@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/runtime/ledger-writer.js

@@ -1,46 +0,0 @@
-// Shared manifest -> grounding-mcp ledger-writer wiring (task T-001,
-// record-verbs).
-//
-// `harness session-start preflight` originally inlined this lookup
-// (find the `grounding-mcp` MCP server entry in the manifest, split its
-// `command` into an argv array, resolve a per-call timeout, and close
-// over `addLedgerFact`). `harness record {review,review-subagent,
-// dogfood}` needs the exact same wiring, so it is lifted here verbatim
-// — behavior unchanged, just made reusable. `session-start/index.ts`
-// now imports this instead of defining its own copies.
-import { addLedgerFact } from "./ledger-add.js";
-export function findGroundingMcp(manifest) {
-    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
-}
-export function mcpCommandList(server) {
-    return Array.isArray(server.command)
-        ? server.command
-        : server.command.trim().split(/\s+/);
-}
-/**
- * Resolve a `LedgerWriteFn` bound to the manifest's declared
- * `grounding-mcp` server, or `{ ok: false, reason }` when no such
- * server is declared. Callers that want a verb-specific tail on the
- * reason (e.g. "; cannot record preflight tag") append it themselves —
- * this function's message stays generic so it is reusable verbatim
- * across every producer.
- */
-export function resolveManifestLedgerWriter(manifest, opts = {}) {
-    const server = findGroundingMcp(manifest);
-    if (!server) {
-        return { ok: false, reason: "grounding-mcp not declared in manifest" };
-    }
-    const command = mcpCommandList(server);
-    const env = server.env ?? undefined;
-    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
-    return {
-        ok: true,
-        write: (args) => addLedgerFact({
-            mcpCommand: command,
-            ...(env && { mcpEnv: env }),
-            timeoutMs,
-            ...args,
-        }),
-    };
-}
-//# sourceMappingURL=ledger-writer.js.map

package/dist/runtime/ledger-writer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger-writer.js","sourceRoot":"","sources":["../../src/runtime/ledger-writer.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,iBAAiB;AACjB,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,uDAAuD;AAEvD,OAAO,EAAE,aAAa,EAA4B,MAAM,iBAAiB,CAAC;AAW1E,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAkB,EAClB,OAAqC,EAAE;IAEvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,aAAa,CAAC;YACZ,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC3B,SAAS;YACT,GAAG,IAAI;SACR,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/runtime/pause-sentinel.d.ts

@@ -1,60 +0,0 @@
-export declare const SENTINEL_BASENAME = ".harness-paused";
-export interface PauseSentinel {
-    /** ISO-8601 of when `harness pause` ran. */
-    pausedAt: string;
-    /** ISO-8601 expiry, or null for `--indefinite`. */
-    expiresAt: string | null;
-    /** Operator-supplied reason, or null when none was passed. */
-    reason: string | null;
-    /** Caller identity recorded by the CLI (host/user). */
-    pausedBy: string | null;
-}
-export declare function sentinelPath(generatedDir: string): string;
-export type ReadSentinelResult = {
-    kind: "absent";
-} | {
-    kind: "active";
-    sentinel: PauseSentinel;
-} | {
-    kind: "expired";
-    sentinel: PauseSentinel;
-};
-export declare function readSentinel(generatedDir: string, now?: Date): ReadSentinelResult;
-export declare function writeSentinel(generatedDir: string, sentinel: PauseSentinel): void;
-/** Returns true when a sentinel existed and was removed. */
-export declare function deleteSentinel(generatedDir: string): boolean;
-/**
- * Format a short human-readable relative offset between `from` (the past
- * anchor for "since X ago") or `to` (the future anchor for "in X") and
- * `now`. Always rounds toward 1 so a near-boundary value never reads "0s".
- */
-export declare function formatRelative(targetIso: string, now: Date): string;
-export interface AnnouncePauseOptions {
-    /** Already-resolved generatedDir. Required: hooks resolve this themselves. */
-    generatedDir: string;
-    /** Override "now" for tests. */
-    now?: Date;
-    /** Where to write the notice line. Defaults to process.stderr. */
-    stderr?: NodeJS.WritableStream;
-    /**
-     * Hook label inserted into the notice line so an operator scanning a
-     * busy stderr can tell which hook fire emitted it. Defaults to a
-     * generic "hook" tag.
-     */
-    hookLabel?: string;
-}
-/**
- * Hook integration helper. One call from each PreToolUse / PostToolUse
- * hook covers:
- *   - active sentinel  → emit one stderr line; caller exits 0 (allow).
- *   - expired sentinel → silently delete (auto-resume); caller proceeds.
- *   - absent sentinel  → no-op; caller proceeds.
- *
- * The boolean `paused` return tells the caller whether to short-circuit.
- * Any I/O error in the sentinel read degrades to `paused: false` rather
- * than blocking: a broken state file is a debug nuisance, not a reason
- * to silently freeze the whole session.
- */
-export declare function maybeAnnouncePause(opts: AnnouncePauseOptions): {
-    paused: boolean;
-};

package/dist/runtime/pause-sentinel.js

@@ -1,156 +0,0 @@
-// harness pause/resume sentinel — temporary hook bypass for operator-only
-// recovery, debug, and incident-mode flows.
-//
-// The whole feature is one JSON file at `<generatedDir>/.harness-paused`.
-// While it exists and has not expired, every PreToolUse / PostToolUse hook
-// emits a one-line stderr notice and short-circuits to allow instead of
-// evaluating its normal gate logic. On the first hook fire AFTER expiry,
-// the sentinel is silently deleted (auto-resume) and evaluation resumes.
-//
-// Source-of-truth split:
-//   - Hook enforcement reads the sentinel file. Stat() on a known path —
-//     no per-call grounding-mcp roundtrip.
-//   - Audit trail goes to the evidence ledger via `harness pause` and
-//     `harness resume`. The ledger is queryable history; the sentinel is
-//     ephemeral state.
-//
-// Operator-only design: the `harness pause` verb refuses to run inside an
-// agent shell (where `$CLAUDE_CODE_SESSION_ID` / `$CLAUDE_SESSION_ID` /
-// `$CODEX_SESSION_ID` is set) and refuses non-TTY stdin without an explicit
-// `--i-am-the-operator` acknowledgement. These are a speed bump, not a
-// boundary: a Claude Code `! `-prefixed shell inherits the session's env
-// AND its non-TTY stdin, so it is indistinguishable from an agent-issued
-// command and trips both checks (verified live; see
-// docs/okf/pause-vs-gate-kill-switch.md). The real enforcement boundary is
-// the PreToolUse deny-policy layer (`harness pause` / `harness resume` /
-// `harness gate disable` / `harness gate enable` denied from Bash, see
-// `src/cli/init/templates.ts`) plus the operator running the verb from a
-// terminal genuinely outside the agent session. This sentinel is also
-// unsigned plain JSON (see `writeSentinel` below): any process with
-// filesystem write access under `harness.generated/` can forge it
-// regardless of what the CLI guards do.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { atomicWriteFile } from "../io/atomic-write.js";
-export const SENTINEL_BASENAME = ".harness-paused";
-export function sentinelPath(generatedDir) {
-    return path.join(generatedDir, SENTINEL_BASENAME);
-}
-export function readSentinel(generatedDir, now = new Date()) {
-    let raw;
-    try {
-        raw = fs.readFileSync(sentinelPath(generatedDir), "utf8");
-    }
-    catch {
-        return { kind: "absent" };
-    }
-    let sentinel;
-    try {
-        sentinel = normalizeSentinel(JSON.parse(raw));
-    }
-    catch {
-        // A malformed sentinel file is treated as absent: a broken state file
-        // must never escalate into a session-wide block. The `harness pause`
-        // verb only ever writes well-formed JSON, so this branch is reserved
-        // for operator-corrupted files.
-        return { kind: "absent" };
-    }
-    if (sentinel.expiresAt === null)
-        return { kind: "active", sentinel };
-    const expires = Date.parse(sentinel.expiresAt);
-    if (!Number.isFinite(expires))
-        return { kind: "active", sentinel };
-    if (expires <= now.getTime())
-        return { kind: "expired", sentinel };
-    return { kind: "active", sentinel };
-}
-function normalizeSentinel(raw) {
-    const pausedAt = typeof raw["pausedAt"] === "string" ? raw["pausedAt"] : "";
-    if (pausedAt === "")
-        throw new Error("missing pausedAt");
-    // expiresAt must be either an explicit null (indefinite) or a non-empty
-    // string. A typed-wrong value (e.g. number 42) is rejected as malformed
-    // rather than silently downgraded to indefinite — without this, a forged
-    // sentinel of `{"pausedAt":"...","expiresAt":42}` would read as a no-
-    // auto-resume pause that survives every hook fire.
-    const expiresAtRaw = raw["expiresAt"];
-    let expiresAt;
-    if (expiresAtRaw === null || expiresAtRaw === undefined) {
-        expiresAt = null;
-    }
-    else if (typeof expiresAtRaw === "string" && expiresAtRaw.length > 0) {
-        expiresAt = expiresAtRaw;
-    }
-    else {
-        throw new Error("expiresAt must be a non-empty ISO string or null");
-    }
-    const reason = typeof raw["reason"] === "string" ? raw["reason"] : null;
-    const pausedBy = typeof raw["pausedBy"] === "string" ? raw["pausedBy"] : null;
-    return { pausedAt, expiresAt, reason, pausedBy };
-}
-export function writeSentinel(generatedDir, sentinel) {
-    atomicWriteFile(sentinelPath(generatedDir), `${JSON.stringify(sentinel, null, 2)}\n`);
-}
-/** Returns true when a sentinel existed and was removed. */
-export function deleteSentinel(generatedDir) {
-    try {
-        fs.rmSync(sentinelPath(generatedDir));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Format a short human-readable relative offset between `from` (the past
- * anchor for "since X ago") or `to` (the future anchor for "in X") and
- * `now`. Always rounds toward 1 so a near-boundary value never reads "0s".
- */
-export function formatRelative(targetIso, now) {
-    const target = Date.parse(targetIso);
-    if (!Number.isFinite(target))
-        return "?";
-    const abs = Math.max(1, Math.round(Math.abs(target - now.getTime()) / 1000));
-    if (abs < 90)
-        return `${abs}s`;
-    const mins = Math.round(abs / 60);
-    if (mins < 90)
-        return `${mins}m`;
-    const hrs = Math.round(mins / 60);
-    if (hrs < 36)
-        return `${hrs}h`;
-    const days = Math.round(hrs / 24);
-    return `${days}d`;
-}
-/**
- * Hook integration helper. One call from each PreToolUse / PostToolUse
- * hook covers:
- *   - active sentinel  → emit one stderr line; caller exits 0 (allow).
- *   - expired sentinel → silently delete (auto-resume); caller proceeds.
- *   - absent sentinel  → no-op; caller proceeds.
- *
- * The boolean `paused` return tells the caller whether to short-circuit.
- * Any I/O error in the sentinel read degrades to `paused: false` rather
- * than blocking: a broken state file is a debug nuisance, not a reason
- * to silently freeze the whole session.
- */
-export function maybeAnnouncePause(opts) {
-    const now = opts.now ?? new Date();
-    const stderr = opts.stderr ?? process.stderr;
-    const hookLabel = opts.hookLabel ?? "hook";
-    const result = readSentinel(opts.generatedDir, now);
-    if (result.kind === "absent")
-        return { paused: false };
-    if (result.kind === "expired") {
-        deleteSentinel(opts.generatedDir);
-        return { paused: false };
-    }
-    const reason = result.sentinel.reason ?? "(no reason given)";
-    const since = formatRelative(result.sentinel.pausedAt, now);
-    const remaining = result.sentinel.expiresAt === null
-        ? "indefinite (no auto-resume)"
-        : `auto-resumes in ${formatRelative(result.sentinel.expiresAt, now)}`;
-    stderr.write(`harness ${hookLabel}: PAUSED since ${since} ago (reason: ${reason}); ${remaining}. Run \`harness resume\` to re-enable.\n`);
-    return { paused: true };
-}
-//# sourceMappingURL=pause-sentinel.js.map

package/dist/runtime/pause-sentinel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pause-sentinel.js","sourceRoot":"","sources":["../../src/runtime/pause-sentinel.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4CAA4C;AAC5C,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,yBAAyB;AACzB,yEAAyE;AACzE,2CAA2C;AAC3C,sEAAsE;AACtE,yEAAyE;AACzE,uBAAuB;AACvB,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,oDAAoD;AACpD,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,kEAAkE;AAClE,wCAAwC;AAExC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAanD,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;AACpD,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;IACvE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACnE,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA4B;IACrD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzD,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAAwB,CAAC;IAC7B,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,GAAG,YAAY,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,QAAuB;IACzE,eAAe,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,YAAoB;IACjD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAS;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7E,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,GAAG,CAAC;AACpB,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA0B;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,SAAS,GACb,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI;QAChC,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,mBAAmB,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1E,MAAM,CAAC,KAAK,CACV,WAAW,SAAS,kBAAkB,KAAK,iBAAiB,MAAM,MAAM,SAAS,0CAA0C,CAC5H,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/runtime/pending-approval.d.ts

@@ -1,23 +0,0 @@
-import { GENERATED_DIRNAME, resolveGeneratedDir } from "../io/generated-dir.js";
-export { GENERATED_DIRNAME, resolveGeneratedDir };
-export declare const PENDING_APPROVAL_BASENAME = ".pending-approval";
-export declare function pendingApprovalPath(generatedDir: string): string;
-/**
- * Producer: stage `sessionId` for a later `harness approve`. `atomicWriteFile`
- * creates `generatedDir` if missing, so a hand-wired hook with no prior
- * apply still benefits. Callers treat this as best-effort — a write
- * failure must never escalate a gate block into a thrown hook error.
- */
-export declare function writePendingApproval(generatedDir: string, sessionId: string): void;
-/**
- * Consumer: read the staged session id, or null when the file is absent,
- * empty, whitespace-only, or unreadable. Trims the trailing newline the
- * producer writes plus any surrounding whitespace.
- */
-export declare function readPendingApproval(generatedDir: string): string | null;
-/**
- * Consumer: drop the staging file once its id has been consumed, so a
- * later arg-less `harness approve` cannot revive a stale session id.
- * Best-effort — a missing file counts as success.
- */
-export declare function clearPendingApproval(generatedDir: string): void;

package/dist/runtime/pending-approval.js

@@ -1,67 +0,0 @@
-// Task 33abc147 — `.pending-approval` session-id staging file.
-//
-// The understanding-gate PreToolUse hook knows the running session's
-// exact `session_id` (it arrives on the hook event's stdin). `harness
-// approve`, run from the operator's `!`-shell, does NOT: $CLAUDE_SESSION_ID
-// is unset in that shell, and guessing the id from the newest project
-// transcript is a heuristic that breaks on subagent / parallel-session
-// transcripts (the approve error message warns about exactly that).
-//
-// So the producer hands the id off instead of making the consumer guess:
-// on every block / ask the gate hook writes the `session_id` to
-// `<generatedDir>/.pending-approval`, and `harness approve` reads it when
-// no `--session` flag and no `$CLAUDE_SESSION_ID` are given. Deterministic,
-// not a guess.
-//
-// `harness apply` only writes its own known files into harness.generated/
-// (it never wipes the directory), so the staging file survives applies.
-// `harness approve` deletes it after a successful resolve so a later
-// arg-less invocation cannot revive a stale session id.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { atomicWriteFile } from "../io/atomic-write.js";
-import { GENERATED_DIRNAME, resolveGeneratedDir } from "../io/generated-dir.js";
-export { GENERATED_DIRNAME, resolveGeneratedDir };
-export const PENDING_APPROVAL_BASENAME = ".pending-approval";
-export function pendingApprovalPath(generatedDir) {
-    return path.join(generatedDir, PENDING_APPROVAL_BASENAME);
-}
-/**
- * Producer: stage `sessionId` for a later `harness approve`. `atomicWriteFile`
- * creates `generatedDir` if missing, so a hand-wired hook with no prior
- * apply still benefits. Callers treat this as best-effort — a write
- * failure must never escalate a gate block into a thrown hook error.
- */
-export function writePendingApproval(generatedDir, sessionId) {
-    atomicWriteFile(pendingApprovalPath(generatedDir), `${sessionId}\n`);
-}
-/**
- * Consumer: read the staged session id, or null when the file is absent,
- * empty, whitespace-only, or unreadable. Trims the trailing newline the
- * producer writes plus any surrounding whitespace.
- */
-export function readPendingApproval(generatedDir) {
-    let raw;
-    try {
-        raw = fs.readFileSync(pendingApprovalPath(generatedDir), "utf8");
-    }
-    catch {
-        return null;
-    }
-    const trimmed = raw.trim();
-    return trimmed.length > 0 ? trimmed : null;
-}
-/**
- * Consumer: drop the staging file once its id has been consumed, so a
- * later arg-less `harness approve` cannot revive a stale session id.
- * Best-effort — a missing file counts as success.
- */
-export function clearPendingApproval(generatedDir) {
-    try {
-        fs.rmSync(pendingApprovalPath(generatedDir));
-    }
-    catch {
-        /* already gone (or never written) — nothing to clean up */
-    }
-}
-//# sourceMappingURL=pending-approval.js.map

package/dist/runtime/pending-approval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pending-approval.js","sourceRoot":"","sources":["../../src/runtime/pending-approval.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,gEAAgE;AAChE,0EAA0E;AAC1E,4EAA4E;AAC5E,eAAe;AACf,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,wDAAwD;AAExD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,SAAiB;IAC1E,eAAe,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC"}

package/dist/runtime/read-only-bash.d.ts

@@ -1,141 +0,0 @@
-/**
- * Command-runner binaries: their argv is itself a nested command to
- * execute, so the "each accepts arguments without changing
- * classification" rule does NOT hold for them. `command rm -rf /tmp/x`
- * runs `rm`, and `env FOO=bar rm -rf /tmp/x` runs `rm` too. Including
- * them in `SIMPLE_READ_ONLY_BINS` would classify the WRAPPER as
- * read-only while the wrapped command does the write, a hard gate
- * bypass. Each runner gets a `find`-style special case below that
- * strips the runner's own leading flags/assignments and recurse-
- * classifies the residual underlying command. Bare `env` /
- * `command` (no underlying command) stay read-only: they only print
- * the environment or resolve a name.
- *
- * `env` leading flags that take no command and do not change the fact
- * that what follows is still a command to run. `-i` / `--ignore-
- * environment` and `-u NAME` / `--unset=NAME` scrub the environment
- * but still execute the residual command; `-` is the historical
- * synonym for `-i`. `--` ends option parsing. We skip these (and any
- * `NAME=VALUE` assignment tokens) to find the real underlying command.
- *
- * Exported (F6 fix, review round 2026-07-27, run
- * 2026-07-27-gate-target-repo-resolution): `command-normalize.ts`'s
- * `peelEnv` used to hand-roll its own copy of this exact enumeration
- * ("that module's constants are private" — no longer true), and the two
- * copies had already drifted (see that module's header for the confirmed
- * divergence). Exporting the NAME sets here — not the parsing logic
- * itself — lets both callers share one source of truth for "which `env`
- * flags exist" while each keeps its own decision about what a match
- * means (this file only needs to skip past them; `command-normalize.ts`
- * additionally needs the VALUE of `-C`/`--chdir` to extract a target
- * directory, which stays local to that module). No behaviour change here.
- */
-export declare const ENV_LEADING_FLAGS: ReadonlySet<string>;
-/** `env` flags that consume the following token as their value. */
-export declare const ENV_VALUE_FLAGS: ReadonlySet<string>;
-/**
- * `env -S` / `--split-string` re-parses its single string argument
- * into a fresh argv, which defeats our whitespace tokenization: the
- * write would live inside one quoted token. Any appearance of the
- * split-string flag (bare, glued, or long-form) forfeits the
- * read-only classification. Fail closed.
- */
-export declare const ENV_SPLIT_STRING_FLAGS: RegExp;
-/**
- * Classify a Bash command string. `true` means the command is
- * provably read-only and the understanding-gate can allow it without
- * an approved report. `false` means the command is either a write or
- * unclassifiable; the gate must block (fail-closed).
- *
- * The classifier inspects the command as a raw shell string. It does
- * NOT shell-parse or evaluate the command — that would introduce its
- * own attack surface. Instead it rejects any string that contains
- * shell metacharacters that could hide a write, then looks at the
- * first one or two tokens.
- */
-export declare function isReadOnlyBashCommand(command: string): boolean;
-/**
- * Classify a Bash command that MAY be a `|` pipeline. `true` means every
- * stage is provably read-only, so the whole pipeline reads without
- * writing and the understanding-gate can allow it without an approved
- * report. This is the pipeline-aware companion to `isReadOnlyBashCommand`,
- * used ONLY by the understanding-gate PreToolUse hooks so a post-task
- * read-only poll like `gh pr checks 123 | head` is not blocked.
- *
- * Safety: a pipe between provably read-only stages authorizes no writes —
- * writing requires a write-bin (not on the conservative allowlist), a
- * redirection, or a command substitution, all of which are still refused
- * before the split. Everything except a single `|` is rejected up front:
- * `;`, `&` (and thus `&&`, `|&`, background `&`), `<`, `>`, backtick, and
- * `$(`. `||` (logical OR) and a leading/trailing/doubled pipe surface as
- * an empty stage and are refused. Each stage is then handed to the strict
- * `isReadOnlyBashCommand`, so the per-bin write-flag guards (`find`,
- * `sort`, `tree`, `file`) and the `command`/`env` runner recursion all
- * still apply per stage.
- */
-export declare function isReadOnlyBashPipeline(command: string): boolean;
-/**
- * Kubectl read-only floor for the Risk Classifier ONLY — see the module
- * doc above this constant block for scope and the blast-radius
- * decision. `true` means every token after `kubectl` is argv-shaped as
- * a plain word, a curated read verb was invoked, every flag is drawn
- * from that verb's (or the global) allowlist, and — for `get`/
- * `describe` — no token mentions a Secret or ConfigMap resource, with
- * no shell chaining, redirection, or substitution anywhere in the
- * command.
- */
-export declare function isReadOnlyKubectlCommand(command: string): boolean;
-/**
- * `sed` read-only floor for the Risk Classifier ONLY.
- *
- * CORRECTS A FALSE PREMISE this task shipped in round 1 ("without `-i`,
- * sed only writes to stdout"). It does not: sed's `w FILE` command and the
- * `s///w FILE` substitution flag write an operator-named file with no
- * `-i`, no redirection and no shell metacharacter, and `-f SCRIPTFILE`
- * executes a script this classifier never reads. GNU sed's `e` command and
- * `s///e` flag additionally execute a shell command. All four are refused
- * here.
- *
- * `true` requires ALL of: the head is exactly `sed`; no token carries a
- * live shell expansion; every flag is drawn from the read-only allowlist
- * above (so `-i` in every spelling: `-i`, `-i.bak`, `-ni`,
- * `--in-place`, `--in-place=SUFFIX`, and `-f`/`--file` forfeit by never
- * being ON it, not by being enumerated as write flags); and every script
- * (each `-e`/`--expression` value, or the first positional operand when no
- * `-e` was given) parses as a read-only sed program under
- * `sedScriptIsReadOnly`.
- */
-export declare function isReadOnlySedCommand(command: string): boolean;
-/**
- * curl read-only SHAPE floor for the Risk Classifier ONLY (task fdaad781,
- * decision D-026, round 2 hardening). Composes exactly like the sed and
- * kubectl floors above: it never sinks below an operator classifier,
- * and only the DESTRUCTIVE floor (evaluated first in
- * `risk-classifier.ts`) can raise above it. This comment states only
- * the grammar; see docs/risk-gate.md's "curl read-only SHAPE floor"
- * section for the full history (D-013's two leaked flag lists), the
- * round-2 changes (mandatory `-q`, dropped `-L`/`-k`, the `\r`/query-
- * string fixes), the residuals, and the operator escape hatch.
- *
- * `true` requires ALL of: no shell chaining, redirection, substitution,
- * or background `&` anywhere in the whole command (the same whole-string
- * guard every other floor in this file uses); the head word is exactly
- * `curl` (unquoted, not composite -- no path prefix, no `env`/`command`/
- * `sudo`/other wrapper, those are other heads and forfeit here); the
- * SECOND word is exactly `-q` or `--disable` (unquoted, not composite,
- * not inside a cluster, not merely present later -- curl only honors it
- * as the first argument, and skipping it leaves `$CURL_HOME/.curlrc` /
- * `$XDG_CONFIG_HOME/curlrc` / `~/.curlrc` free to set `output`,
- * `request`, `data`, or `upload-file` underneath every other spelling
- * this shape would otherwise accept -- see docs/risk-gate.md's curl
- * section for the measurement); every remaining word is either a flag
- * drawn from the closed allowlists above (no flag on this list names a
- * file, and the only method any of them selects is HEAD, which is
- * read-only; curl's config surface is closed off by the mandatory
- * `-q`; a value-taking flag consumed only in its separate-token form,
- * and never repeated) or the SINGLE operand, which must be a single-quoted,
- * unbroken word matching `CURL_SHAPE_URL_RE`. Any composite word, any
- * unknown flag, any `=`-glued flag, any second operand, or a missing
- * operand forfeits the whole command.
- */
-export declare function isReadOnlyCurlCommand(command: string): boolean;