@lannguyensi/harness 0.61.0 → 0.63.0

package/dist/io/atomic-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/io/atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAY,aAAa,EAAE,MAAM,MAAM,CAAC;AAM/C,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,MAAsC;IAEtC,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC;IACZ,iFAAiF;IACjF,sEAAsE;IACtE,4EAA4E;IAC5E,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/io/atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAY,aAAa,EAAE,MAAM,MAAM,CAAC;AAM/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,EAAE,CAAC,SAAS,CAAC,QAAQ;IACrB,EAAE,CAAC,SAAS,CAAC,OAAO;IACpB,EAAE,CAAC,SAAS,CAAC,MAAM;IACnB,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AAEjC,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB;IAC9B,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,OAAe,EACf,UAA8B,EAAE,EAChC,SAAuB,gBAAgB;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,MAAsC;IAEtC,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC;IACZ,iFAAiF;IACjF,sEAAsE;IACtE,4EAA4E;IAC5E,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/io/display-path.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `value` as one double-quoted, single-line literal that is safe to print:
+ * `JSON.stringify` escapes `"`, `\`, every C0 control character (ESC as
+ * `\u001b`, CR as `\r`, LF as `\n`) and lone surrogates, and DEL and the C1
+ * range, which JSON leaves raw (U+009B is a one-byte CSI on terminals that
+ * honour C1), are escaped here as `\uXXXX`. Unicode format characters
+ * (including bidi overrides) and line/paragraph separators are escaped too.
+ * Supplementary characters use two UTF-16 `\uXXXX` escapes so the result
+ * stays a JSON literal that parses back to the original string.
+ */
+export declare function escapeForDisplay(value: string): string;

package/dist/io/display-path.js

@@ -0,0 +1,29 @@
+// Safe rendering of a path (or any other agent-chosen string) into text an
+// operator reads on a terminal.
+//
+// A file name in a directory the gated agent can write is attacker-chosen:
+// POSIX permits every byte but `/` and NUL in it, so it can carry an ESC
+// (an OSC 52 clipboard write, a screen clear), a CR (overwrite the line it
+// lands on) or a newline (forge an extra diagnostic-looking line). A path
+// that reaches stderr therefore goes through this one helper; it ESCAPES
+// rather than strips, so the operator can still see which name is meant and
+// can copy its escaped form into a recovery command.
+//
+// Lives in `src/io/` for the same reason `project-name.ts` does: it is a
+// leaf utility any layer may use (`io/` may not import from `runtime/`).
+/** Controls JSON leaves raw, Unicode format characters and line separators. */
+const UNSAFE_DISPLAY_CHARACTERS = /[\u007f-\u009f\p{Cf}\u2028\u2029]/gu;
+/**
+ * `value` as one double-quoted, single-line literal that is safe to print:
+ * `JSON.stringify` escapes `"`, `\`, every C0 control character (ESC as
+ * `\u001b`, CR as `\r`, LF as `\n`) and lone surrogates, and DEL and the C1
+ * range, which JSON leaves raw (U+009B is a one-byte CSI on terminals that
+ * honour C1), are escaped here as `\uXXXX`. Unicode format characters
+ * (including bidi overrides) and line/paragraph separators are escaped too.
+ * Supplementary characters use two UTF-16 `\uXXXX` escapes so the result
+ * stays a JSON literal that parses back to the original string.
+ */
+export function escapeForDisplay(value) {
+    return JSON.stringify(value).replace(UNSAFE_DISPLAY_CHARACTERS, (ch) => ch.split("").map((unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`).join(""));
+}
+//# sourceMappingURL=display-path.js.map

package/dist/io/display-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-path.js","sourceRoot":"","sources":["../../src/io/display-path.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AAEzE,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAClC,yBAAyB,EACzB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACtG,CAAC;AACJ,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/index.d.ts

@@ -6,7 +6,7 @@ export interface ApprovalCheckResult {
 }
 export { APPROVED_LEDGER_TAG_PREFIX, approvedLedgerTagFor, isPolicyDecisionRow, matchLedgerEntries, } from "./ledger.js";
 export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, type ApprovalMarker, writeApprovalMarker, type MarkerCheck, type CheckApprovalMarkerOptions, checkApprovalMarker, clearApprovalMarker, } from "./markers.js";
-export { type PersistedReport, REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, type SkippedReportEntry, listPersistedReportsBoundedWithSkips, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, type FindReportOptions, type FindReportSelection, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, type PersistedReportEvidence, expirePersistedReport, checkPersistedReport, canonicalReportHash, canonicalReportHashOfFile, MAX_HASHED_REPORT_BYTES, type ReportFileReadFailure, type BoundedReportRead, readReportFileBounded, type UnhashableReportReason, type ReportFileHash, hashReportFile, type ApprovalMarkerKind, type MarkerReportBinding, type ApprovedReportHashVerification, verifyApprovedReportHash, } from "./persisted-reports.js";
+export { type PersistedReport, REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, type SkippedReportEntry, listPersistedReportsBoundedWithSkips, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, type FindReportOptions, type FindReportSelection, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, type PersistedReportEvidence, expirePersistedReport, checkPersistedReport, canonicalReportHash, canonicalReportHashOfFile, MAX_HASHED_REPORT_BYTES, MAX_HOOK_LISTING_ENTRIES, type BoundedDirNames, listDirNamesBounded, type ReportFileReadFailure, type BoundedReportRead, type ReadBudget, readReportFileBounded, type UnhashableReportReason, type ReportFileHash, hashReportFile, type ApprovalMarkerKind, type MarkerReportBinding, type ApprovedReportHashVerification, verifyApprovedReportHash, } from "./persisted-reports.js";
 export { type ApprovalLifecycle, parseApprovalLifecycle } from "./lifecycle.js";
 export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, type ParsedAutoApprovedBy, parseAutoApprovedBy, autoApprovedLedgerTagFor, type AutoApproveConfig, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, DEFAULT_REPORT_SCAN_MAX_WAIT_MS, REPORT_SCAN_MAX_WAIT_CEILING_MS, parseReportScanMaxWait, } from "./auto-approve.js";
 export { type AutoApproveDefaultConfig, defaultAutoApproveConfig, renderAutoApproveSnippet, } from "./auto-approve-default.js";

package/dist/policy-packs/builtin/understanding-before-execution/index.js

@@ -37,7 +37,7 @@
 // harness gate; `harness approve understanding` is the approval path.
 export { APPROVED_LEDGER_TAG_PREFIX, approvedLedgerTagFor, isPolicyDecisionRow, matchLedgerEntries, } from "./ledger.js";
 export { APPROVAL_MARKER_DIRNAME, approvalMarkerPathFor, writeApprovalMarker, checkApprovalMarker, clearApprovalMarker, } from "./markers.js";
-export { REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, listPersistedReportsBoundedWithSkips, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, expirePersistedReport, checkPersistedReport, canonicalReportHash, canonicalReportHashOfFile, MAX_HASHED_REPORT_BYTES, readReportFileBounded, hashReportFile, verifyApprovedReportHash, } from "./persisted-reports.js";
+export { REPORTS_DIR_ENV, defaultReportsDir, reportsDirForManifest, listPersistedReports, listPersistedReportsBoundedWithSkips, TOLERANT_FALLBACK_MAX_AGE_MS, TOLERANT_FALLBACK_FUTURE_SKEW_MS, selectReportForSession, selectNewestStrictSessionReport, findLatestReportForSession, expirePersistedReport, checkPersistedReport, canonicalReportHash, canonicalReportHashOfFile, MAX_HASHED_REPORT_BYTES, MAX_HOOK_LISTING_ENTRIES, listDirNamesBounded, readReportFileBounded, hashReportFile, verifyApprovedReportHash, } from "./persisted-reports.js";
 export { parseApprovalLifecycle } from "./lifecycle.js";
 export { AUTO_APPROVED_BY_PREFIX, CLAUDE_CODE_HARNESS, autoApprovedByFor, parseAutoApprovedBy, autoApprovedLedgerTagFor, parseAutoApprove, permissionModeAllowed, harnessAllowed, AUTO_APPROVE_HARNESS_VALUES, DEFAULT_AUTO_APPROVE_HARNESSES, DEFAULT_REPORT_SCAN_MAX_WAIT_MS, REPORT_SCAN_MAX_WAIT_CEILING_MS, parseReportScanMaxWait, } from "./auto-approve.js";
 // D-004 shipped default (task 8f637efd): the one `auto_approve` snippet

package/dist/policy-packs/builtin/understanding-before-execution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AAqBtE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EAEpB,oCAAoC,EACpC,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EAGvB,qBAAqB,EAGrB,cAAc,EAId,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAEjB,mBAAmB,EACnB,wBAAwB,EAExB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,iFAAiF;AACjF,iEAAiE;AACjE,8DAA8D;AAC9D,0DAA0D;AAC1D,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,qEAAqE;AACrE,sDAAsD;AACtD,mDAAmD;AACnD,OAAO,EACL,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,EAC/B,kBAAkB,GAGnB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAG9B,0BAA0B,EAE1B,4BAA4B,EAE5B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EAEjB,yBAAyB,EAGzB,yBAAyB,EAGzB,qBAAqB,EAIrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,gEAAgE;AAChE,uEAAuE;AACvE,qEAAqE;AACrE,wDAAwD;AACxD,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EAIrB,mBAAmB,EAGnB,oBAAoB,EACpB,mBAAmB,EAEnB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,4EAA4E;AAC5E,8DAA8D;AAC9D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AAqBtE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAErB,mBAAmB,EAGnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EAEpB,oCAAoC,EACpC,4BAA4B,EAC5B,gCAAgC,EAGhC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAE1B,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EAExB,mBAAmB,EAInB,qBAAqB,EAGrB,cAAc,EAId,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAA0B,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EAEjB,mBAAmB,EACnB,wBAAwB,EAExB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,iFAAiF;AACjF,iEAAiE;AACjE,8DAA8D;AAC9D,0DAA0D;AAC1D,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,qEAAqE;AACrE,sDAAsD;AACtD,mDAAmD;AACnD,OAAO,EACL,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,EAC/B,kBAAkB,GAGnB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAG9B,0BAA0B,EAE1B,4BAA4B,EAE5B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,yCAAyC,EAEzC,wBAAwB,EAExB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EAEjB,yBAAyB,EAGzB,yBAAyB,EAGzB,qBAAqB,EAIrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,gEAAgE;AAChE,uEAAuE;AACvE,qEAAqE;AACrE,wDAAwD;AACxD,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EAIrB,mBAAmB,EAGnB,oBAAoB,EACpB,mBAAmB,EAEnB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,4EAA4E;AAC5E,8DAA8D;AAC9D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.d.ts

@@ -55,16 +55,16 @@ export declare function defaultReportsDir(cwd?: string): string;
 export declare function reportsDirForManifest(manifestPath: string): string;
 /**
  * List persisted reports under `dir`, newest-first by creation time
- * (JSON `createdAt`, falling back to the filename ISO prefix, falling
- * back to mtime). Missing directory returns []. Any I/O error on a
- * single file is silently skipped; the caller falls through to the
- * ledger result.
+ * (JSON `createdAt`, then the filename ISO prefix, then mtime). Missing
+ * directory returns []; an I/O error on a single file skips it. Reads each
+ * regular file IN FULL, so it must not list the agent-writable reports
+ * directory (use {@link listPersistedReportsBoundedWithSkips}); no `src`
+ * caller remains, it stays for its tests and the pack's export surface.
  *
  * Creation time, NOT mtime, is the sort key: `harness approve
  * understanding` rewrites the report it flips, which bumps mtime and
  * made an old just-approved report sort as the freshest
- * (harness-discovery C1). mtime survives only as the last-resort
- * fallback for files that carry neither timestamp.
+ * (harness-discovery C1). mtime is the last-resort fallback.
  */
 export declare function listPersistedReports(dir: string): PersistedReport[];
 /**
@@ -276,6 +276,86 @@ export declare function describeBoundaryExpiry(report: Pick<PersistedReport, "ap
  * producers refuse to approve such a report.
  */
 export declare const MAX_HASHED_REPORT_BYTES: number;
+/**
+ * Budget the gate-read hash scan spends before it gives up (32 MiB), charged
+ * per `*.json` entry as the larger of the bytes read and
+ * {@link MIN_SCAN_ENTRY_COST_BYTES}. The per-file cap bounds one file, not
+ * their number: 160 planted 1 MiB key-heavy files took 15.9 to 17.6 s of scan
+ * time, past the 15 s PreToolUse budget, and a hook past its budget is a
+ * non-blocking error for the runtime (an allow). Charging bytes alone left the
+ * entry count open: entries that cost no bytes (tiny files, directories named
+ * `*.json`, files over the cap, unreadable ones) still cost an open each, and
+ * 400k tiny files took about 22 s of CPU. A scan that spent the budget without
+ * finding every wanted hash stops and the check fails closed with the mismatch
+ * reason. With the floor the scan opens at most 8192 entries and reads about
+ * 32 MiB (the last file read may add up to the 1 MiB per-file cap), whichever
+ * the entries are. Real reports are a few kilobytes, so the budget covers
+ * thousands of them. The scan reads the newest file first, which is where the
+ * approved report usually is.
+ *
+ * The other full-directory reads on the PreToolUse path spend the same
+ * budget with the same floor, each its own (a fresh {@link ReadBudget} per
+ * listing, not one shared across the hook call): the evidence read, the
+ * auto-approval precondition listing, the subagent-delegation lookup and the
+ * parse-error log lookup each read at most about 32 MiB, and none opens an
+ * entry once the directory holds more than {@link MAX_HOOK_LISTING_ENTRIES}.
+ */
+export declare const MAX_HASH_SCAN_BYTES: number;
+/**
+ * Least a `*.json` entry is charged against {@link MAX_HASH_SCAN_BYTES}
+ * whatever the read returned (4 KiB, about one real report), so entries that
+ * read nothing or little still spend the budget at a rate that bounds their
+ * count: 32 MiB / 4 KiB = 8192 entries.
+ */
+export declare const MIN_SCAN_ENTRY_COST_BYTES = 4096;
+/**
+ * Most entries (8192, the hash scan's budget divided by its per-entry floor)
+ * a PreToolUse-path reader accepts in one agent-writable directory. The hash
+ * scan stops at its budget, but four more readers on the same hook path used
+ * to open every entry (the evidence read, the auto-approval precondition
+ * listing, the subagent-delegation lookup, the parse-error log lookup), so a
+ * directory of hundreds of thousands of planted entries took the hook past the
+ * 15 s PreToolUse budget, which the runtime treats as an allow (measured at
+ * 400k planted entries: 408195 opens and 28.9 s of CPU in the Claude Code
+ * hook). The count alone left each entry readable up to the 1 MiB per-file
+ * cap, so every one of those readers also charges the entries it reads against
+ * {@link MAX_HASH_SCAN_BYTES} (see {@link ReadBudget}).
+ *
+ * A reader does not take a newest window of such a directory: a partial view
+ * would let a hidden newer entry change a selection (an auto-approval would
+ * adopt an older pending report while a newer, hidden one is already
+ * approved). Past either bound (more entries, or more report data than the
+ * byte budget) it returns nothing and reports the directory as too large to
+ * read, and each reader treats that as no evidence: the evidence read
+ * reports no report, the auto-approval path declines, the delegation lookup
+ * captures nothing and the parse-error lookup finds nothing. None of them
+ * allows. The directory listing stops as soon as the bound is crossed. See
+ * {@link listDirNamesBounded}.
+ */
+export declare const MAX_HOOK_LISTING_ENTRIES: number;
+/** Result of {@link listDirNamesBounded}. */
+export interface BoundedDirNames {
+    /** Entry names that end with the suffix, in ascending byte order; empty when `truncated`. */
+    names: string[];
+    /** True when the directory holds more matching entries than `maxEntries`, or more entries in all than `maxScanned`. */
+    truncated: boolean;
+}
+/**
+ * Names under `dir` ending in `suffix`, or none and `truncated: true` when
+ * there are more than `maxEntries` of them. The one listing the bounded
+ * PreToolUse-path readers share, so the bound lives in one place; a missing or
+ * unreadable directory lists nothing and is not `truncated`.
+ *
+ * The listing reads the directory one entry at a time and stops as soon as
+ * `maxEntries + 1` matching names have been seen, or `maxScanned` entries of
+ * any name (default: {@link HOOK_LISTING_SCAN_FACTOR} times `maxEntries`),
+ * so millions of planted names, matching or not, cost a bounded number of
+ * directory reads and no allocation of their names. The directory handle is
+ * always closed. An unbounded `maxEntries` reads the whole directory. The
+ * names come back in ascending byte order (the `fs.readdirSync` order), not
+ * in the filesystem's iteration order.
+ */
+export declare function listDirNamesBounded(dir: string, suffix: string, maxEntries: number, maxScanned?: number): BoundedDirNames;
 /** Result of {@link walkContainerDepth}. */
 export interface ContainerDepthWalk {
     /** True when some array/object nests deeper than the walk's `max` levels. */
@@ -313,7 +393,15 @@ export declare function walkContainerDepth(value: unknown, max: number): Contain
  */
 export declare function canonicalReportHash(report: Record<string, unknown>): string | null;
 /** Why {@link readReportFileBounded} returned no content. */
-export type ReportFileReadFailure = "unreadable" | "not-regular" | "too-large" | "grew";
+export type ReportFileReadFailure = "unreadable" | "not-regular" | "too-large" | "grew" | "over-budget";
+/**
+ * Bytes a bounded multi-entry reader has spent against
+ * {@link MAX_HASH_SCAN_BYTES}; pass one object to every
+ * {@link readReportFileBounded} call of the same listing.
+ */
+export interface ReadBudget {
+    spent: number;
+}
 export type BoundedReportRead = {
     ok: true;
     raw: string;
@@ -337,8 +425,22 @@ export type BoundedReportRead = {
  * (never more than the cap plus one byte); a file that grows into that byte
  * while being read is refused too. The descriptor is always closed. Never
  * throws.
+ *
+ * `opts.noFollow` adds `O_NOFOLLOW` to the open: a path that is a symbolic
+ * link (whatever it points at, a dangling link included) is refused as
+ * not-regular by the open itself (`ELOOP`), with no earlier `lstat` for a
+ * swap to race. Off by default, so every hook read keeps following links
+ * exactly as before; `harness approve understanding` turns it on.
+ *
+ * `opts.budget` charges the read against {@link MAX_HASH_SCAN_BYTES} the way
+ * the hash scan does (the larger of the `fstat` size and
+ * {@link MIN_SCAN_ENTRY_COST_BYTES} per entry, taken before the read); once
+ * the budget is spent the call opens nothing and returns `over-budget`.
  */
-export declare function readReportFileBounded(filePath: string): BoundedReportRead;
+export declare function readReportFileBounded(filePath: string, opts?: {
+    noFollow?: boolean;
+    budget?: ReadBudget;
+}): BoundedReportRead;
 /** Why a report file has no canonical hash. */
 export type UnhashableReportReason = ReportFileReadFailure | "not-json-object" | "too-deep";
 export type ReportFileHash = {
@@ -357,9 +459,13 @@ export type ReportFileHash = {
  * any of these (the `detail` is its message); the gate-read scan counts such
  * a file as one that matches nothing. Never throws.
  */
-export declare function hashReportFile(filePath: string): ReportFileHash;
+export declare function hashReportFile(filePath: string, opts?: {
+    noFollow?: boolean;
+}): ReportFileHash;
 /** Canonical hash of the report file at `filePath` ({@link hashReportFile}); null when it has none. */
-export declare function canonicalReportHashOfFile(filePath: string): string | null;
+export declare function canonicalReportHashOfFile(filePath: string, opts?: {
+    noFollow?: boolean;
+}): string | null;
 /** Marker kind whose signed report hash the gate checks. */
 export type ApprovalMarkerKind = "task" | "session";
 /** One matched marker's signed `reportContentHash`, tagged with its kind. */
@@ -412,11 +518,26 @@ export type ApprovedReportHashVerification = {
  * the "no report file" allow, the same as before this check existed. The
  * marker and the operator's approval itself are untouched in both cases;
  * only the audit trail loses its claim to be the approved content. (3) The
- * cap bounds each file, not their number: the scan time grows with the
- * total volume of report files, so an agent that plants hundreds of
- * megabytes of files just under the cap can still push one scan past the
- * hook's time budget, which the runtime treats as a non-blocking error (the
- * same allow as before this check existed).
+ * cap bounds each file, not their number, so the scan charges every `*.json`
+ * entry at least `MIN_SCAN_ENTRY_COST_BYTES` against `MAX_HASH_SCAN_BYTES`
+ * (bytes read or the floor, whichever is larger, whatever the read returned):
+ * past the budget the check denies with the mismatch reason (fail closed).
+ * That bounds the entries opened (8192) and the bytes read (about 32 MiB, the
+ * last file read may add up to the 1 MiB per-file cap). Three costs remain.
+ * A legitimate approval whose report sits behind that much newer report data
+ * (by name, descending) is denied; re-approving writes a new, newest report
+ * and recovers only when the newer entries are real reports: planted `*.json`
+ * names that sort after the timestamped report names (for example names
+ * starting with a letter) stay newer than any new report and keep denying
+ * until removed. The `readdir` plus name sort of the directory itself are not
+ * charged, so a directory of millions of entries still costs that listing
+ * before this scan starts (the scan runs when a signed marker is present). The
+ * hash scan is not the whole hook: the other full-directory reads on it (the
+ * evidence read, the auto-approval listing, the delegation lookup and the
+ * parse-error lookup) list the directory entry by entry and stop once
+ * {@link MAX_HOOK_LISTING_ENTRIES} entries are crossed, and charge the entries
+ * they read against the same byte budget; past either bound they open or read
+ * nothing more and fail closed.
  *
  * Removing the approved report while other report files remain is a deny:
  * nothing on disk carries the signed content any more. `harness gc --apply`
@@ -429,8 +550,8 @@ export type ApprovedReportHashVerification = {
  * fallback is consulted only when the primary fails the check, so a task
  * marker signed for another report does not hide a session marker that
  * verifies. Unchanged behaviour: a null hash on the accepted marker (no
- * report resolved, or `--force` over a report the producer could not hash:
- * too deeply nested or over the size cap) and a reports directory with no
+ * report resolved, or `--force` over a report nested too deeply to hash,
+ * never one over the size cap) and a reports directory with no
  * `*.json` entry at all both allow. A forced approval of a hashable report
  * signs its hash and is checked like any other.
  *
@@ -465,9 +586,12 @@ export interface SkippedReportEntry {
  *
  * A caller that must not let the selection fall back to an older report when
  * a newer one is unreadable (the auto-approval precondition) declines when
- * `skipped` is not empty. The operator commands (`harness approve
- * understanding`, `harness gc`) keep the unbounded {@link listPersistedReports}
- * on purpose: they must still see an oversized report to refuse or age it.
+ * `skipped` is not empty. The operator commands read through this listing as
+ * well, so a planted oversized or non-regular entry cannot crash or hang
+ * them, and they still see it: `harness approve understanding` refuses
+ * while `skipped` is not empty (it passes `refuseSymlinks`, which also
+ * refuses a symbolic link at the open, whatever it points at), and
+ * `harness gc` reports each skipped entry and leaves it in place.
  *
  * Placement: this block sits at the end of the file, and
  * {@link readPersistedReport} takes the already-read text (`boundedRaw`), so
@@ -475,9 +599,16 @@ export interface SkippedReportEntry {
  * docs/decisions/2026-08-27-ug-auto-mode-approval.md cites in this file stay
  * put (tests/decisions-citations-resolve.test.ts pins them).
  */
-export declare function listPersistedReportsBoundedWithSkips(dir: string): {
+export declare function listPersistedReportsBoundedWithSkips(dir: string, opts?: {
+    refuseSymlinks?: boolean;
+    maxEntries?: number;
+}): {
     reports: PersistedReport[];
     skipped: SkippedReportEntry[];
+    /** True when `opts.maxEntries` was set and the directory holds more `*.json` entries, or more report data than the byte budget; no report is returned. */
+    truncated: boolean;
+    /** Why the listing was `truncated`, as a clause that follows the subject ("holds more than ..."); empty otherwise. */
+    truncatedDetail: string;
 };
 /**
  * {@link listPersistedReportsBoundedWithSkips} without the skipped entries,