EAAE;YACF,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AA8BjE,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,OAAgB;IAEhB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,GAAG,YAAY,EAAE;YACjB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2E;IAE3E,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAClD,CAAC,CAAC,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,4BAA4B,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUnD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACxD,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,OAAO,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,qEAAqE;QACrE,2DAA2D;QAC3D,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC5E,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;IACzD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,oBAAoB,uBAAuB,mCAAmC;aACnG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAiC,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAsBD;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,MAA2B;IAChE,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IACtE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,OAA4B,EAC5B,WAAuC,IAAI;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,iBAAiB,KAAK,IAAI;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,wBAAwB;QAC9D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,sBAAsB,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,8DAA8D,KAAK,cAAc;YACjF,uGAAuG;KAC1G,CAAC;AACJ,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.d.ts

@@ -113,7 +113,7 @@ export interface ApplyPostToolUseExpiryResult {
  * side effects exactly so both runtimes share one clearing
  * implementation (task a1348c89).
  */
-export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date): ApplyPostToolUseExpiryResult;
+export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date, trigger?: string): ApplyPostToolUseExpiryResult;
 /**
  * Compose the stderr diagnostic line for a matched-and-applied PostToolUse
  * expiry. Shared by `harness pack hook post-tool-use` (Claude) and

package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js

@@ -149,7 +149,7 @@ export function matchPostToolUseBoundary(toolName, toolInput, lifecycle, bashToo
  * side effects exactly so both runtimes share one clearing
  * implementation (task a1348c89).
  */
-export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now) {
+export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now, trigger) {
     const markerPath = approvalMarkerPathFor(generatedDir, sessionId);
     const wasMarkerPresent = fs.existsSync(markerPath);
     clearApprovalMarker(generatedDir, sessionId);
@@ -176,7 +176,7 @@ export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolN
     // 7402301d the report can no longer satisfy the gate on its own, so
     // this now exists so the audit record agrees with the cleared marker.
     // Best-effort.
-    const reportExpiry = expirePersistedReport(reportsDir, sessionId, now);
+    const reportExpiry = expirePersistedReport(reportsDir, sessionId, now, trigger);
     return {
         wasMarkerPresent,
         taskMarkerCleared,

package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU;IAEV,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe;IACf,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvE,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,sBAAsB,EAAE,YAAY,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,SAA6B,EAC7B,MAAoC;IAEpC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,CAAC,CAAC,8BAA8B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9D,CAAC,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;IACxE,OAAO,MAAM,CAAC,gBAAgB;QAC5B,CAAC,CAAC,GAAG,SAAS,yCAAyC,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAC7H,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AAChI,CAAC"}
+{"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU,EACV,OAAgB;IAEhB,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe;IACf,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhF,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,sBAAsB,EAAE,YAAY,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,SAA6B,EAC7B,MAAoC;IAEpC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,CAAC,CAAC,8BAA8B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9D,CAAC,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;IACxE,OAAO,MAAM,CAAC,gBAAgB;QAC5B,CAAC,CAAC,GAAG,SAAS,yCAAyC,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAC7H,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AAChI,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/task-markers.d.ts

@@ -1,4 +1,5 @@
 import { type ApprovalMarker, type CheckApprovalMarkerOptions, type MarkerCheck } from "./markers.js";
+import { type ApprovalMarkerKind } from "./persisted-reports.js";
 export declare const APPROVAL_MARKER_TASK_PREFIX = "task-";
 /** Filesystem path of a per-task approval marker. */
 export declare function taskApprovalMarkerPathFor(generatedDir: string, taskId: string): string;
@@ -82,6 +83,23 @@ export interface OperatorMarkerApproval {
     detail: string;
     /** Task-scoped check detail, for callers that trace the fall-through. */
     taskCheckDetail: string;
+    /**
+     * The matched marker's signed `reportContentHash`; null when no marker
+     * matched or the matched marker binds no report. The gate-read
+     * cross-check (`verifyApprovedReportHash`) consumes it.
+     */
+    reportContentHash: string | null;
+    /**
+     * A session marker that ALSO matched behind a matched task marker whose
+     * signed hash is non-null (null otherwise). The gate-read cross-check
+     * falls back to it when the task marker's report content is gone: a task
+     * marker is not bound to a session, so it can be signed for another
+     * session's report while this session's own marker still verifies.
+     */
+    sessionFallback: {
+        detail: string;
+        reportContentHash: string | null;
+    } | null;
     /**
      * True when EITHER the task-scoped or the session-scoped marker
      * existed but aged past `approval_lifecycle.max_age` (task 6e888423).
@@ -126,3 +144,21 @@ export declare function checkOperatorApprovalMarkers(generatedDir: string, sessi
 } | null): OperatorMarkerApproval;
 /** Clear a specific task-scoped marker. Used by the post-tool-use hook. */
 export declare function clearTaskApprovalMarker(generatedDir: string, taskId: string): void;
+export type MatchedMarkerReportCheck = {
+    ok: true;
+    source: ApprovalMarkerKind;
+    detail: string;
+} | {
+    ok: false;
+    detail: string;
+};
+/**
+ * Gate-read report cross-check for a matched operator marker, shared by the
+ * Claude and Codex PreToolUse hooks (task fa423e9b). Applies
+ * `verifyApprovedReportHash` to the matched marker and, when that fails and
+ * a session marker matched behind a task marker, to the session marker, so
+ * the verdict never depends on which marker the check order happened to
+ * pick. On success `source`/`detail` describe the marker that verified; on
+ * failure `detail` is the block reason.
+ */
+export declare function verifyMatchedMarkerReport(reportsDir: string, markers: OperatorMarkerApproval): MatchedMarkerReportCheck;

package/dist/policy-packs/builtin/understanding-before-execution/task-markers.js

@@ -10,6 +10,7 @@ import { signMarker } from "../../../runtime/approval-signing.js";
 import { readActiveClaim } from "./active-claim.js";
 import { parseApprovalLifecycle } from "./lifecycle.js";
 import { APPROVAL_MARKER_DIRNAME, checkApprovalMarker, } from "./markers.js";
+import { verifyApprovedReportHash, } from "./persisted-reports.js";
 // Task-scoped approval markers (harness/1ee26e77). When the operator
 // passes `--task <id>` to `harness approve understanding`, a second
 // marker file is written next to the session marker, keyed by the
@@ -166,11 +167,30 @@ export function checkOperatorApprovalMarkers(generatedDir, sessionId, packConfig
     const ageOpts = lifecycle.maxAgeMs !== undefined ? { maxAgeMs: lifecycle.maxAgeMs } : {};
     const taskMarker = checkActiveClaimApprovalMarker(generatedDir, ageOpts);
     if (taskMarker.matched) {
+        const taskHash = taskMarker.marker?.reportContentHash ?? null;
+        // Only a task marker that binds a report can fail the gate-read hash
+        // check, so only then is the session marker read as its fallback.
+        const sessionFallback = taskHash === null
+            ? null
+            : (() => {
+                const fallback = checkSessionApprovalMarker(generatedDir, sessionId, {
+                    ...ageOpts,
+                    taskBinding: !lifecycle.legacyMode,
+                });
+                return fallback.matched
+                    ? {
+                        detail: fallback.detail,
+                        reportContentHash: fallback.marker?.reportContentHash ?? null,
+                    }
+                    : null;
+            })();
         return {
             matched: true,
             source: "task",
             detail: taskMarker.detail,
             taskCheckDetail: taskMarker.detail,
+            reportContentHash: taskHash,
+            sessionFallback,
             expired: false,
             forged: false,
             sessionBindingRefused: false,
@@ -186,6 +206,8 @@ export function checkOperatorApprovalMarkers(generatedDir, sessionId, packConfig
             source: "session",
             detail: sessionMarker.detail,
             taskCheckDetail: taskMarker.detail,
+            reportContentHash: sessionMarker.marker?.reportContentHash ?? null,
+            sessionFallback: null,
             expired: false,
             forged: false,
             sessionBindingRefused: false,
@@ -196,6 +218,8 @@ export function checkOperatorApprovalMarkers(generatedDir, sessionId, packConfig
         source: null,
         detail: sessionMarker.detail,
         taskCheckDetail: taskMarker.detail,
+        reportContentHash: null,
+        sessionFallback: null,
         // `expired` is computed ONLY on this non-matched path, preserving the
         // "false when matched is true" invariant (task 6e888423 review):
         // e.g. a FRESH session marker (matched:true, returned above) must not
@@ -222,4 +246,30 @@ export function clearTaskApprovalMarker(generatedDir, taskId) {
         /* already gone */
     }
 }
+/**
+ * Gate-read report cross-check for a matched operator marker, shared by the
+ * Claude and Codex PreToolUse hooks (task fa423e9b). Applies
+ * `verifyApprovedReportHash` to the matched marker and, when that fails and
+ * a session marker matched behind a task marker, to the session marker, so
+ * the verdict never depends on which marker the check order happened to
+ * pick. On success `source`/`detail` describe the marker that verified; on
+ * failure `detail` is the block reason.
+ */
+export function verifyMatchedMarkerReport(reportsDir, markers) {
+    const source = markers.source === "task" ? "task" : "session";
+    const primary = {
+        kind: source,
+        reportContentHash: markers.reportContentHash,
+    };
+    const fallback = markers.sessionFallback === null
+        ? null
+        : { kind: "session", reportContentHash: markers.sessionFallback.reportContentHash };
+    const verdict = verifyApprovedReportHash(reportsDir, primary, fallback);
+    if (!verdict.ok)
+        return verdict;
+    if (verdict.kind === primary.kind || markers.sessionFallback === null) {
+        return { ok: true, source: verdict.kind, detail: markers.detail };
+    }
+    return { ok: true, source: "session", detail: markers.sessionFallback.detail };
+}
 //# sourceMappingURL=task-markers.js.map