@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/runtime/task-providers/agent-tasks.js

@@ -1,245 +0,0 @@
-// Internal agent-tasks runtime adapter. Consumers keep their own event and
-// diagnostic handling; this module owns provider-specific semantics only.
-import { expandToolNameAliases } from "../tool-name-aliases.js";
-export const AGENT_TASKS_MCP_PREFIX = "mcp__agent-tasks__";
-export const TASK_START_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_start`;
-export const TASK_FINISH_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_finish`;
-export const TASK_ABANDON_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_abandon`;
-export const TASKS_TRANSITION_TOOL = `${AGENT_TASKS_MCP_PREFIX}tasks_transition`;
-export const TASK_MERGE_TOOL = `${AGENT_TASKS_MCP_PREFIX}task_merge`;
-export const PULL_REQUESTS_MERGE_TOOL = `${AGENT_TASKS_MCP_PREFIX}pull_requests_merge`;
-export const ACTIVE_CLAIM_TOOL_NAMES = [
-    TASK_START_TOOL,
-    TASK_FINISH_TOOL,
-    TASK_ABANDON_TOOL,
-    TASKS_TRANSITION_TOOL,
-    TASK_MERGE_TOOL,
-];
-/**
- * Default approval-marker expiry tool list. It only shapes the EMITTED
- * PostToolUse matcher when a manifest configures no explicit
- * `approval_lifecycle.expire_on_tool_match`; the runtime boundary list
- * the hook applies comes from the config alone (`parseApprovalLifecycle`
- * returns an empty list when the key is absent). `task_merge` is listed
- * because a `task_finish` that lands in `review` no longer expires the
- * approval (it keeps the work claim, task 5018c0c4); an operator's
- * explicit list, and every `harness init` scaffold, needs `task_merge`
- * too for the review-then-`task_merge` path to expire the approval.
- */
-export const DEFAULT_BOUNDARY_TOOL_NAMES = [
-    TASK_FINISH_TOOL,
-    TASK_ABANDON_TOOL,
-    PULL_REQUESTS_MERGE_TOOL,
-    TASKS_TRANSITION_TOOL,
-    TASK_MERGE_TOOL,
-];
-export const DEFAULT_PROTECTED_COMPLETION_TOOLS = [
-    "task_finish",
-    "task_submit_pr",
-    "task_merge",
-    "pull_requests_merge",
-];
-export const TASK_FINISH_AUTOMERGE_INPUT_MATCH = {
-    "toolArgs.autoMerge": true,
-};
-export const TASK_ID_EXTRACT = { TASK_ID: "toolArgs.taskId" };
-export const PR_NUMBER_EXTRACT = { PR_NUMBER: "toolArgs.prNumber" };
-function inputRecord(input) {
-    if (typeof input !== "object" || input === null || Array.isArray(input))
-        return null;
-    return input;
-}
-export function taskIdFromInput(input) {
-    const taskId = inputRecord(input)?.["taskId"];
-    return typeof taskId === "string" ? taskId : "";
-}
-export function tasksTransitionStatusFromInput(input) {
-    const status = inputRecord(input)?.["status"];
-    return typeof status === "string" ? status : "";
-}
-export function tasksTransitionReleasesClaim(input) {
-    return tasksTransitionStatusFromInput(input) === "done";
-}
-/**
- * Best-effort recursive unwrap of a task_finish tool RESULT into the
- * mcp-server receipt object it ultimately carries, tolerating every
- * transport shape observed or plausible for a PostToolUse event (task
- * c86e3c4a: an earlier version of this function read only shape (a)
- * below and was inert against the shape Claude Code actually sends):
- *
- *   (a) the receipt object itself, `{ ok, task: { id, status } }` -- both
- *       the small default receipt and the `include:["task"]` full-object
- *       variant, since both nest the task under `task` and this function
- *       only reads that key, not the rest of the shape;
- *   (b) Claude Code's REAL PostToolUse `tool_response` for an MCP tool
- *       (live capture, claude 2.1.280): a content-block array
- *       `[{ type: "text", text: "<json>" }, ...]` -- the first `text`
- *       block is located and its `text` is JSON-parsed, then unwrapped
- *       again as (a). See `tests/fixtures/track-active-claim/
- *       real-posttooluse-task-finish-2.1.280.json` for the verbatim
- *       redacted capture;
- *   (c) an MCP `CallToolResult` object, `{ content: [{ type: "text",
- *       text: "<json>" }] }` -- plausible on Codex, UNMEASURED here (no
- *       Codex capture exists in this run; see
- *       `docs/policy-packs/understanding-before-execution.md`), handled
- *       defensively the same way as (b);
- *   (d) a bare JSON string -- parsed once, then unwrapped again.
- *
- * Anything else, a `JSON.parse` failure at any step, or a nesting depth
- * past a small guard, returns `null` so the caller fails safe rather
- * than throwing or silently misreading.
- */
-function unwrapToolResponseEnvelope(toolResponse, depth = 0) {
-    if (depth > 4)
-        return null;
-    if (typeof toolResponse === "string") {
-        let parsed;
-        try {
-            parsed = JSON.parse(toolResponse);
-        }
-        catch {
-            return null;
-        }
-        return unwrapToolResponseEnvelope(parsed, depth + 1);
-    }
-    if (Array.isArray(toolResponse)) {
-        const textBlock = toolResponse.find((block) => {
-            const rec = inputRecord(block);
-            return rec !== null && rec["type"] === "text" && typeof rec["text"] === "string";
-        });
-        const text = inputRecord(textBlock)?.["text"];
-        return typeof text === "string" ? unwrapToolResponseEnvelope(text, depth + 1) : null;
-    }
-    const record = inputRecord(toolResponse);
-    if (record === null)
-        return null;
-    if (Array.isArray(record["content"])) {
-        return unwrapToolResponseEnvelope(record["content"], depth + 1);
-    }
-    return record;
-}
-/**
- * Read the resulting status off a task_finish tool RESULT (not the
- * request), unwrapping whichever transport shape it arrived in (see
- * `unwrapToolResponseEnvelope`). Returns `null` when the result is
- * absent, malformed, or carries no string status, so a caller can tell
- * "the task landed on a known non-review status" apart from "we could
- * not tell" (task c86e3c4a).
- */
-export function taskFinishResultingStatus(toolResponse) {
-    const task = unwrapToolResponseEnvelope(toolResponse)?.["task"];
-    const status = inputRecord(task)?.["status"];
-    return typeof status === "string" && status.length > 0 ? status : null;
-}
-/**
- * Read the acted-on task id off a task_finish (or any agent-tasks) tool
- * RESULT, unwrapping the same shapes as `taskFinishResultingStatus`.
- * Used as a fallback when the tool_input did not carry a `taskId` (task
- * c86e3c4a, id-equality guard on release verbs), and by the stay-in-scope
- * hook to read the created task id off a create verb's result, which never
- * carries a `taskId` input (task b5e65f5e).
- */
-export function taskIdFromToolResponse(toolResponse) {
-    const task = unwrapToolResponseEnvelope(toolResponse)?.["task"];
-    const id = inputRecord(task)?.["id"];
-    return typeof id === "string" ? id : "";
-}
-/**
- * Diagnostic-only companion to `claimEffectForAgentTasksTool`: was a
- * task_finish's resulting status actually readable? This does NOT feed
- * back into the release/keep decision (that stays the classifier's
- * alone) -- it lets `hook-track-active-claim.ts` label its stderr line
- * so a silent fail-safe fallback release does not look identical to an
- * intentional `done` release in the operator's own trail (task
- * c86e3c4a).
- */
-export function taskFinishReleaseIsUnreadable(toolResponse) {
-    return taskFinishResultingStatus(toolResponse) === null;
-}
-/**
- * Coarse shape label for a tool_response, for the same stderr diagnostic
- * above -- never used to decide anything, only to name what shape a
- * fail-safe release fell back from.
- */
-export function describeToolResponseShape(toolResponse) {
-    if (toolResponse === undefined || toolResponse === null)
-        return "absent";
-    if (Array.isArray(toolResponse))
-        return "array";
-    if (typeof toolResponse === "string")
-        return "string";
-    return "object";
-}
-export function agentTasksToolName(verb) {
-    return `${AGENT_TASKS_MCP_PREFIX}${verb}`;
-}
-/** Alias-aware for runtime events, including mcp__server.verb variants. */
-export function matchesAgentTasksRuntimeVerb(toolName, verbs) {
-    const expected = new Set(verbs.map(agentTasksToolName));
-    return expandToolNameAliases(toolName).some((alias) => expected.has(alias));
-}
-/** Strict canonical parsing for Solution Acceptance's deliberately narrow gate. */
-export function canonicalAgentTasksVerb(toolName, verbs) {
-    if (!toolName.startsWith(AGENT_TASKS_MCP_PREFIX))
-        return null;
-    const verb = toolName.slice(AGENT_TASKS_MCP_PREFIX.length);
-    return verbs.includes(verb) ? verb : null;
-}
-/**
- * Claim lifecycle is separate from approval boundaries: only a completed
- * legacy transition releases a claim, while abandon and merge always do.
- *
- * task_finish is decided from the RESULT, not the verb (task c86e3c4a):
- * agent-tasks's own v2 semantics clear the work claim going to `done`
- * and keep it going to `review`, so `toolResponse` (the tool RESULT
- * envelope, optional third parameter -- the caller's PostToolUse event
- * carries this alongside `tool_input`) is read via
- * `taskFinishResultingStatus`. A resulting status of `review` returns
- * `none` (keep); `done`, any other resolvable status, and an
- * unresolvable result (no `toolResponse`, or a malformed one) all
- * return `release`.
- *
- * Fail-safe rationale (task c86e3c4a -- corrected from an earlier
- * wording of this comment that was wrong about what the marker feeds):
- * the active-claim file
- * this classifier feeds is read by the FAIL-CLOSED completion gate
- * (`src/cli/pack/hook-solution-acceptance.ts`'s `readActiveClaim` call)
- * to derive the verdict id it gates `task_finish` / `task_submit_pr` /
- * `task_merge` / `pull_requests_merge` / `git push` on. Release-on-
- * unreadable is chosen because a KEPT marker for a task that actually
- * finished would fail OPEN: until the next `task_start` overwrites it,
- * post-done completion-gated actions (git push, task_merge, PR merge)
- * would pass on that finished task's already-accepted verdict, and the
- * marker would override SOLUTION_VERDICT_ID. Releasing fails CLOSED
- * instead, at the cost of a possible wedge (the gate refuses with "no
- * active-claim task id recorded" until a fresh `task_start` or an
- * operator clears the file). It is not costless, and it is not merely
- * giving up an "ergonomic shortcut".
- *
- * This is the ONE place that decision is made: callers (e.g.
- * `hook-track-active-claim.ts`) do not re-derive it locally.
- */
-export function claimEffectForAgentTasksTool(toolName, input, toolResponse) {
-    if (matchesAgentTasksRuntimeVerb(toolName, ["task_start"]))
-        return "acquire";
-    if (matchesAgentTasksRuntimeVerb(toolName, ["task_finish"])) {
-        return taskFinishResultingStatus(toolResponse) === "review" ? "none" : "release";
-    }
-    if (matchesAgentTasksRuntimeVerb(toolName, ["task_abandon", "task_merge"])) {
-        return "release";
-    }
-    if (matchesAgentTasksRuntimeVerb(toolName, ["tasks_transition"]) &&
-        tasksTransitionReleasesClaim(input)) {
-        return "release";
-    }
-    return "none";
-}
-export function resolveProtectedCompletionTools(config) {
-    if (Array.isArray(config) &&
-        config.length > 0 &&
-        config.every((verb) => typeof verb === "string" && verb.length > 0)) {
-        return config;
-    }
-    return [...DEFAULT_PROTECTED_COMPLETION_TOOLS];
-}
-//# sourceMappingURL=agent-tasks.js.map

package/dist/runtime/task-providers/agent-tasks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-tasks.js","sourceRoot":"","sources":["../../../src/runtime/task-providers/agent-tasks.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAE1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,sBAAsB,YAAY,CAAC;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,sBAAsB,aAAa,CAAC;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,cAAc,CAAC;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,sBAAsB,kBAAkB,CAAC;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,sBAAsB,YAAY,CAAC;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,sBAAsB,qBAAqB,CAAC;AAEvF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;CACP,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,gBAAgB;IAChB,iBAAiB;IACjB,wBAAwB;IACxB,qBAAqB;IACrB,eAAe;CACP,CAAC;AAEX,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,iCAAiC,GAA4B;IACxE,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAA2B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;AAE5F,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,0BAA0B,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAqB;IAC7D,MAAM,IAAI,GAAG,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAqB;IAC1D,MAAM,IAAI,GAAG,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAqB;IACjE,OAAO,yBAAyB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAqB;IAErB,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,sBAAsB,GAAG,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,KAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,KAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,KAAc,EACd,YAAsB;IAEtB,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,yBAAyB,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IACD,IAAI,4BAA4B,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,4BAA4B,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5D,4BAA4B,CAAC,KAAK,CAAC,EACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAe;IAC7D,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,MAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,kCAAkC,CAAC,CAAC;AACjD,CAAC"}

package/dist/runtime/when-eval.d.ts

@@ -1,62 +0,0 @@
-import type { PolicyWhen } from "../schema/index.js";
-import type { DeletionTargetVerdict } from "./deletion-target-resolve.js";
-import type { EnvironmentResolution } from "./environment-resolver.js";
-import type { RiskProfile } from "./risk-classifier.js";
-/**
- * The severity NAME the unclassified fallback is treated as, for
- * surfaces that have to say it out loud (`intercept.ts`'s deny
- * envelope). Exported so no caller hard-codes "high" beside a constant
- * that is derived.
- */
-export declare const UNCLASSIFIED_FALLBACK_SEVERITY: string;
-/** The enriched-envelope inputs a `when:` block is evaluated against. */
-export interface WhenContext {
-    risk: RiskProfile;
-    environment: EnvironmentResolution;
-    /**
-     * Static deletion-target verdict for this action (task d03af8f6), or
-     * `null`/omitted when the command was not recognized as a deletion
-     * verb at all — see `deletion-target-resolve.ts`. Optional so every
-     * caller/fixture that predates this arm keeps compiling and behaving
-     * exactly as before (treated the same as `null`).
-     */
-    deletionTarget?: DeletionTargetVerdict | null;
-}
-/** The five `when:` clause keys, exactly as they appear in the manifest. */
-export type WhenClauseKey = "risk.severity_at_least" | "risk.category_in" | "environment.name" | "action.reversible" | "action.deletion_target_unresolvable";
-/** One declared clause's verdict, carried for explainability. */
-export interface WhenClauseResult {
-    clause: WhenClauseKey;
-    /** Human-readable expected value, as written in the manifest. */
-    expected: string;
-    /** Human-readable observed value, from the enriched envelope. */
-    actual: string;
-    matched: boolean;
-}
-export interface WhenEvaluation {
-    /** AND of every declared clause. A `when:` with no clauses cannot be
-     *  constructed (the schema rejects `when: {}`), so an evaluated
-     *  `when:` always has at least one clause. */
-    matched: boolean;
-    /** One entry per DECLARED clause, in manifest-key order. */
-    clauses: WhenClauseResult[];
-    /** True when at least one clause's outcome was decided by the
-     *  unclassified fallback rather than a real classification ("unknown
-     *  is not safe" for `risk.category_in` / `action.reversible`, or the
-     *  "treated as high" rung for `risk.severity_at_least`) — true
-     *  whether that fallback made the clause match or fail. Surfaced so
-     *  `explain-policy` can tell an operator a clause outcome was
-     *  fail-closed, not a real hit. */
-    unclassifiedFallback: boolean;
-}
-/**
- * Evaluate a policy's `when:` block against the enriched envelope.
- *
- * Every clause is optional; only declared clauses are evaluated, and
- * `matched` is their AND. An unclassified risk profile (`classified:
- * false`) satisfies `risk.category_in` / `action.reversible` by the
- * "unknown is not safe" rule, and satisfies `risk.severity_at_least`
- * up through `high` but never `critical` (see the module header);
- * `environment.name` is always a plain equality test.
- */
-export declare function evaluateWhen(when: PolicyWhen, ctx: WhenContext): WhenEvaluation;

package/dist/runtime/when-eval.js

@@ -1,212 +0,0 @@
-// Phase 7 #5 — `policy.when:` evaluator.
-//
-// A policy's `trigger:` decides WHICH tool calls it inspects; its
-// optional `when:` block decides whether — given the enriched Action
-// Envelope — the policy actually applies to this particular call. The
-// runtime ANDs the two: a policy fires only when `trigger:` AND every
-// declared `when:` clause hold.
-//
-// Pure: the risk profile (#3) + environment resolution (#4) come in, a
-// match verdict with a per-clause breakdown comes out, no I/O. The
-// breakdown is what `harness explain-policy` renders.
-//
-// "Unknown is not safe" — the load-bearing decision in this module.
-// The Risk Classifier emits `severity: null` / `reversible: null` /
-// `categories: []` for an action no pattern matched (`classified:
-// false`). A null does not silently fail to satisfy a clause: an
-// UNCLASSIFIED action satisfies every `risk.category_in` /
-// `action.reversible` clause, so a risk-gating policy treats "we could
-// not classify this" as risk-bearing rather than letting it slip the
-// gate. A *classified* action is compared on its real values.
-// `environment.name` needs no such rule: the resolver always returns a
-// concrete environment, with `unknown` as the matchable no-resolver-
-// fired case.
-//
-// `risk.severity_at_least` is the ONE exception to a blanket "satisfies
-// every threshold". An unknown severity is risk-bearing: it still
-// satisfies `low`/`medium`/`high`, so an approval-required gate on an
-// unrecognized production command stays fail-closed, but it is not
-// itself proof of the WORST tier: an unclassified profile is treated as
-// sitting at the "high" rung, one below `critical`, for this one clause
-// only, so it never triggers a hard, agent-unoverridable block on its
-// own. A hard block deserves a real classification.
-//
-// The rule is deliberately paired with two things this module does NOT
-// do: (1) it does not touch `risk.category_in` / `action.reversible`,
-// which keep the full "satisfies everything" fallback; (2) it leans on
-// the Risk Classifier's built-in floors (`read-only-bash.ts`'s
-// read-only floors, `destructive-shell-floor.ts`'s mutating-head floor)
-// and the manifest's `risk.classifiers[]` to make the common cases
-// explicitly `low` or explicitly `high`/`critical`. The "treated as
-// high" rung is a safety net for the genuinely unenumerable case, not a
-// replacement for classification. There is no manifest opt-in to restore
-// the blanket behavior. Rationale, the incident that motivated it, and
-// the disclosed residual gaps: docs/risk-gate.md, "Unclassified actions
-// and the fail-close rule"; the measurement is in the CHANGELOG entry
-// for agent-tasks task 2929c5b7.
-//
-// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md
-// (design phase D); the null-handling steer is the Phase 7 #3 review
-// note on agent-tasks task harness-phase-7-5.
-import { RiskSeveritySchema } from "../schema/index.js";
-// Ordered severity scale; an index is the comparison key for
-// `severity_at_least`. Sourced from the schema enum so a reordering
-// there flows through unchanged — same pattern as the Risk Classifier.
-const SEVERITY_ORDER = RiskSeveritySchema.options;
-// The rung an UNCLASSIFIED action is treated as sitting at for
-// `risk.severity_at_least` comparisons only (see the module header):
-// one below the top of `SEVERITY_ORDER` ("critical"), i.e. "high" on
-// the shipped four-value scale. Derived from the scale's length rather
-// than a literal "high" so a future scale reordering/extension still
-// lands one rung below the top without a second hand-edit.
-//
-// That derivation has a precondition the schema must keep satisfying: a
-// scale with fewer than two rungs has no "one below the top". Asserted
-// at module load rather than left implicit, because a silently negative
-// index would make EVERY threshold comparison fail and quietly disable
-// the fail-close for unclassified actions.
-if (SEVERITY_ORDER.length < 2) {
-    throw new Error(`when-eval: the severity scale must have at least two rungs for the ` +
-        `unclassified fallback to sit one below the top (got ${SEVERITY_ORDER.length})`);
-}
-const UNCLASSIFIED_FALLBACK_SEVERITY_INDEX = SEVERITY_ORDER.length - 2;
-/**
- * The severity NAME the unclassified fallback is treated as, for
- * surfaces that have to say it out loud (`intercept.ts`'s deny
- * envelope). Exported so no caller hard-codes "high" beside a constant
- * that is derived.
- */
-export const UNCLASSIFIED_FALLBACK_SEVERITY = SEVERITY_ORDER[UNCLASSIFIED_FALLBACK_SEVERITY_INDEX];
-function severityIndex(severity) {
-    return SEVERITY_ORDER.indexOf(severity);
-}
-/**
- * Evaluate a policy's `when:` block against the enriched envelope.
- *
- * Every clause is optional; only declared clauses are evaluated, and
- * `matched` is their AND. An unclassified risk profile (`classified:
- * false`) satisfies `risk.category_in` / `action.reversible` by the
- * "unknown is not safe" rule, and satisfies `risk.severity_at_least`
- * up through `high` but never `critical` (see the module header);
- * `environment.name` is always a plain equality test.
- */
-export function evaluateWhen(when, ctx) {
-    const clauses = [];
-    let unclassifiedFallback = false;
-    const unclassified = !ctx.risk.classified;
-    const sevAtLeast = when["risk.severity_at_least"];
-    if (sevAtLeast !== undefined) {
-        let matched;
-        let actual;
-        if (unclassified) {
-            // severity is null — treated as risk-bearing at the "high" rung
-            // (SEVERITY_ORDER.length - 2), not at "critical": satisfies
-            // low/medium/high thresholds, but never critical on its own. See
-            // the module header for why (task 2929c5b7).
-            matched = UNCLASSIFIED_FALLBACK_SEVERITY_INDEX >= severityIndex(sevAtLeast);
-            actual = "null (unclassified, treated as high)";
-            unclassifiedFallback = true;
-        }
-        else {
-            matched =
-                severityIndex(ctx.risk.severity) >= severityIndex(sevAtLeast);
-            actual = ctx.risk.severity;
-        }
-        clauses.push({
-            clause: "risk.severity_at_least",
-            expected: `>= ${sevAtLeast}`,
-            actual,
-            matched,
-        });
-    }
-    const categoryIn = when["risk.category_in"];
-    if (categoryIn !== undefined) {
-        let matched;
-        let actual;
-        if (unclassified) {
-            // categories is [] — treat as risk-bearing, consistent with the
-            // severity clause: an unclassified action satisfies every risk
-            // clause so a multi-clause `when:` cannot be slipped by one
-            // clause matching null while another fails an empty set.
-            matched = true;
-            actual = "[] (unclassified)";
-            unclassifiedFallback = true;
-        }
-        else {
-            matched = categoryIn.some((c) => ctx.risk.categories.includes(c));
-            actual =
-                ctx.risk.categories.length > 0
-                    ? `[${ctx.risk.categories.join(", ")}]`
-                    : "[]";
-        }
-        clauses.push({
-            clause: "risk.category_in",
-            expected: `any of [${categoryIn.join(", ")}]`,
-            actual,
-            matched,
-        });
-    }
-    const envName = when["environment.name"];
-    if (envName !== undefined) {
-        clauses.push({
-            clause: "environment.name",
-            expected: envName,
-            actual: ctx.environment.name,
-            matched: ctx.environment.name === envName,
-        });
-    }
-    const reversible = when["action.reversible"];
-    if (reversible !== undefined) {
-        let matched;
-        let actual;
-        if (unclassified) {
-            // reversible is null — reversibility unknown. "Unknown is not
-            // safe": the clause matches whichever value the policy gates on,
-            // so an unclassified action never escapes a reversibility gate.
-            matched = true;
-            actual = "null (unclassified)";
-            unclassifiedFallback = true;
-        }
-        else {
-            matched = ctx.risk.reversible === reversible;
-            actual = String(ctx.risk.reversible);
-        }
-        clauses.push({
-            clause: "action.reversible",
-            expected: String(reversible),
-            actual,
-            matched,
-        });
-    }
-    // `action.deletion_target_unresolvable` (task d03af8f6) is deliberately
-    // NOT wired through the `unclassified` fail-close path above: it reads
-    // an entirely separate signal (`ctx.deletionTarget`, from
-    // `deletion-target-resolve.ts`), not the Risk Classifier's
-    // `classified`/`severity`/`categories` triad. An action the deletion
-    // resolver does not recognize as a deletion verb (`deletionTarget ===
-    // null`) simply does not satisfy `true` here — it never falls back to
-    // matched=true the way the four clauses above do for an unclassified
-    // risk profile. This is what lets a policy gate purely on this clause,
-    // environment-independently, without becoming a blanket gate on every
-    // unrelated unclassified Bash call (see this module's header and
-    // docs/risk-gate.md).
-    const deletionUnresolvable = when["action.deletion_target_unresolvable"];
-    if (deletionUnresolvable !== undefined) {
-        const verdict = ctx.deletionTarget ?? null;
-        const actualUnresolvable = verdict?.unresolvable ?? false;
-        clauses.push({
-            clause: "action.deletion_target_unresolvable",
-            expected: String(deletionUnresolvable),
-            actual: verdict === null
-                ? "false (not a recognized deletion-verb command)"
-                : String(actualUnresolvable),
-            matched: actualUnresolvable === deletionUnresolvable,
-        });
-    }
-    return {
-        matched: clauses.every((c) => c.matched),
-        clauses,
-        unclassifiedFallback,
-    };
-}
-//# sourceMappingURL=when-eval.js.map

package/dist/runtime/when-eval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"when-eval.js","sourceRoot":"","sources":["../../src/runtime/when-eval.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,sDAAsD;AACtD,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,2DAA2D;AAC3D,uEAAuE;AACvE,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,qEAAqE;AACrE,cAAc;AACd,EAAE;AACF,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,oDAAoD;AACpD,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,+DAA+D;AAC/D,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,8CAA8C;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxD,6DAA6D;AAC7D,oEAAoE;AACpE,uEAAuE;AACvE,MAAM,cAAc,GAAsB,kBAAkB,CAAC,OAAO,CAAC;AAErE,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,2CAA2C;AAC3C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC9B,MAAM,IAAI,KAAK,CACb,qEAAqE;QACnE,uDAAuD,cAAc,CAAC,MAAM,GAAG,CAClF,CAAC;AACJ,CAAC;AACD,MAAM,oCAAoC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,cAAc,CAAC,oCAAoC,CAAE,CAAC;AAmDxD,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,GAAgB;IAEhB,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,gEAAgE;YAChE,4DAA4D;YAC5D,iEAAiE;YACjE,6CAA6C;YAC7C,OAAO,GAAG,oCAAoC,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;YAC5E,MAAM,GAAG,sCAAsC,CAAC;YAChD,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM,UAAU,EAAE;YAC5B,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,gEAAgE;YAChE,+DAA+D;YAC/D,4DAA4D;YAC5D,yDAAyD;YACzD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,mBAAmB,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM;gBACJ,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBAC5B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACvC,CAAC,CAAC,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EAAE,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7C,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI;YAC5B,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,8DAA8D;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,qBAAqB,CAAC;YAC/B,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC;YAC7C,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAC5B,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,0DAA0D;IAC1D,2DAA2D;IAC3D,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,sBAAsB;IACtB,MAAM,oBAAoB,GAAG,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACzE,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;QAC3C,MAAM,kBAAkB,GAAG,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,qCAAqC;YAC7C,QAAQ,EAAE,MAAM,CAAC,oBAAoB,CAAC;YACtC,MAAM,EACJ,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;YAChC,OAAO,EAAE,kBAAkB,KAAK,oBAAoB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxC,OAAO;QACP,oBAAoB;KACrB,CAAC;AACJ,CAAC"}