@lannguyensi/harness 0.59.2 → 0.61.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (125) hide show
  1. package/CHANGELOG.md +66 -0
  2. package/README.md +1 -1
  3. package/dist/cli/apply/apply.d.ts +20 -0
  4. package/dist/cli/apply/apply.js +13 -7
  5. package/dist/cli/apply/apply.js.map +1 -1
  6. package/dist/cli/apply/install-codex-config.d.ts +26 -4
  7. package/dist/cli/apply/install-codex-config.js +299 -120
  8. package/dist/cli/apply/install-codex-config.js.map +1 -1
  9. package/dist/cli/approve/understanding.d.ts +6 -6
  10. package/dist/cli/approve/understanding.js +62 -58
  11. package/dist/cli/approve/understanding.js.map +1 -1
  12. package/dist/cli/bounded-stdin.d.ts +27 -0
  13. package/dist/cli/bounded-stdin.js +82 -0
  14. package/dist/cli/bounded-stdin.js.map +1 -0
  15. package/dist/cli/doctor/format.js +22 -0
  16. package/dist/cli/doctor/format.js.map +1 -1
  17. package/dist/cli/doctor/index.js +60 -31
  18. package/dist/cli/doctor/index.js.map +1 -1
  19. package/dist/cli/doctor/settings-drift.js +12 -2
  20. package/dist/cli/doctor/settings-drift.js.map +1 -1
  21. package/dist/cli/doctor/types.d.ts +17 -0
  22. package/dist/cli/dry-run.js +7 -0
  23. package/dist/cli/dry-run.js.map +1 -1
  24. package/dist/cli/index.js +46 -144
  25. package/dist/cli/index.js.map +1 -1
  26. package/dist/cli/pack/auto-approve-path.js +47 -13
  27. package/dist/cli/pack/auto-approve-path.js.map +1 -1
  28. package/dist/cli/pack/hook-bootstrap.d.ts +71 -5
  29. package/dist/cli/pack/hook-bootstrap.js +92 -18
  30. package/dist/cli/pack/hook-bootstrap.js.map +1 -1
  31. package/dist/cli/pack/hook-branch-protection.d.ts +6 -0
  32. package/dist/cli/pack/hook-branch-protection.js +11 -2
  33. package/dist/cli/pack/hook-branch-protection.js.map +1 -1
  34. package/dist/cli/pack/hook-codex-post-tool-use.js +2 -2
  35. package/dist/cli/pack/hook-codex-post-tool-use.js.map +1 -1
  36. package/dist/cli/pack/hook-codex-pre-tool-use.d.ts +6 -0
  37. package/dist/cli/pack/hook-codex-pre-tool-use.js +52 -7
  38. package/dist/cli/pack/hook-codex-pre-tool-use.js.map +1 -1
  39. package/dist/cli/pack/hook-post-merge-gate-record.d.ts +7 -0
  40. package/dist/cli/pack/hook-post-merge-gate-record.js +39 -2
  41. package/dist/cli/pack/hook-post-merge-gate-record.js.map +1 -1
  42. package/dist/cli/pack/hook-post-merge-gate.d.ts +6 -0
  43. package/dist/cli/pack/hook-post-merge-gate.js +17 -2
  44. package/dist/cli/pack/hook-post-merge-gate.js.map +1 -1
  45. package/dist/cli/pack/hook-post-tool-use.js +2 -2
  46. package/dist/cli/pack/hook-post-tool-use.js.map +1 -1
  47. package/dist/cli/pack/hook-pre-tool-use.d.ts +7 -0
  48. package/dist/cli/pack/hook-pre-tool-use.js +84 -18
  49. package/dist/cli/pack/hook-pre-tool-use.js.map +1 -1
  50. package/dist/cli/pack/hook-runtime-reality.d.ts +2 -0
  51. package/dist/cli/pack/hook-runtime-reality.js +49 -9
  52. package/dist/cli/pack/hook-runtime-reality.js.map +1 -1
  53. package/dist/cli/pack/hook-solution-acceptance-writeguard.d.ts +6 -0
  54. package/dist/cli/pack/hook-solution-acceptance-writeguard.js +11 -2
  55. package/dist/cli/pack/hook-solution-acceptance-writeguard.js.map +1 -1
  56. package/dist/cli/pack/hook-solution-acceptance.d.ts +6 -0
  57. package/dist/cli/pack/hook-solution-acceptance.js +11 -2
  58. package/dist/cli/pack/hook-solution-acceptance.js.map +1 -1
  59. package/dist/cli/pack/hook-subagent-start.d.ts +2 -0
  60. package/dist/cli/pack/hook-subagent-start.js +21 -4
  61. package/dist/cli/pack/hook-subagent-start.js.map +1 -1
  62. package/dist/cli/policy/intercept.d.ts +2 -0
  63. package/dist/cli/policy/intercept.js +14 -13
  64. package/dist/cli/policy/intercept.js.map +1 -1
  65. package/dist/cli/record/index.d.ts +11 -2
  66. package/dist/cli/record/index.js +114 -25
  67. package/dist/cli/record/index.js.map +1 -1
  68. package/dist/cli/session-start/branch-check.d.ts +3 -29
  69. package/dist/cli/session-start/branch-check.js +10 -37
  70. package/dist/cli/session-start/branch-check.js.map +1 -1
  71. package/dist/cli/session-start/index.d.ts +3 -32
  72. package/dist/cli/session-start/index.js +19 -31
  73. package/dist/cli/session-start/index.js.map +1 -1
  74. package/dist/cli/session-start/shared-options.d.ts +103 -0
  75. package/dist/cli/session-start/shared-options.js +107 -0
  76. package/dist/cli/session-start/shared-options.js.map +1 -0
  77. package/dist/cli/session-start/stale-base-check.d.ts +3 -28
  78. package/dist/cli/session-start/stale-base-check.js +10 -37
  79. package/dist/cli/session-start/stale-base-check.js.map +1 -1
  80. package/dist/cli/session-start/toolchain-parity.d.ts +5 -21
  81. package/dist/cli/session-start/toolchain-parity.js +9 -38
  82. package/dist/cli/session-start/toolchain-parity.js.map +1 -1
  83. package/dist/cli/smoke/index.d.ts +1 -1
  84. package/dist/cli/smoke/index.js +8 -11
  85. package/dist/cli/smoke/index.js.map +1 -1
  86. package/dist/policy-packs/builtin/post-merge-gate-runtime.d.ts +11 -0
  87. package/dist/policy-packs/builtin/post-merge-gate-runtime.js +11 -0
  88. package/dist/policy-packs/builtin/post-merge-gate-runtime.js.map +1 -1
  89. package/dist/policy-packs/builtin/post-merge-gate.js +5 -2
  90. package/dist/policy-packs/builtin/post-merge-gate.js.map +1 -1
  91. package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.d.ts +36 -0
  92. package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.js +73 -0
  93. package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.js.map +1 -0
  94. package/dist/policy-packs/builtin/understanding-before-execution/index.d.ts +3 -2
  95. package/dist/policy-packs/builtin/understanding-before-execution/index.js +5 -2
  96. package/dist/policy-packs/builtin/understanding-before-execution/index.js.map +1 -1
  97. package/dist/policy-packs/builtin/understanding-before-execution/markers.js +1 -0
  98. package/dist/policy-packs/builtin/understanding-before-execution/markers.js.map +1 -1
  99. package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.d.ts +253 -1
  100. package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js +429 -13
  101. package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js.map +1 -1
  102. package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.d.ts +1 -1
  103. package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js +2 -2
  104. package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js.map +1 -1
  105. package/dist/policy-packs/builtin/understanding-before-execution/task-markers.d.ts +36 -0
  106. package/dist/policy-packs/builtin/understanding-before-execution/task-markers.js +50 -0
  107. package/dist/policy-packs/builtin/understanding-before-execution/task-markers.js.map +1 -1
  108. package/dist/policy-packs/builtin/understanding-before-execution.d.ts +3 -2
  109. package/dist/policy-packs/builtin/understanding-before-execution.js +4 -1
  110. package/dist/policy-packs/builtin/understanding-before-execution.js.map +1 -1
  111. package/dist/runtime/bash-prefix-parse.js +319 -126
  112. package/dist/runtime/bash-prefix-parse.js.map +1 -1
  113. package/dist/runtime/deletion-target-resolve.js +24 -1
  114. package/dist/runtime/deletion-target-resolve.js.map +1 -1
  115. package/dist/runtime/destructive-shell-floor.js +15 -1
  116. package/dist/runtime/destructive-shell-floor.js.map +1 -1
  117. package/dist/runtime/intercept.d.ts +38 -0
  118. package/dist/runtime/intercept.js +224 -5
  119. package/dist/runtime/intercept.js.map +1 -1
  120. package/dist/runtime/read-only-bash.js +11 -1
  121. package/dist/runtime/read-only-bash.js.map +1 -1
  122. package/dist/runtime/shell-word.d.ts +42 -1
  123. package/dist/runtime/shell-word.js +174 -6
  124. package/dist/runtime/shell-word.js.map +1 -1
  125. package/package.json +1 -1
@@ -14,6 +14,7 @@ import * as fs from "node:fs";
14
14
  import * as path from "node:path";
15
15
  import { atomicWriteFile } from "../../../io/atomic-write.js";
16
16
  import { safeJsonParse } from "../../../io/safe-json-parse.js";
17
+ import { sha256Hex } from "../../../runtime/approval-signing.js";
17
18
  const DEFAULT_REPORTS_DIRNAME = ".understanding-gate";
18
19
  const REPORTS_SUBDIR = "reports";
19
20
  /**
@@ -64,10 +65,10 @@ function parseFilenameIsoMs(name) {
64
65
  const ms = Date.parse(`${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z`);
65
66
  return Number.isNaN(ms) ? null : ms;
66
67
  }
67
- function readPersistedReport(filePath, mtimeMs) {
68
+ function readPersistedReport(filePath, mtimeMs, boundedRaw) {
68
69
  let raw;
69
70
  try {
70
- raw = fs.readFileSync(filePath, "utf8");
71
+ raw = boundedRaw ?? fs.readFileSync(filePath, "utf8");
71
72
  }
72
73
  catch {
73
74
  return null;
@@ -86,6 +87,8 @@ function readPersistedReport(filePath, mtimeMs) {
86
87
  sessionId: typeof obj["sessionId"] === "string" ? obj["sessionId"] : null,
87
88
  approvalStatus: typeof obj["approvalStatus"] === "string" ? obj["approvalStatus"] : null,
88
89
  approvedAt: typeof obj["approvedAt"] === "string" ? obj["approvedAt"] : null,
90
+ expiredBy: typeof obj["expiredBy"] === "string" ? obj["expiredBy"] : null,
91
+ expiredAt: typeof obj["expiredAt"] === "string" ? obj["expiredAt"] : null,
89
92
  createdAt,
90
93
  createdAtMs,
91
94
  };
@@ -265,7 +268,7 @@ const DETAIL_VALUE_MAX_LENGTH = 120;
265
268
  * forge extra `reason:`-looking lines) are replaced with a space and
266
269
  * the result is capped so one field cannot blow out the surface.
267
270
  */
268
- function sanitizeDetailValue(value) {
271
+ export function sanitizeDetailValue(value) {
269
272
  // Deliberately strips C0/DEL control characters (including newline,
270
273
  // which could otherwise forge an extra `reason:`-looking stderr line).
271
274
  const flattened = value.replace(/[\x00-\x1f\x7f]/g, " ");
@@ -292,8 +295,8 @@ function sanitizeDetailValue(value) {
292
295
  * best-effort cleanup so a missing report dir or unrelated I/O issue
293
296
  * does not escalate into a session-breaking hook failure.
294
297
  */
295
- export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
296
- const reports = listPersistedReports(reportsDir);
298
+ export function expirePersistedReport(reportsDir, sessionId, now = new Date(), trigger) {
299
+ const reports = listPersistedReportsBounded(reportsDir);
297
300
  if (reports.length === 0) {
298
301
  return { ok: false, reason: `no reports under ${reportsDir}` };
299
302
  }
@@ -310,13 +313,12 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
310
313
  reason: `latest report ${sanitizeDetailValue(path.basename(latest.filePath))} already has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}, nothing to expire`,
311
314
  };
312
315
  }
313
- let raw;
314
- try {
315
- raw = fs.readFileSync(latest.filePath, "utf8");
316
- }
317
- catch (err) {
318
- return { ok: false, reason: `failed to read ${latest.filePath}: ${err.message}` };
316
+ // Bounded like the listing: the file may have been swapped since.
317
+ const read = readReportFileBounded(latest.filePath);
318
+ if (!read.ok) {
319
+ return { ok: false, reason: `failed to read ${latest.filePath}: ${read.detail}` };
319
320
  }
321
+ const raw = read.raw;
320
322
  let parsed;
321
323
  try {
322
324
  parsed = JSON.parse(raw);
@@ -327,6 +329,13 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
327
329
  const previousStatus = typeof parsed["approvalStatus"] === "string" ? parsed["approvalStatus"] : null;
328
330
  parsed["approvalStatus"] = "expired";
329
331
  parsed["expiredAt"] = now.toISOString();
332
+ if (trigger !== undefined && trigger !== "") {
333
+ parsed["expiredBy"] = trigger;
334
+ }
335
+ else {
336
+ // No event to record: drop a stale one from an earlier expiry.
337
+ delete parsed["expiredBy"];
338
+ }
330
339
  try {
331
340
  atomicWriteFile(latest.filePath, `${JSON.stringify(parsed, null, 2)}\n`);
332
341
  }
@@ -356,7 +365,7 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
356
365
  * `understanding-gate approve` CLI, which writes no signed marker).
357
366
  */
358
367
  export function checkPersistedReport(reportsDir, sessionId) {
359
- const reports = listPersistedReports(reportsDir);
368
+ const reports = listPersistedReportsBounded(reportsDir);
360
369
  if (reports.length === 0) {
361
370
  return {
362
371
  claimsApproved: false,
@@ -374,9 +383,11 @@ export function checkPersistedReport(reportsDir, sessionId) {
374
383
  }
375
384
  const safeFileName = sanitizeDetailValue(path.basename(latest.filePath));
376
385
  if (latest.approvalStatus !== "approved") {
386
+ const boundaryExpiry = describeBoundaryExpiry(latest);
387
+ const expirySuffix = boundaryExpiry !== undefined ? `; ${boundaryExpiry}` : "";
377
388
  return {
378
389
  claimsApproved: false,
379
- detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}`,
390
+ detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}${expirySuffix}`,
380
391
  report: latest,
381
392
  };
382
393
  }
@@ -390,4 +401,409 @@ export function checkPersistedReport(reportsDir, sessionId) {
390
401
  report: latest,
391
402
  };
392
403
  }
404
+ /**
405
+ * `approval expired because <event> at <time>` for a report a PostToolUse
406
+ * boundary expired (`expirePersistedReport` stamps `expiredBy` and
407
+ * `expiredAt`), `undefined` for any other report, including an older one or
408
+ * one a package producer wrote that carries no `expiredBy`. Both values come
409
+ * from a JSON file the gated agent can write, so both pass
410
+ * `sanitizeDetailValue`.
411
+ */
412
+ export function describeBoundaryExpiry(report) {
413
+ if (report.approvalStatus !== "expired")
414
+ return undefined;
415
+ if (report.expiredBy === null || report.expiredBy === "")
416
+ return undefined;
417
+ const when = report.expiredAt !== null && report.expiredAt !== ""
418
+ ? ` at ${sanitizeDetailValue(report.expiredAt)}`
419
+ : "";
420
+ return `approval expired because ${sanitizeDetailValue(report.expiredBy)}${when}`;
421
+ }
422
+ /**
423
+ * Report fields the approval and expiry lifecycles rewrite. They are left
424
+ * out of {@link canonicalReportHash}: `rewriteReportApproved` flips
425
+ * `approvalStatus`/`approvedAt`/`approvedBy`, may stamp `sessionId`, and
426
+ * drops `expiredAt`/`expiredBy`; `expirePersistedReport` later sets
427
+ * `approvalStatus`/`expiredAt`/`expiredBy` again. The hash must survive all
428
+ * of that for an untouched report, so it covers only the content the
429
+ * operator actually reviewed.
430
+ */
431
+ const LIFECYCLE_REPORT_FIELDS = new Set([
432
+ "approvalStatus",
433
+ "approvedAt",
434
+ "approvedBy",
435
+ "expiredAt",
436
+ "expiredBy",
437
+ "sessionId",
438
+ ]);
439
+ /**
440
+ * Deepest array/object nesting {@link canonicalReportHash} serialises (the
441
+ * report object itself is level 1). `sortKeysDeep` and `JSON.stringify`
442
+ * recurse once per level, and any agent-written `*.json` file in the reports
443
+ * directory reaches them through the gate-read scan, so without a bound a
444
+ * file nested a few thousand levels deep overflows the stack and the hook
445
+ * process dies instead of deciding. A real report nests a handful of levels.
446
+ */
447
+ const MAX_CANONICAL_REPORT_DEPTH = 64;
448
+ /**
449
+ * Largest report file, in bytes, the canonical hash reads from disk (1 MiB).
450
+ * Every `*.json` entry of the reports directory reaches the hash through the
451
+ * gate-read scan, and the agent can write that directory, so without a bound
452
+ * a planted file of a few hundred megabytes made the hook run out of heap or
453
+ * past its time budget instead of deciding (a hook that dies or overruns is a
454
+ * non-blocking error for the runtime). A real report is a few kilobytes, far
455
+ * below the cap. A file over the cap matches nothing at gate read, and both
456
+ * producers refuse to approve such a report.
457
+ */
458
+ export const MAX_HASHED_REPORT_BYTES = 1024 * 1024;
459
+ /**
460
+ * Iterative walk over the arrays and objects of `value` (the value itself is
461
+ * level 1) that stops at the first one nested deeper than `max` levels.
462
+ * Iterative, so the walk itself cannot overflow the stack. Only arrays and
463
+ * objects are pushed: a scalar child (string, number, boolean, null) cannot
464
+ * nest, so a wide array of scalars costs no stack slot per element, and
465
+ * `visited` counts the root plus the containers below it. Exported for tests.
466
+ */
467
+ export function walkContainerDepth(value, max) {
468
+ const nodes = [value];
469
+ const depths = [1];
470
+ let visited = 0;
471
+ while (nodes.length > 0) {
472
+ const node = nodes.pop();
473
+ const depth = depths.pop() ?? 1;
474
+ visited += 1;
475
+ if (node === null || typeof node !== "object")
476
+ continue;
477
+ if (depth > max)
478
+ return { tooDeep: true, visited };
479
+ for (const child of Array.isArray(node) ? node : Object.values(node)) {
480
+ if (child !== null && typeof child === "object") {
481
+ nodes.push(child);
482
+ depths.push(depth + 1);
483
+ }
484
+ }
485
+ }
486
+ return { tooDeep: false, visited };
487
+ }
488
+ /** True when `value` nests arrays/objects deeper than `max` levels. */
489
+ function nestsDeeperThan(value, max) {
490
+ return walkContainerDepth(value, max).tooDeep;
491
+ }
492
+ function sortKeysDeep(value) {
493
+ if (Array.isArray(value))
494
+ return value.map(sortKeysDeep);
495
+ if (value !== null && typeof value === "object") {
496
+ const entries = Object.entries(value)
497
+ .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
498
+ .map(([k, v]) => [k, sortKeysDeep(v)]);
499
+ // `Object.fromEntries` defines own properties, so a report key named
500
+ // `__proto__` stays data instead of re-parenting the copy.
501
+ return Object.fromEntries(entries);
502
+ }
503
+ return value;
504
+ }
505
+ /**
506
+ * The hash an approval marker signs as its `reportContentHash`, and the one
507
+ * the gate recomputes at read time (task fa423e9b): sha256 over a key-sorted
508
+ * JSON serialisation of the parsed report with the lifecycle fields in
509
+ * `LIFECYCLE_REPORT_FIELDS` removed. A raw-bytes hash cannot do this job: the
510
+ * producers hash before `rewriteReportApproved` re-serialises the file and
511
+ * `expirePersistedReport` rewrites it again, so the raw bytes of an untouched
512
+ * report never match what the marker signed. One function on purpose, shared
513
+ * by both producers (`harness approve understanding`, the auto-approval path)
514
+ * and the verifier.
515
+ *
516
+ * Total: returns null instead of throwing for a report nested deeper than
517
+ * `MAX_CANONICAL_REPORT_DEPTH`. The verifier counts such a file as one that
518
+ * matches nothing; both producers refuse to approve such a report, so no
519
+ * marker is ever signed without a content binding because of it. Report
520
+ * files reach it only after {@link readReportFileBounded} bounded their type
521
+ * and size (the gate-read scan and `harness approve understanding` through
522
+ * {@link hashReportFile}, the auto-approval path directly).
523
+ */
524
+ export function canonicalReportHash(report) {
525
+ // `Object.fromEntries` (not `kept[key] = value`): a report key named
526
+ // `__proto__` must stay hashed data, not re-parent the copy and vanish.
527
+ const kept = Object.fromEntries(Object.entries(report).filter(([key]) => !LIFECYCLE_REPORT_FIELDS.has(key)));
528
+ if (nestsDeeperThan(kept, MAX_CANONICAL_REPORT_DEPTH))
529
+ return null;
530
+ return sha256Hex(JSON.stringify(sortKeysDeep(kept)));
531
+ }
532
+ function errorCode(err) {
533
+ const code = err?.code;
534
+ return typeof code === "string" ? code : String(err);
535
+ }
536
+ /**
537
+ * Read a report file for hashing, bounded by type and size. This is the one
538
+ * read every canonical report hash goes through: the gate-read scan (via
539
+ * {@link hashReportFile}) and both producers. The path is opened once,
540
+ * read-only and non-blocking (`O_NONBLOCK`: opening a FIFO with no writer
541
+ * returns at once instead of waiting for one); its type and size come from
542
+ * `fstat` on that descriptor, and the content is read through the same
543
+ * descriptor, so nothing can be swapped in between (no separate stat of the
544
+ * path, which a symlink flipped to a FIFO used to race). Refused without
545
+ * reading: anything that is not a regular file, and a file larger than
546
+ * `MAX_HASHED_REPORT_BYTES`. The read stops one byte past the fstat size
547
+ * (never more than the cap plus one byte); a file that grows into that byte
548
+ * while being read is refused too. The descriptor is always closed. Never
549
+ * throws.
550
+ */
551
+ export function readReportFileBounded(filePath) {
552
+ let fd;
553
+ try {
554
+ fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
555
+ }
556
+ catch (err) {
557
+ return { ok: false, reason: "unreadable", detail: `could not be opened (${errorCode(err)})` };
558
+ }
559
+ try {
560
+ const stat = fs.fstatSync(fd);
561
+ if (!stat.isFile())
562
+ return { ok: false, reason: "not-regular", detail: "not a regular file" };
563
+ if (stat.size > MAX_HASHED_REPORT_BYTES) {
564
+ return {
565
+ ok: false,
566
+ reason: "too-large",
567
+ detail: `${stat.size} bytes, over the ${MAX_HASHED_REPORT_BYTES}-byte cap for hashing its content`,
568
+ };
569
+ }
570
+ const buf = Buffer.allocUnsafe(stat.size + 1);
571
+ let total = 0;
572
+ while (total < buf.length) {
573
+ const n = fs.readSync(fd, buf, total, buf.length - total, null);
574
+ if (n === 0)
575
+ break;
576
+ total += n;
577
+ }
578
+ if (total > stat.size)
579
+ return { ok: false, reason: "grew", detail: "grew while being read" };
580
+ return { ok: true, raw: buf.toString("utf8", 0, total), mtimeMs: stat.mtimeMs };
581
+ }
582
+ catch (err) {
583
+ return { ok: false, reason: "unreadable", detail: `could not be read (${errorCode(err)})` };
584
+ }
585
+ finally {
586
+ try {
587
+ fs.closeSync(fd);
588
+ }
589
+ catch {
590
+ // Already gone; nothing left to release.
591
+ }
592
+ }
593
+ }
594
+ /**
595
+ * Canonical hash of the report file at `filePath`, read through
596
+ * {@link readReportFileBounded}, or why it has none: not a regular file, over
597
+ * `MAX_HASHED_REPORT_BYTES`, unreadable, grown while read, not a JSON object,
598
+ * or nested too deeply. `harness approve understanding` refuses a report on
599
+ * any of these (the `detail` is its message); the gate-read scan counts such
600
+ * a file as one that matches nothing. Never throws.
601
+ */
602
+ export function hashReportFile(filePath) {
603
+ const read = readReportFileBounded(filePath);
604
+ if (!read.ok)
605
+ return read;
606
+ const parsed = safeJsonParse(read.raw);
607
+ if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
608
+ return { ok: false, reason: "not-json-object", detail: "not a JSON object" };
609
+ }
610
+ const hash = canonicalReportHash(parsed);
611
+ if (hash === null) {
612
+ return { ok: false, reason: "too-deep", detail: "nested too deeply to hash its content" };
613
+ }
614
+ return { ok: true, hash };
615
+ }
616
+ /** Canonical hash of the report file at `filePath` ({@link hashReportFile}); null when it has none. */
617
+ export function canonicalReportHashOfFile(filePath) {
618
+ const hashed = hashReportFile(filePath);
619
+ return hashed.ok ? hashed.hash : null;
620
+ }
621
+ /**
622
+ * Hash every `*.json` entry of `dir` (any session, any `approvalStatus`)
623
+ * through {@link canonicalReportHashOfFile} and report which of the `wanted`
624
+ * hashes occur. Stops as soon as every wanted hash was found. Every entry
625
+ * counts as a report file; one that is not a regular file, is larger than
626
+ * `MAX_HASHED_REPORT_BYTES`, cannot be opened or read, grows while read, is
627
+ * not a JSON object, or nests too deeply matches nothing. The cost is linear
628
+ * in the number and size of the report files (each read at most up to the
629
+ * cap), and the usual allow path scans nearly all of them: the directory
630
+ * listing comes back in name order and report names start with a timestamp,
631
+ * so the approved (newest) report tends to come last.
632
+ */
633
+ function scanReportHashes(dir, wanted) {
634
+ const scan = { files: 0, matched: new Set() };
635
+ let names;
636
+ try {
637
+ names = fs.readdirSync(dir);
638
+ }
639
+ catch {
640
+ return scan;
641
+ }
642
+ for (const name of names) {
643
+ if (!name.endsWith(".json"))
644
+ continue;
645
+ const full = path.join(dir, name);
646
+ scan.files += 1;
647
+ const hash = canonicalReportHashOfFile(full);
648
+ if (hash !== null && wanted.has(hash)) {
649
+ scan.matched.add(hash);
650
+ if (scan.matched.size === wanted.size)
651
+ break;
652
+ }
653
+ }
654
+ return scan;
655
+ }
656
+ /**
657
+ * Gate-read cross-check of a matched approval marker against the persisted
658
+ * reports (task fa423e9b). Both PreToolUse hooks call it after
659
+ * `checkOperatorApprovalMarkers` matched, through `verifyMatchedMarkerReport`.
660
+ *
661
+ * Rule: a marker with a non-null signed `reportContentHash` is valid iff at
662
+ * least one parseable report file in `reportsDir` (any session, any
663
+ * `approvalStatus`) has a canonical hash equal to it. The hash already
664
+ * leaves the lifecycle fields out, so approving, expiring or re-approving
665
+ * the report never changes it. The signed hash therefore proves one thing:
666
+ * the content the operator approved is still on disk unmodified. Editing
667
+ * that file (in place, by swap, by symlink, by an unparseable rewrite)
668
+ * removes the only match and the marker stops opening the gate. Comparing
669
+ * against the session's newest approved report instead would deny
670
+ * legitimate approvals (a newer report approved for the same claim, two
671
+ * sessions on one claim) and would let a swap pass by moving the swapped
672
+ * report out of the selection.
673
+ *
674
+ * Bounded input: only a regular file of at most `MAX_HASHED_REPORT_BYTES`
675
+ * (1 MiB) that parses as a JSON object nested at most 64 levels deep has a
676
+ * canonical hash, read through {@link readReportFileBounded} (opened
677
+ * non-blocking, typed and sized by `fstat` on the open descriptor, read
678
+ * through it). Every other `*.json` entry (a FIFO, a directory, a device, a
679
+ * symlink to one of them, a file over the cap, an unreadable, unparseable or
680
+ * too deeply nested file) still counts as a report file but matches nothing,
681
+ * so it can neither open the gate nor make the scan block, run out of
682
+ * memory or die instead of deciding.
683
+ *
684
+ * Residuals: (1) the check proves only that some file carries the approved
685
+ * content. Any regular `*.json` file within the size cap whose content
686
+ * equals it keeps a match, whether it was kept before the edit (a copy) or
687
+ * re-created after it (the agent wrote that content, so it can write it
688
+ * again), and the marker still opens the gate. (2) A reports directory that
689
+ * is empty, unreadable or holds no `*.json` entry at all (every report
690
+ * deleted, the directory made unreadable, the reports renamed) falls back to
691
+ * the "no report file" allow, the same as before this check existed. The
692
+ * marker and the operator's approval itself are untouched in both cases;
693
+ * only the audit trail loses its claim to be the approved content. (3) The
694
+ * cap bounds each file, not their number: the scan time grows with the
695
+ * total volume of report files, so an agent that plants hundreds of
696
+ * megabytes of files just under the cap can still push one scan past the
697
+ * hook's time budget, which the runtime treats as a non-blocking error (the
698
+ * same allow as before this check existed).
699
+ *
700
+ * Removing the approved report while other report files remain is a deny:
701
+ * nothing on disk carries the signed content any more. `harness gc --apply`
702
+ * can do that legitimately: it ages approved reports out by their createdAt
703
+ * but markers by their file mtime, so a report written long before its
704
+ * approval can go while the marker stays. Re-approving recovers.
705
+ *
706
+ * `primary` is the marker that satisfied the gate (task-scoped first),
707
+ * `fallback` a session marker that matched behind a task marker. The
708
+ * fallback is consulted only when the primary fails the check, so a task
709
+ * marker signed for another report does not hide a session marker that
710
+ * verifies. Unchanged behaviour: a null hash on the accepted marker (no
711
+ * report resolved, or `--force` over a report the producer could not hash:
712
+ * too deeply nested or over the size cap) and a reports directory with no
713
+ * `*.json` entry at all both allow. A forced approval of a hashable report
714
+ * signs its hash and is checked like any other.
715
+ *
716
+ * The `detail` is the block reason. It names the failing marker kind and the
717
+ * one-command fix, which is also the single migration step for a marker
718
+ * written before the canonical hash existed. It carries no report-derived
719
+ * value, so nothing in it needs sanitising.
720
+ */
721
+ export function verifyApprovedReportHash(reportsDir, primary, fallback = null) {
722
+ if (primary.reportContentHash === null)
723
+ return { ok: true, kind: primary.kind };
724
+ if (fallback !== null && fallback.reportContentHash === null) {
725
+ return { ok: true, kind: fallback.kind };
726
+ }
727
+ const wanted = new Set([primary.reportContentHash]);
728
+ if (fallback !== null && fallback.reportContentHash !== null) {
729
+ wanted.add(fallback.reportContentHash);
730
+ }
731
+ const scan = scanReportHashes(reportsDir, wanted);
732
+ if (scan.files === 0 || scan.matched.has(primary.reportContentHash)) {
733
+ return { ok: true, kind: primary.kind };
734
+ }
735
+ if (fallback !== null &&
736
+ fallback.reportContentHash !== null &&
737
+ scan.matched.has(fallback.reportContentHash)) {
738
+ return { ok: true, kind: fallback.kind };
739
+ }
740
+ const kinds = fallback !== null
741
+ ? `${primary.kind} and ${fallback.kind} approval markers were`
742
+ : `${primary.kind} approval marker was`;
743
+ return {
744
+ ok: false,
745
+ detail: `no report in the reports directory matches the content the ${kinds} signed for ` +
746
+ `(the approved report was changed or removed after approval); re-run \`harness approve understanding\``,
747
+ };
748
+ }
749
+ /**
750
+ * {@link listPersistedReports} for every read a PreToolUse hook (or the
751
+ * PostToolUse boundary) makes of the reports directory. The directory holds
752
+ * files the gated agent can write, so every entry is opened once through
753
+ * {@link readReportFileBounded}: non-blocking, typed and sized by `fstat` on
754
+ * the open descriptor, read through it. A `*.json` entry that is not a
755
+ * regular file (a FIFO, a directory, a device, a symlink to one of them), is
756
+ * over `MAX_HASHED_REPORT_BYTES`, cannot be opened or read, or grows while it
757
+ * is read is left out of `reports`, as if it were not there, and recorded in
758
+ * `skipped`: it can neither block the hook nor run it out of memory. There is
759
+ * no separate stat of the path (a symlink flipped to a FIFO between that stat
760
+ * and the read used to hang the read), and the modification time comes from
761
+ * the same descriptor.
762
+ *
763
+ * A caller that must not let the selection fall back to an older report when
764
+ * a newer one is unreadable (the auto-approval precondition) declines when
765
+ * `skipped` is not empty. The operator commands (`harness approve
766
+ * understanding`, `harness gc`) keep the unbounded {@link listPersistedReports}
767
+ * on purpose: they must still see an oversized report to refuse or age it.
768
+ *
769
+ * Placement: this block sits at the end of the file, and
770
+ * {@link readPersistedReport} takes the already-read text (`boundedRaw`), so
771
+ * the line numbers the decision record
772
+ * docs/decisions/2026-08-27-ug-auto-mode-approval.md cites in this file stay
773
+ * put (tests/decisions-citations-resolve.test.ts pins them).
774
+ */
775
+ export function listPersistedReportsBoundedWithSkips(dir) {
776
+ let names = [];
777
+ try {
778
+ names = fs.readdirSync(dir);
779
+ }
780
+ catch {
781
+ // No readable directory: no reports.
782
+ }
783
+ const reports = [];
784
+ const skipped = [];
785
+ for (const name of names.filter((n) => n.endsWith(".json"))) {
786
+ const full = path.join(dir, name);
787
+ const read = readReportFileBounded(full);
788
+ if (!read.ok) {
789
+ skipped.push({ filePath: full, reason: read.reason, detail: read.detail });
790
+ continue;
791
+ }
792
+ const report = readPersistedReport(full, read.mtimeMs, read.raw);
793
+ if (report !== null)
794
+ reports.push(report);
795
+ }
796
+ reports.sort((a, b) => b.createdAtMs - a.createdAtMs);
797
+ return { reports, skipped };
798
+ }
799
+ /**
800
+ * {@link listPersistedReportsBoundedWithSkips} without the skipped entries,
801
+ * for the callers that treat a skipped entry as no evidence
802
+ * ({@link checkPersistedReport}, {@link expirePersistedReport}). Expiry acts
803
+ * on the newest report that was within the cap, so an oversized newest
804
+ * approved report is left as it is and the next in-cap one is expired.
805
+ */
806
+ export function listPersistedReportsBounded(dir) {
807
+ return listPersistedReportsBoundedWithSkips(dir).reports;
808
+ }
393
809
  //# sourceMappingURL=persisted-reports.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAqB/D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,EAAE;YACF,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AA8BjE,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAmB;IACjF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,OAAgB;IAEhB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,GAAG,YAAY,EAAE;YACjB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2E;IAE3E,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAClD,CAAC,CAAC,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,4BAA4B,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUnD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACxD,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,OAAO,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,qEAAqE;QACrE,2DAA2D;QAC3D,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC5E,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;IACzD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,oBAAoB,uBAAuB,mCAAmC;aACnG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAiC,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAsBD;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,MAA2B;IAChE,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IACtE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,OAA4B,EAC5B,WAAuC,IAAI;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,iBAAiB,KAAK,IAAI;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,wBAAwB;QAC9D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,sBAAsB,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,8DAA8D,KAAK,cAAc;YACjF,uGAAuG;KAC1G,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oCAAoC,CAAC,GAAW;IAI9D,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,OAAO,oCAAoC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC"}
@@ -113,7 +113,7 @@ export interface ApplyPostToolUseExpiryResult {
113
113
  * side effects exactly so both runtimes share one clearing
114
114
  * implementation (task a1348c89).
115
115
  */
116
- export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date): ApplyPostToolUseExpiryResult;
116
+ export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date, trigger?: string): ApplyPostToolUseExpiryResult;
117
117
  /**
118
118
  * Compose the stderr diagnostic line for a matched-and-applied PostToolUse
119
119
  * expiry. Shared by `harness pack hook post-tool-use` (Claude) and
@@ -149,7 +149,7 @@ export function matchPostToolUseBoundary(toolName, toolInput, lifecycle, bashToo
149
149
  * side effects exactly so both runtimes share one clearing
150
150
  * implementation (task a1348c89).
151
151
  */
152
- export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now) {
152
+ export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now, trigger) {
153
153
  const markerPath = approvalMarkerPathFor(generatedDir, sessionId);
154
154
  const wasMarkerPresent = fs.existsSync(markerPath);
155
155
  clearApprovalMarker(generatedDir, sessionId);
@@ -176,7 +176,7 @@ export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolN
176
176
  // 7402301d the report can no longer satisfy the gate on its own, so
177
177
  // this now exists so the audit record agrees with the cleared marker.
178
178
  // Best-effort.
179
- const reportExpiry = expirePersistedReport(reportsDir, sessionId, now);
179
+ const reportExpiry = expirePersistedReport(reportsDir, sessionId, now, trigger);
180
180
  return {
181
181
  wasMarkerPresent,
182
182
  taskMarkerCleared,
@@ -1 +1 @@
1
- {"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU;IAEV,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe;IACf,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvE,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,sBAAsB,EAAE,YAAY,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,SAA6B,EAC7B,MAAoC;IAEpC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,CAAC,CAAC,8BAA8B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9D,CAAC,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;IACxE,OAAO,MAAM,CAAC,gBAAgB;QAC5B,CAAC,CAAC,GAAG,SAAS,yCAAyC,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAC7H,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AAChI,CAAC"}
1
+ {"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU,EACV,OAAgB;IAEhB,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe;IACf,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhF,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,sBAAsB,EAAE,YAAY,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,SAA6B,EAC7B,MAAoC;IAEpC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,CAAC,CAAC,8BAA8B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9D,CAAC,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;IACxE,OAAO,MAAM,CAAC,gBAAgB;QAC5B,CAAC,CAAC,GAAG,SAAS,yCAAyC,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAC7H,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AAChI,CAAC"}