@lannguyensi/harness 0.59.2 → 0.60.0

package/dist/cli/pack/hook-codex-pre-tool-use.js

@@ -21,7 +21,7 @@
 // net for solo users; the harness blocker is strictly more powerful.
 import * as path from "node:path";
 import { queryLedgerByTag } from "../../policies/index.js";
-import { checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, matchLedgerEntries, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, describeMarkerTtlExpiry, matchLedgerEntries, noApprovalMarkerReason, verifyMatchedMarkerReport, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { findLatestParseError, renderMalformedSectionsNotice } from "../approve/understanding.js";
 import { CODEX_HARNESS } from "../../policy-packs/builtin/understanding-before-execution/auto-approve.js";
 import { attemptAutoApproval, AUTO_APPROVE_LEDGER_SOURCE_CODEX, } from "./auto-approve-path.js";
@@ -219,12 +219,22 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     // own reason text.
     let sessionBindingRefusedDetail;
     let markerExpired = false;
+    // The max_age sentence for the block reason (wording only, never read by a
+    // gate decision); set when the marker check reported a TTL expiry.
+    let markerTtlExpiry;
     // True when checkOperatorApprovalMarkers found a marker FILE that failed
     // signature verification (harness/f9485cc7), mirroring the Claude hook.
     let markerForged = false;
+    // Set when a marker matched but no persisted report file hashes to the
+    // content that marker was signed for any more (task fa423e9b),
+    // mirroring the Claude hook: the call falls through to the ordinary block
+    // path (read-only shell commands keep their exemption) with this reason.
+    let reportHashMismatchDetail;
+    const reportsDir = opts.reportsDir ?? defaultReportsDir();
     if (generatedDir !== undefined) {
         const markers = checkOperatorApprovalMarkers(generatedDir, sessionId, declared.config, stderr);
         markerExpired = markers.expired;
+        markerTtlExpiry = describeMarkerTtlExpiry(markers);
         markerForged = markers.forged;
         if (markers.source !== "task") {
             // Trace the task-marker miss, mirroring the Claude hook, so an
@@ -234,7 +244,14 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
         }
         sessionBindingRefusedDetail = markers.sessionBindingRefused ? markers.detail : undefined;
         if (markers.matched) {
-            return allowResult(markers.detail, "marker", stderr);
+            // Cross-check the matched marker's signed report hash against the
+            // persisted reports (task fa423e9b): the task marker first, the
+            // session marker as fallback.
+            const reportHash = verifyMatchedMarkerReport(reportsDir, markers);
+            if (reportHash.ok) {
+                return allowResult(reportHash.detail, "marker", stderr);
+            }
+            reportHashMismatchDetail = reportHash.detail;
         }
     }
     // Persisted-report EVIDENCE probe (task 7402301d), mirroring the Claude
@@ -246,7 +263,6 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     // this hook too. The read-only-Bash and recovery-git-commit carve-outs
     // below are separate, independently-argued exemptions, not a second
     // approval source.
-    const reportsDir = opts.reportsDir ?? defaultReportsDir();
     const report = checkPersistedReport(reportsDir, sessionId);
     // Audit-only ledger probe.
     const ledger = await checkLedger(manifest, sessionId, opts);
@@ -373,13 +389,20 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     // Neither operator source approved. Codex blocks via non-zero exit
     // + stderr reason; there is no JSON-decision wire to write to stdout.
     // Mirrors the Claude hook's distinct forged-marker reason (harness/f9485cc7).
-    const reason = generatedDir !== undefined
+    const unapprovedReason = generatedDir !== undefined
         ? markerForged
             ? `forged/unsigned marker rejected for session ${sessionId}; ${report.detail}; ${ledger.detail}`
             : sessionBindingRefusedDetail !== undefined
                 ? `${sessionBindingRefusedDetail}; ${report.detail}; ${ledger.detail}`
-                : `no approval marker for session ${sessionId}; ${report.detail}; ${ledger.detail}`
+                : noApprovalMarkerReason(sessionId, markerTtlExpiry, report.detail, ledger.detail)
         : `generatedDir not resolvable (test/injection path); ${report.detail}; ${ledger.detail}`;
+    // A marker that matched but whose signed report content is gone (the
+    // approved report was edited or removed after approval, task fa423e9b)
+    // gets its own reason, naming the marker kind and the one-command fix; no
+    // "no approval marker" wording applies to it.
+    const reason = reportHashMismatchDetail !== undefined
+        ? `${reportHashMismatchDetail}; ${ledger.detail}`
+        : unapprovedReason;
     // When the pack config declares `ux:`, the agent-facing block becomes
     // the plain-language shape and the legacy schemaHint text is
     // suppressed. The engine-vocabulary `reason` still lands in stderr
@@ -413,6 +436,10 @@ export async function runPackHookCodexPreToolUseCli(opts = {}) {
     if (malformedNotice) {
         agentFacing = `${agentFacing}\n\n${malformedNotice}`;
     }
+    // No separate expiry sentence is appended here (the Claude hook does append
+    // one): the Codex agent reads the whole stderr diagnostic, and the engine
+    // reason on its BLOCK line already carries `approval expired because ...`
+    // (see `noApprovalMarkerReason`), so a second copy would say it twice.
     const diagnostic = configUx
         ? `harness pack hook codex: BLOCK: ${reason}.\n${agentFacing}`
         : `harness pack hook codex: BLOCK: ${reason}. Tool: ${toolName}. ${agentFacing}`;

package/dist/cli/pack/hook-codex-pre-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,gDAAgD;AAChD,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,2EAA2E,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AAmErB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CACzB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAgD,CAAC;QAC9D,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6DACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,qGAAqG,EACrG,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,mBAAmB;IACnB,IAAI,2BAA+C,CAAC;IACpD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,CAAC,KAAK,CACV,+CAA+C,OAAO,CAAC,eAAe,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,mBAAmB;IACnB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE3D,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,sBAAsB,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,GAAG,2FAA2F,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QACrI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,kDAAkD;IAClD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,aAAa;QACb,mBAAmB,CAAC,UAAU,CAAC,EAC/B,CAAC;QACD,MAAM,UAAU,GAAG,6EAA6E,SAAS,oIAAoI,UAAU,CAAC,IAAI,EAAE,kFAAkF,CAAC;QACjV,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;YAChF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,+DAA+D;IAC/D,0DAA0D;IAC1D,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,SAAS;IACT,EAAE;IACF,mEAAmE;IACnE,kEAAkE;IAClE,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,EAAE;IACF,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,cAAc;IACd,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,GAAqD,EAAE;QAC/E,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,UAAU;QAClC,cAAc,EAAE,KAAK,CAAC,eAAe;QACrC,OAAO,EAAE,aAAa;QACtB,iEAAiE;QACjE,+DAA+D;QAC/D,uDAAuD;QACvD,YAAY,EAAE,gCAAgC;QAC9C,KAAK,EAAE,yBAAyB;QAChC,kBAAkB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE;QACtF,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,UAAU;QACV,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,oEAAoE;IACpE,wDAAwD;IACxD,gGAAgG;IAChG,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,+CAA+C,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,2BAA2B,KAAK,SAAS;gBACzC,CAAC,CAAC,GAAG,2BAA2B,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;gBACtE,CAAC,CAAC,kCAAkC,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;QACvF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF,IAAI,WAAW,GAAG,QAAQ;QACxB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,yDAAyD;IACzD,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,KAAK,IAAI;QACpB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC;QACtF,CAAC,CAAC,IAAI,CAAC;IACX,kEAAkE;IAClE,qDAAqD;IACrD,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,eAAe,GAAG,6BAA6B,CACnD,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAC1C,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,GAAG,GAAG,WAAW,OAAO,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-codex-pre-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-pre-tool-use.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,gDAAgD;AAChD,EAAE;AACF,+DAA+D;AAC/D,wEAAwE;AACxE,+DAA+D;AAC/D,0CAA0C;AAC1C,mEAAmE;AACnE,sCAAsC;AACtC,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,2EAA2E,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,CAAC,CAAC;AAmErB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM;IACN,OAAO;IACP,cAAc;IACd,wBAAwB;CACzB,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAgD,CAAC;QAC9D,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAkB,EAClB,SAAiB,EACjB,IAAoC;IAEpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,MAAqC,EACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,4BAA4B,MAAM,aAAa,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,6DACG,GAAa,CAAC,OACjB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAExE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAChB,yBAA0B,GAAa,CAAC,OAAO,GAAG,EAClD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,QAAQ,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,SAAS,QAAQ,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,WAAW,CAChB,qGAAqG,EACrG,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,4DAA4D;IAC5D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,mBAAmB;IACnB,IAAI,2BAA+C,CAAC;IACpD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,eAAmC,CAAC;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,uEAAuE;IACvE,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,wBAA4C,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;QACF,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACnD,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,CAAC,KAAK,CACV,+CAA+C,OAAO,CAAC,eAAe,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,kEAAkE;YAClE,gEAAgE;YAChE,8BAA8B;YAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,CAAC;YACD,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,mBAAmB;IACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE3D,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5D,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACvD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,sBAAsB,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,GAAG,2FAA2F,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QACrI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;YACrE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,kDAAkD;IAClD,IACE,UAAU,KAAK,IAAI;QACnB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,aAAa;QACb,mBAAmB,CAAC,UAAU,CAAC,EAC/B,CAAC;QACD,MAAM,UAAU,GAAG,6EAA6E,SAAS,oIAAoI,UAAU,CAAC,IAAI,EAAE,kFAAkF,CAAC;QACjV,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;YAChF,UAAU;SACX,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,+DAA+D;IAC/D,0DAA0D;IAC1D,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,SAAS;IACT,EAAE;IACF,mEAAmE;IACnE,kEAAkE;IAClE,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,EAAE;IACF,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,cAAc;IACd,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,GAAqD,EAAE;QAC/E,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,UAAU;QAClC,cAAc,EAAE,KAAK,CAAC,eAAe;QACrC,OAAO,EAAE,aAAa;QACtB,iEAAiE;QACjE,+DAA+D;QAC/D,uDAAuD;QACvD,YAAY,EAAE,gCAAgC;QAC9C,KAAK,EAAE,yBAAyB;QAChC,kBAAkB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe,EAAE;QACtF,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,UAAU;QACV,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,oEAAoE;IACpE,wDAAwD;IACxD,gGAAgG;IAChG,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,YAAY,KAAK,SAAS;QACjD,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,+CAA+C,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,2BAA2B,KAAK,SAAS;gBACzC,CAAC,CAAC,GAAG,2BAA2B,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;gBACtE,CAAC,CAAC,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACtF,CAAC,CAAC,sDAAsD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5F,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,MAAM,GACV,wBAAwB,KAAK,SAAS;QACpC,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,MAAM,EAAE;QACjD,CAAC,CAAC,gBAAgB,CAAC;IACvB,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,iEAAiE;IACjE,uBAAuB;IACvB,MAAM,QAAQ,GAAG,aAAa,CAC3B,QAAQ,CAAC,MAAkC,CAAC,IAAI,CAAC,EAClD,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF,IAAI,WAAW,GAAG,QAAQ;QACxB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC,CAAC,wGAAwG,sBAAsB,EAAE,EAAE,CAAC;IACvI,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,yDAAyD;IACzD,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,KAAK,IAAI;QACpB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC;QACtF,CAAC,CAAC,IAAI,CAAC;IACX,kEAAkE;IAClE,qDAAqD;IACrD,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,eAAe,GAAG,6BAA6B,CACnD,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAC1C,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,GAAG,GAAG,WAAW,OAAO,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,mCAAmC,MAAM,MAAM,WAAW,EAAE;QAC9D,CAAC,CAAC,mCAAmC,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAClE,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-post-merge-gate-record.d.ts

@@ -27,4 +27,11 @@ export interface PackHookPostMergeGateRecordResult {
     /** Human-readable explanation, always populated (even on a write). */
     diagnostic: string;
 }
+/**
+ * Does `command` look like a `gh pr merge` invocation to any of the four
+ * arms the gate policies use? Raw first, then each normalised form, lazily:
+ * a later arm runs only after every earlier arm missed. Exported for the
+ * divergence measurement and the ordering test.
+ */
+export declare function recorderTriggerMatches(command: string): boolean;
 export declare function runPackHookPostMergeGateRecordCli(opts?: PackHookPostMergeGateRecordOptions): Promise<PackHookPostMergeGateRecordResult>;

package/dist/cli/pack/hook-post-merge-gate-record.js

@@ -3,7 +3,7 @@
 //
 // Receives Claude Code's PostToolUse event JSON on stdin. Fires only when
 // the just-completed tool was Bash AND the command matched `gh pr merge`
-// AND the merge is CONFIRMED by one of two contracts (see
+// (see "Trigger arms" below) AND the merge is CONFIRMED by one of two contracts (see
 // `resolveMergeConfirmation` in post-merge-gate-runtime.ts, "PAYLOAD
 // REALITY" follow-up):
 //
@@ -27,6 +27,27 @@
 // (see post-merge-gate-runtime.ts's header for the full squash-fest
 // rationale — no ancestry walk, no `git` subprocess).
 //
+// Trigger arms: the trigger mirrors the four arms the `gh pr merge` gate
+// policies test in `policyMatchesEvent` (src/runtime/intercept.ts), in the
+// same raw-first, lazy order: `GH_PR_MERGE_BASH_RE` against (1) the raw
+// command, then (2) `normalizeCommand`, (3) `normalizeCommandAmpAware`,
+// (4) `normalizeCommandQuoteAware`. Each later arm is computed only when
+// every earlier arm missed, so a raw match never normalizes, and the
+// result is strictly additive (a command that matched raw keeps matching;
+// no arm removes a hit). That closes wrapper spellings (`nice`/`env`/
+// `command`/`time`), the bare-`&` chain (`echo hi & nice gh pr merge 1`)
+// and a boundary character inside a quoted assignment value
+// (`VAR='a; b' gh pr merge 1`), which the raw regex alone missed while the
+// gate blocked them. Normalisation is skipped above MAX_NORMALIZE_LENGTH,
+// like the gate; such a command is tested raw only, which is the one named
+// residual (a wrapper spelling in a command longer than that bound).
+// Like the gate, quoted text that holds a wrapper plus `gh pr merge` behind
+// a boundary (`git commit -m 'x; env gh pr merge 1'`) also matches; the
+// merged fact is still written only on a confirmed merge result.
+// Only the TRIGGER is widened: the PR number is still read from the raw
+// command and the merged fact is still written only when
+// `resolveMergeConfirmation` confirms the merge.
+//
 // Every non-match / failure path is a no-op: wrong tool, non-matching
 // command, neither contract confirms, an unresolvable git context, no
 // session id, a manifest/ledger failure. `PostToolUse` is `blocking:false`
@@ -34,6 +55,7 @@
 // session; the only observable effect of a miss is that the blocker has
 // no merged-tip fact to compare against for this particular merge.
 import { buildMergedTagContent, GH_PR_MERGE_BASH_RE, PACK_NAME, resolveMergeConfirmation, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
+import { normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, } from "../../runtime/command-normalize.js";
 import { resolveGitContext } from "../../runtime/git-context.js";
 import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
 import { checkHookPause, loadManifestOrInjected, readStdin } from "./hook-bootstrap.js";
@@ -44,6 +66,21 @@ function bashCommandOf(toolInput) {
     const cmd = toolInput["command"];
     return typeof cmd === "string" ? cmd : "";
 }
+/**
+ * Does `command` look like a `gh pr merge` invocation to any of the four
+ * arms the gate policies use? Raw first, then each normalised form, lazily:
+ * a later arm runs only after every earlier arm missed. Exported for the
+ * divergence measurement and the ordering test.
+ */
+export function recorderTriggerMatches(command) {
+    if (GH_PR_MERGE_BASH_RE.test(command))
+        return true;
+    if (GH_PR_MERGE_BASH_RE.test(normalizeCommand(command).normalized))
+        return true;
+    if (GH_PR_MERGE_BASH_RE.test(normalizeCommandAmpAware(command).normalized))
+        return true;
+    return GH_PR_MERGE_BASH_RE.test(normalizeCommandQuoteAware(command).normalized);
+}
 export async function runPackHookPostMergeGateRecordCli(opts = {}) {
     const stdin = opts.stdin ?? process.stdin;
     const stderr = opts.stderr ?? process.stderr;
@@ -73,7 +110,7 @@ export async function runPackHookPostMergeGateRecordCli(opts = {}) {
         return { exitCode: 0, wrote: false, diagnostic };
     }
     const command = bashCommandOf(event.tool_input);
-    if (!command || !GH_PR_MERGE_BASH_RE.test(command)) {
+    if (!command || !recorderTriggerMatches(command)) {
         const diagnostic = "command did not match gh pr merge, skipping";
         note(diagnostic);
         return { exitCode: 0, wrote: false, diagnostic };

package/dist/cli/pack/hook-post-merge-gate-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-post-merge-gate-record.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate-record.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,0DAA0D;AAC1D,qEAAqE;AACrE,uBAAuB;AACvB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,4DAA4D;AAC5D,0EAA0E;AAC1E,6DAA6D;AAC7D,6DAA6D;AAC7D,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AAGjG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExF,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAyCjE,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,gCAAgC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,qEAAqE,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,QAAQ,QAAQ,IAAI,WAAW,wBAAwB,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,kCAAkC,YAAY,CAAC,MAAM,+BAA+B,CAAC;QACxG,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GACd,kCAAkC,GAAG,GAAG;YACxC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;YAC9F,4BAA4B,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,+GAA+G,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3F,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,+BAA+B,CAAC;YAClG,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,mBAAmB,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"hook-post-merge-gate-record.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate-record.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,qFAAqF;AACrF,qEAAqE;AACrE,uBAAuB;AACvB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,4DAA4D;AAC5D,0EAA0E;AAC1E,6DAA6D;AAC7D,6DAA6D;AAC7D,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,4DAA4D;AAC5D,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,wEAAwE;AACxE,iEAAiE;AACjE,wEAAwE;AACxE,yDAAyD;AACzD,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AAGjG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExF,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAyCjE,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,mBAAmB,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,mBAAmB,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,gCAAgC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,qEAAqE,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,QAAQ,QAAQ,IAAI,WAAW,wBAAwB,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,kCAAkC,YAAY,CAAC,MAAM,+BAA+B,CAAC;QACxG,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GACd,kCAAkC,GAAG,GAAG;YACxC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;YAC9F,4BAA4B,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,+GAA+G,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3F,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,+BAA+B,CAAC;YAClG,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,mBAAmB,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC"}

package/dist/cli/pack/hook-post-tool-use.js

@@ -29,7 +29,7 @@
 // (task 5018c0c4; this hook is not emitted under `mode: session`, the
 // one mode where that binding is not applied), so it degrades to a
 // per-task approval, not to the legacy per-session contract.
-import { applyPostToolUseExpiry, defaultReportsDir, describePostToolUseExpiry, matchPostToolUseBoundary, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { applyPostToolUseExpiry, defaultReportsDir, describePostToolUseExpiry, describePostToolUseTrigger, matchPostToolUseBoundary, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
 import { checkHookPause, loadManifestOrInjected, readStdin, } from "./hook-bootstrap.js";
 const PACK_NAME = "understanding-before-execution";
@@ -122,7 +122,7 @@ export async function runPackHookPostToolUseCli(opts = {}) {
     // and expire the persisted report — same side effects the Codex
     // sibling hook applies via the shared `applyPostToolUseExpiry`.
     const reportsDir = opts.reportsDir ?? defaultReportsDir();
-    const expiry = applyPostToolUseExpiry(generatedDir, sessionId, event.tool_input, boundary.toolNameMatched, reportsDir, opts.now);
+    const expiry = applyPostToolUseExpiry(generatedDir, sessionId, event.tool_input, boundary.toolNameMatched, reportsDir, opts.now, describePostToolUseTrigger(toolName, boundary));
     const diagnostic = describePostToolUseExpiry("harness pack hook post-tool-use", sessionId, toolName, boundary.bashRegex, expiry);
     stderr.write(`${diagnostic}\n`);
     return {

package/dist/cli/pack/hook-post-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,gEAAgE;AAChE,sEAAsE;AACtE,mEAAmE;AACnE,6DAA6D;AAE7D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAqDnD,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CACT,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,gEAAgE,EAChE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uGAAuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,8DAA8D;IAC9D,uEAAuE;IACvE,8DAA8D;IAC9D,mBAAmB;IACnB,MAAM,QAAQ,GAAG,wBAAwB,CACvC,QAAQ,EACR,KAAK,CAAC,UAAU,EAChB,SAAS,EACT,SAAS,EACT,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB;YACzC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACnB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B;YAClD,CAAC,CAAC,GAAG,QAAQ,oDAAoD,CAAC;QACpE,OAAO,IAAI,CACT,oCAAoC,MAAM,YAAY,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,sBAAsB,CACnC,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,UAAU,EAChB,QAAQ,CAAC,eAAe,EACxB,UAAU,EACV,IAAI,CAAC,GAAG,CACT,CAAC;IAEF,MAAM,UAAU,GAAG,yBAAyB,CAC1C,iCAAiC,EACjC,SAAS,EACT,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,MAAM,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hook-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-tool-use.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,gEAAgE;AAChE,sEAAsE;AACtE,mEAAmE;AACnE,6DAA6D;AAE7D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAqDnD,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,+EAA+E,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CACT,0EAA0E,EAC1E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,wDAAwD,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EAC3J,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,0DAA2D,GAAa,CAAC,OAAO,aAAa,EAC7F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,0CAA0C,QAAQ,sCAAsC,EACxF,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,0CAA0C,QAAQ,8BAA8B,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,gEAAgE,EAChE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,uGAAuG,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,8DAA8D;IAC9D,uEAAuE;IACvE,8DAA8D;IAC9D,mBAAmB;IACnB,MAAM,QAAQ,GAAG,wBAAwB,CACvC,QAAQ,EACR,KAAK,CAAC,UAAU,EAChB,SAAS,EACT,SAAS,EACT,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB;YACzC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACnB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B;YAClD,CAAC,CAAC,GAAG,QAAQ,oDAAoD,CAAC;QACpE,OAAO,IAAI,CACT,oCAAoC,MAAM,YAAY,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,oFAAoF,EACpF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,sBAAsB,CACnC,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,UAAU,EAChB,QAAQ,CAAC,eAAe,EACxB,UAAU,EACV,IAAI,CAAC,GAAG,EACR,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;IAEF,MAAM,UAAU,GAAG,yBAAyB,CAC1C,iCAAiC,EACjC,SAAS,EACT,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,MAAM,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-pre-tool-use.js

@@ -56,7 +56,7 @@ import * as path from "node:path";
 import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
 import { queryLedgerByTag, } from "../../policies/index.js";
 import { renderProducers } from "../../policies/producers.js";
-import { ADOPTION_LEDGER_DIRNAME, CLAUDE_CODE_HARNESS, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, delegationMarkerPathFor, delegationReportPathFor, harnessAllowed, listPersistedReports, matchLedgerEntries, parseAutoApprove, readActiveClaim, recordPermissionModeObservation, sanitizeForDisplay, selectNewestStrictSessionReport, verifyDelegation, verifyInflightRecord, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
+import { ADOPTION_LEDGER_DIRNAME, CLAUDE_CODE_HARNESS, approvalExpiryNotice, checkOperatorApprovalMarkers, checkPersistedReport, defaultReportsDir, delegationMarkerPathFor, delegationReportPathFor, describeMarkerTtlExpiry, harnessAllowed, listPersistedReports, matchLedgerEntries, noApprovalMarkerReason, parseAutoApprove, readActiveClaim, recordPermissionModeObservation, sanitizeForDisplay, selectNewestStrictSessionReport, verifyDelegation, verifyInflightRecord, verifyMatchedMarkerReport, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
 import { resolveMode, toPackageMode, } from "../../policy-packs/builtin/understanding-before-execution.js";
 import { sha256Hex, signingKeyExists } from "../../runtime/approval-signing.js";
 import { findLatestParseError, renderMalformedSectionsNotice } from "../approve/understanding.js";
@@ -233,7 +233,7 @@ function parseConfigProducers(raw, stderr) {
 // the deny envelope the agent sees becomes the plain-language
 // `{ cannot, required, run }` shape and the legacy "Understanding Gate:
 // no approved..." + schemaHint + producers vocabulary is suppressed.
-function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malformedSections, retryInstruction) {
+function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malformedSections, retryInstruction, expiryNotice) {
     // When the pack config declares `ux:`, the agent-facing surface
     // becomes the plain-language `{ cannot, required, run }` shape, and
     // the legacy schemaHint + producers block is suppressed (the ux
@@ -261,6 +261,13 @@ function blockJson(toolName, reason, producers, ux, sessionId, escapeHint, malfo
         const producersBlock = renderProducers(producers, { SESSION_ID: sessionId });
         reasonText = `Understanding Gate: ${reason}. Tool: ${toolName}. ${suffix}\n${schemaHint}${producersBlock}`;
     }
+    // Say why the approval lapsed (max_age elapsed, or the PostToolUse event
+    // that expired it), after the ux/legacy envelope for the same reason the
+    // malformed-sections notice below is appended there: both envelopes omit
+    // the engine vocabulary, so without this the agent would not see it.
+    if (expiryNotice) {
+        reasonText = `${reasonText}\n\n${expiryNotice}`;
+    }
     // Name the malformed sections from the session's own latest parse-error
     // log, when it carries any (task 823837fd, follow-up to 7e29e5d7): a
     // (list) heading that WAS present but whose body was prose instead of
@@ -543,6 +550,9 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // runtime.ts's `OperatorMarkerApproval.expired` doc for the full
     // distinction.
     let markerExpired = false;
+    // The max_age sentence for the block reason (wording only, never read by a
+    // gate decision); set when the marker check reported a TTL expiry.
+    let markerTtlExpiry;
     // True when checkOperatorApprovalMarkers found a marker FILE that failed
     // signature verification (harness/f9485cc7) — missing/invalid signature,
     // wrong alg, or tampered payload — for either the task-scoped or
@@ -562,6 +572,15 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // text below differs, so the operator sees why an approval that exists
     // on disk does not open the gate.
     let sessionBindingRefusedDetail;
+    // Set when a marker matched but no persisted report file hashes to the
+    // content that marker was signed for any more (task fa423e9b).
+    // The marker is then treated as not matching: the call falls through to the
+    // ordinary block path (read-only Bash and the operator-approval command
+    // keep their exemptions) with this as the reason, and the in-flight
+    // subagent record below is not consulted, because it would otherwise
+    // re-open the gate for a subagent under the very approval just refused.
+    let reportHashMismatchDetail;
+    const reportsDir = opts.reportsDir ?? defaultReportsDir();
     if (generatedDir !== undefined) {
         // Source 1a/1b: task-scoped marker for the currently-claimed task
         // (harness/1ee26e77 + PR #198 correctness fix), then the
@@ -571,6 +590,7 @@ export async function runPackHookPreToolUseCli(opts = {}) {
         // runtimes cannot drift on lifecycle semantics again.
         const markers = checkOperatorApprovalMarkers(generatedDir, sessionId, declared.config, stderr);
         markerExpired = markers.expired;
+        markerTtlExpiry = describeMarkerTtlExpiry(markers);
         markerForged = markers.forged;
         if (markers.sessionBindingRefused)
             sessionBindingRefusedDetail = markers.detail;
@@ -595,14 +615,22 @@ export async function runPackHookPreToolUseCli(opts = {}) {
             stderr.write(`harness pack hook: task-scoped check: ${markers.taskCheckDetail}\n`);
         }
         if (markers.matched) {
-            const diagnostic = `harness pack hook: ${markers.detail}, allowing.`;
-            stderr.write(`${diagnostic}\n`);
-            return {
-                exitCode: 0,
-                blocked: false,
-                approvalCheck: { approved: true, source: "marker", detail: markers.detail },
-                diagnostic,
-            };
+            // Cross-check the matched marker's signed report hash against the
+            // persisted reports (task fa423e9b): the task marker first, the
+            // session marker as fallback, so the verdict never depends on which
+            // marker the check order picked.
+            const reportHash = verifyMatchedMarkerReport(reportsDir, markers);
+            if (reportHash.ok) {
+                const diagnostic = `harness pack hook: ${reportHash.detail}, allowing.`;
+                stderr.write(`${diagnostic}\n`);
+                return {
+                    exitCode: 0,
+                    blocked: false,
+                    approvalCheck: { approved: true, source: "marker", detail: reportHash.detail },
+                    diagnostic,
+                };
+            }
+            reportHashMismatchDetail = reportHash.detail;
         }
     }
     // Source 1c: in-flight subagent record (ADR "TTL, cwd, and subagents").
@@ -634,7 +662,9 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // from a record simply never existing, so the subagent sentence below
     // can name the actual cause instead of always saying "no record".
     let inflightStale = false;
-    if (generatedDir !== undefined && agentId !== undefined) {
+    if (generatedDir !== undefined &&
+        agentId !== undefined &&
+        reportHashMismatchDetail === undefined) {
         const record = verifyInflightRecord(generatedDir, sessionId, agentId, opts.now !== undefined ? { now: opts.now } : {});
         inflightForged = record.forged;
         inflightStale = record.stale;
@@ -673,7 +703,6 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // source that opens the gate. The carve-outs below (read-only Bash,
     // recovery git-commit, escape-ask) are separate, independently-argued
     // exemptions, not a second approval source.
-    const reportsDir = opts.reportsDir ?? defaultReportsDir();
     const report = checkPersistedReport(reportsDir, sessionId);
     // Audit-only ledger probe: the ledger row is still recorded by
     // `harness approve understanding`, and we surface its presence in
@@ -713,15 +742,22 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     // record gets its own distinct phrase for the same reason, checked
     // second so a forged SESSION/TASK marker (the higher-authority forgery)
     // is never masked by a merely-forged copy of it.
-    const reason = generatedDir !== undefined
+    const unapprovedReason = generatedDir !== undefined
         ? markerForged
             ? `forged/unsigned marker rejected for session ${sessionId}; ${report.detail}; ${ledger.detail}`
             : inflightForged
                 ? `forged/unsigned in-flight record for agent ${displayAgentId} rejected for session ${sessionId}; ${report.detail}; ${ledger.detail}`
                 : sessionBindingRefusedDetail !== undefined
                     ? `${sessionBindingRefusedDetail}; ${report.detail}; ${ledger.detail}${subagentRecordSentence}`
-                    : `no approval marker for session ${sessionId}; ${report.detail}; ${ledger.detail}${subagentRecordSentence}`
+                    : noApprovalMarkerReason(sessionId, markerTtlExpiry, report.detail, ledger.detail, subagentRecordSentence)
         : `generatedDir not resolvable (test/injection path); ${report.detail}; ${ledger.detail}`;
+    // A marker that matched but whose signed report content is gone (the
+    // approved report was edited or removed after approval, task fa423e9b)
+    // gets its own reason, naming the marker kind and the one-command fix; no
+    // "no approval marker" wording applies to it.
+    const reason = reportHashMismatchDetail !== undefined
+        ? `${reportHashMismatchDetail}; ${ledger.detail}`
+        : unapprovedReason;
     // Stage the session id so `harness approve`, run from the operator's
     // shell where $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID is unset, can resolve it without
     // guessing from transcript filenames. Covers both the ask and the
@@ -1217,6 +1253,15 @@ export async function runPackHookPreToolUseCli(opts = {}) {
     const latestParseError = report.report === null
         ? findLatestParseError(path.join(path.dirname(reportsDir), "parse-errors"), sessionId)
         : null;
+    // The expiry notice belongs to the routine "no approval marker" reason
+    // only: a forged marker, a forged in-flight record or a refused task
+    // binding keep their own reasons and never carry it.
+    const expiryNotice = generatedDir !== undefined &&
+        !markerForged &&
+        !inflightForged &&
+        sessionBindingRefusedDetail === undefined
+        ? approvalExpiryNotice(markerTtlExpiry, report.report)
+        : undefined;
     // The subagent record sentence, delivered to the AGENT through the
     // same channel the slice-3 retry instruction uses (appended after both
     // the `ux:` and legacy envelopes, so it survives either one) rather
@@ -1237,7 +1282,7 @@ export async function runPackHookPreToolUseCli(opts = {}) {
         : displayAgentId !== undefined && subagentRecordSentence.length > 0
             ? subagentRecordSentence.trim()
             : null;
-    stdout.write(`${blockJson(toolName, "no approved Understanding Report for this session", configProducers, configUx, sessionId, escapeHint, latestParseError?.malformedSections, agentInstruction)}\n`);
+    stdout.write(`${blockJson(toolName, "no approved Understanding Report for this session", configProducers, configUx, sessionId, escapeHint, latestParseError?.malformedSections, agentInstruction, expiryNotice)}\n`);
     return {
         exitCode: 0,
         blocked: true,