@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/hook-branch-protection.js

@@ -1,399 +1,424 @@
-// `harness pack hook branch-protection` — PreToolUse blocker for the
-// `branch-protection` policy pack.
+// `harness pack hook branch-protection`: PreToolUse blocker for the
+// `branch-protection` policy pack (task a4d8adc5).
 //
-// Receives Claude Code's PreToolUse event JSON on stdin and emits a
-// `{ decision: "block" }` envelope when the agent is about to mutate
-// source on a protected branch without a satisfying ledger tag.
+// Receives the runtime's PreToolUse event JSON on stdin and refuses the tool
+// call when a directory it writes into belongs to a repository whose
+// checked-out branch is protected. The branch is git's own answer
+// (`git -C <dir> symbolic-ref -q HEAD`, src/runtime/git-branch.ts); this hook
+// never reads git's files itself.
 //
-// Two paths satisfy the gate:
+// Every event is judged twice, and the hook refuses when either judgment
+// refuses or cannot answer; it allows only when both allow. The as-written
+// judgment runs first.
 //
-//   1. **Producer path** — a `branch:non-protected` tag exists in the
-//      ledger from within the last 5 minutes (set by
-//      `harness session-start branch-check` when the session opened on
-//      a non-protected branch).
+//   1. As written: each path made absolute against the event cwd with `.` and
+//      `..` resolved on the text (`path.resolve`), symlinks left in the path;
+//      the presence walk runs on that text and git runs in that directory.
+//      Write, Edit, MultiEdit, NotebookEdit: the nearest existing directory
+//      holding the target path. Codex `apply_patch`: the same for every path
+//      named by an `*** Add File:`, `*** Update File:`, `*** Delete File:` or
+//      `*** Move to:` header line of the patch text in tool_input.patch,
+//      tool_input.input or a string tool_input, relative to the event cwd.
+//      Anything else, or a patch without a header there: the event cwd.
+//   2. Physical, as the operating system resolves the path (symlinks
+//      followed, `..` taken from the directory reached so far), which is the
+//      directory `git -C` changes into. Write, Edit, MultiEdit, NotebookEdit:
+//      the nearest existing directory of the target path (a Write may create
+//      the directories in between), and, when the target is a symlink, the
+//      directory it leads to as well. Codex `apply_patch`: the same for every
+//      path named by a header line found in any string of the event (any
+//      field or array of tool_input, raw_input or input, and JSON text inside
+//      a string: the field Codex carries the patch in is not pinned). A
+//      relative path resolves against the event cwd and, when the tool input
+//      names a per-call `workdir` or `cwd`, against that as well. Anything
+//      else, or a patch without a header: the event cwd (and that per-call
+//      directory).
 //
-//   2. **Override path** — an operator-only approval marker file exists
-//      at `harness.generated/.approvals/branch-protection-<sessionId>`,
-//      written by `harness approve branch-protection` from outside the
-//      gated shell to bless a deliberate protected-branch edit (version
-//      bumps, CI workflow patches, hotfixes). The legacy
-//      `branch-protection-ack:` LEDGER tag is NO LONGER trusted as an
-//      override (audit finding #39): the agent has direct
-//      `mcp__grounding-mcp__ledger_add` access and could self-write the
-//      tag to bless its own edit. The marker lives under
-//      `harness.generated/`, which Edit / Write / Bash are all gated from
-//      writing, so only a process the operator launched can produce it.
-//      The ack ledger row is still recorded for audit and surfaced in the
-//      diagnostics, but its presence alone never satisfies the gate.
+// Decision, per directory: git names a protected branch (compared
+// case-insensitively) -> refuse; git could not answer (any error, a timeout,
+// git missing, an unexpected answer) -> refuse with one fixed sentence naming
+// git's first stderr line; a detached HEAD, or no `.git` entry anywhere above
+// the directory -> allow. A manifest that does not load refuses every call.
+// Resolving the paths and every git call are bounded, together, from the
+// hook's start and below the pack's hook budget (a hook the runtime kills at
+// its budget is read as an allow): past the bound the hook refuses.
 //
-// Failure mode: any error in load / parse / ledger query resolves to
-// BLOCK. This is the inverse of understanding-before-execution's
-// fail-open contract: branch-protection's whole job is to prevent
-// edit-on-master incidents, so a bug in the blocker that silently
-// allowed Writes through would defeat the purpose. The block envelope
-// always names a recovery path so the operator is never wedged.
+// Block contract per runtime: Claude Code reads a JSON deny envelope on
+// stdout (exit 0); Codex reads exit 2 with the reason on stderr
+// (`--runtime codex`). The agent-facing text names `git checkout -b` as the
+// way forward and nothing else. A Claude Code block whose envelope cannot be
+// written (the reader has gone, or the stream is closed) fails closed too:
+// exit 2 with the reason on stderr, since exit 0 without an envelope is read
+// as an allow.
 import * as path from "node:path";
-import { queryLedgerByTag, } from "../../policies/index.js";
-import { ACK_TAG_PREFIX, DEFAULT_PROTECTED_BRANCHES, NON_PROTECTED_TAG_PREFIX, PACK_NAME, PRODUCER_FRESHNESS_MS, checkBranchProtectionMarker, resolveProtectedBranches, } from "../../policy-packs/builtin/branch-protection-runtime.js";
-import { resolveGeneratedDir } from "../../io/generated-dir.js";
-import { resolveGitContext } from "../../runtime/git-context.js";
-import { POLICY_DECISION_TYPE } from "../../io/ledger-record.js";
+import { PACK_NAME, isProtectedBranch, resolveProtectedBranches, } from "../../policy-packs/builtin/branch-protection-runtime.js";
+import { GIT_BRANCH_TIMEOUT_MS, PathBoundError, absolutePath, nearestExistingDirectory, nearestExistingDirectoryAsWritten, readBranchAt, resolveDirectory, writeTargetDirectories, } from "../../runtime/git-branch.js";
 import { renderAgentFacing } from "../../runtime/agent-facing.js";
-import { checkHookPause, loadManifestOrInjected, parseConfigUx, readStdin, runGateWithStdinRefusal, stdoutBlockRefusal, } from "./hook-bootstrap.js";
+import { boundUtf8 } from "../../runtime/bounded-text.js";
+import { STDIO_DRAIN_TIMEOUT_MS, tolerateClosedStdio } from "../drain-stdio.js";
+import { loadManifestOrInjected, parseConfigUx, pickString, readStdinChecked, } from "./hook-bootstrap.js";
 /**
- * Pull the destination file path out of a PreToolUse event's `tool_input`
- * payload for the tools that mutate a single file. Returns null for tools
- * that don't have a single resolvable target (Bash, search tools, etc.) —
- * those keep cwd-based protection.
- *
- * Path-aware tools today: Write, Edit, MultiEdit, NotebookEdit.
+ * Bound on resolving the paths and on all git calls of one event together,
+ * in ms, counted from the moment the hook starts (the stdin read and the
+ * manifest load included), so neither a slow stdin nor a large event can
+ * push the hook past its budget.
  */
-function extractTargetPath(toolName, toolInput) {
+export const GIT_READ_DEADLINE_MS = 3000;
+/** The runtimes whose block contract this hook speaks. */
+export const BRANCH_PROTECTION_RUNTIMES = ["claude-code", "codex"];
+const CODEX_EXIT_BLOCK = 2;
+/** Target path of the Claude Code tools that write a single file. */
+function singleTargetPath(toolName, toolInput) {
     if (typeof toolInput !== "object" || toolInput === null)
         return null;
     const input = toolInput;
     switch (toolName) {
         case "Write":
         case "Edit":
-        case "MultiEdit": {
-            const fp = input["file_path"];
-            return typeof fp === "string" && fp.length > 0 ? fp : null;
-        }
-        case "NotebookEdit": {
-            const np = input["notebook_path"];
-            return typeof np === "string" && np.length > 0 ? np : null;
-        }
+        case "MultiEdit":
+            return pickString(input["file_path"]) ?? null;
+        case "NotebookEdit":
+            return pickString(input["notebook_path"]) ?? null;
         default:
             return null;
     }
 }
-function findGroundingMcp(manifest) {
-    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
-}
-function evaluateEntries(entries, now) {
-    const cutoff = now.getTime() - PRODUCER_FRESHNESS_MS;
-    let hasFreshProducer = false;
-    let hasAck = false;
-    let freshProducerContent = null;
-    let ackContent = null;
-    for (const e of entries) {
-        // Skip policy_decision audit rows: their serialized payload
-        // incidentally contains the tag they're about (e.g. a denied
-        // decision the engine recorded for THIS pack would carry the
-        // literal "branch:non-protected" or "branch-protection-ack" in
-        // its JSON, falsely satisfying the gate). Two-tier filter
-        // mirrors `src/policies/requires.ts:75-83`: by-type for current
-        // ledger rows, by-content-prefix as a backstop for legacy rows
-        // a pre-Phase-5-#4 ledger may still carry.
-        if (e.type === POLICY_DECISION_TYPE)
-            continue;
-        if (e.content.startsWith(`${POLICY_DECISION_TYPE}:`))
-            continue;
-        if (e.content.includes(ACK_TAG_PREFIX)) {
-            hasAck = true;
-            if (ackContent === null)
-                ackContent = e.content;
-            continue;
+/**
+ * Every string in `value`, in document order: objects and arrays are walked,
+ * and a string holding JSON text is parsed and walked too.
+ */
+function stringsIn(value) {
+    const out = [];
+    const stack = [value];
+    while (stack.length > 0) {
+        const v = stack.pop();
+        if (typeof v === "string") {
+            out.push(v);
+            const t = v.trim();
+            if (t.startsWith("{") || t.startsWith("[")) {
+                try {
+                    stack.push(JSON.parse(t));
+                }
+                catch {
+                    /* not JSON text */
+                }
+            }
         }
-        if (!e.content.includes(NON_PROTECTED_TAG_PREFIX))
-            continue;
-        const ts = e.createdAt instanceof Date ? e.createdAt : new Date(e.createdAt);
-        if (Number.isNaN(ts.getTime()))
-            continue;
-        if (ts.getTime() >= cutoff) {
-            hasFreshProducer = true;
-            if (freshProducerContent === null)
-                freshProducerContent = e.content;
+        else if (Array.isArray(v)) {
+            for (let i = v.length - 1; i >= 0; i -= 1)
+                stack.push(v[i]);
+        }
+        else if (typeof v === "object" && v !== null) {
+            const children = Object.values(v);
+            for (let i = children.length - 1; i >= 0; i -= 1)
+                stack.push(children[i]);
         }
     }
-    return {
-        hasFreshProducer,
-        hasAck,
-        freshProducerContent,
-        ackContent,
-        totalEntries: entries.length,
-        degraded: null,
-    };
+    return out;
 }
-async function probeLedger(manifest, sessionId, opts) {
-    if (opts.ledgerQuery) {
-        const r = await opts.ledgerQuery(sessionId);
-        if ("degraded" in r) {
-            return {
-                hasFreshProducer: false,
-                hasAck: false,
-                freshProducerContent: null,
-                ackContent: null,
-                totalEntries: 0,
-                degraded: r.degraded,
-            };
-        }
-        return evaluateEntries(r, opts.now ?? new Date());
+const PATCH_HEADER = /^\*\*\*\s*(?:Add File|Update File|Delete File|Move to):\s*(.+)$/;
+/** The paths named by the file header lines of one text. */
+function headerPaths(text) {
+    const out = [];
+    for (const raw of text.split("\n")) {
+        const m = PATCH_HEADER.exec(raw.trim());
+        const target = m?.[1]?.trim() ?? "";
+        if (target.length > 0)
+            out.push(target);
     }
-    if (!manifest) {
-        return {
-            hasFreshProducer: false,
-            hasAck: false,
-            freshProducerContent: null,
-            ackContent: null,
-            totalEntries: 0,
-            degraded: "manifest unavailable",
-        };
+    return out;
+}
+/**
+ * Every path an `apply_patch` call names in a file header line, read from
+ * every string of `value` (the whole event, or any part of it), each once.
+ */
+export function patchTargetPaths(value) {
+    return [...new Set(stringsIn(value).flatMap(headerPaths))];
+}
+/** The patch text the as-written judgment reads: tool_input.patch, tool_input.input or a string tool_input. */
+function asWrittenPatchText(toolInput) {
+    if (typeof toolInput === "string")
+        return toolInput;
+    if (typeof toolInput !== "object" || toolInput === null)
+        return "";
+    const input = toolInput;
+    return pickString(input["patch"], input["input"]) ?? "";
+}
+/**
+ * The directories an `apply_patch` call's relative paths resolve against:
+ * the event cwd, plus a per-call `workdir` or `cwd` named in tool_input,
+ * raw_input or input.
+ */
+function patchBaseDirectories(event, cwd) {
+    const bases = [cwd];
+    for (const holder of [event.tool_input, event.raw_input, event.input]) {
+        if (typeof holder !== "object" || holder === null || Array.isArray(holder))
+            continue;
+        const fields = holder;
+        for (const key of ["workdir", "cwd"]) {
+            const value = pickString(fields[key]);
+            if (value !== undefined)
+                bases.push(absolutePath(value, cwd));
+        }
     }
-    const server = findGroundingMcp(manifest);
-    if (!server) {
-        return {
-            hasFreshProducer: false,
-            hasAck: false,
-            freshProducerContent: null,
-            ackContent: null,
-            totalEntries: 0,
-            degraded: "grounding-mcp not declared in manifest",
+    return [...new Set(bases)];
+}
+/**
+ * The directories of the as-written judgment: each path made absolute
+ * against the event cwd with `.` and `..` resolved on the text, then its
+ * nearest existing directory with symlinks left in place.
+ */
+function asWrittenTargets(toolName, toolInput, cwd, res) {
+    const single = singleTargetPath(toolName, toolInput);
+    const paths = single !== null ? [single] : toolName === "apply_patch" ? [...new Set(headerPaths(asWrittenPatchText(toolInput)))] : [];
+    if (paths.length === 0)
+        return { source: "cwd", dirs: [nearestExistingDirectoryAsWritten(cwd, res)] };
+    const dirs = paths.map((p) => nearestExistingDirectoryAsWritten(path.dirname(path.resolve(cwd, p)), res));
+    return { source: single !== null ? "target" : "patch", dirs: [...new Set(dirs)] };
+}
+/** The directories of the physical judgment: where the operating system resolves each path. */
+function checkTargets(toolName, event, cwd, res) {
+    const single = singleTargetPath(toolName, event.tool_input);
+    if (single !== null)
+        return { source: "target", dirs: writeTargetDirectories(single, cwd, res) };
+    if (toolName !== "apply_patch")
+        return { source: "cwd", dirs: [nearestExistingDirectory(cwd, res)] };
+    const bases = patchBaseDirectories(event, cwd);
+    const paths = patchTargetPaths(event);
+    if (paths.length === 0)
+        return { source: "cwd", dirs: [...new Set(bases.map((b) => nearestExistingDirectory(b, res)))] };
+    const dirs = paths.flatMap((p) => (path.isAbsolute(p) ? [cwd] : bases).flatMap((b) => writeTargetDirectories(p, b, res)));
+    return { source: "patch", dirs: [...new Set(dirs)] };
+}
+/**
+ * Write `text` to `stream` and wait for the write to complete, for at most
+ * `timeoutMs`. The write counts as failed when the stream is already closed,
+ * when the completion callback carries an error, when the stream emits
+ * 'error' during the wait, or when it has closed by the time the wait ends.
+ * A wait that ends with the stream still open is a slow reader, not a failed
+ * write: the entry point's drain gives the rest of the text its own bounded
+ * wait.
+ */
+function writeAndAwait(stream, text, timeoutMs) {
+    const closedReason = () => {
+        const s = stream;
+        return s.destroyed === true || s.writable === false ? "stdout is closed" : undefined;
+    };
+    return new Promise((resolve) => {
+        const before = closedReason();
+        if (before !== undefined) {
+            resolve({ delivered: false, why: before });
+            return;
+        }
+        let timer;
+        const onError = (err) => settle({ delivered: false, why: err.message });
+        const settle = (result) => {
+            clearTimeout(timer);
+            stream.removeListener("error", onError);
+            resolve(result);
         };
-    }
-    const command = Array.isArray(server.command)
-        ? server.command
-        : server.command.trim().split(/\s+/);
-    const env = server.env ?? undefined;
-    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
-    const result = await queryLedgerByTag({
-        mcpCommand: command,
-        ...(env && { mcpEnv: env }),
-        sessionId,
-        timeoutMs,
+        stream.on("error", onError);
+        timer = setTimeout(() => {
+            const why = closedReason();
+            settle(why === undefined ? { delivered: true } : { delivered: false, why });
+        }, timeoutMs);
+        try {
+            stream.write(text, (err) => {
+                settle(err ? { delivered: false, why: err.message } : { delivered: true });
+            });
+        }
+        catch (err) {
+            settle({ delivered: false, why: err instanceof Error ? err.message : String(err) });
+        }
     });
-    if (result.kind === "degraded") {
-        return {
-            hasFreshProducer: false,
-            hasAck: false,
-            freshProducerContent: null,
-            ackContent: null,
-            totalEntries: 0,
-            degraded: result.reason,
-        };
-    }
-    return evaluateEntries(result.entries, opts.now ?? new Date());
 }
-function blockJson(toolName, branch, detail, protectedList, ux, sessionId) {
-    // When the pack config declares `ux:`, the agent-facing surface
-    // becomes the plain-language `{ cannot, required, run }` shape and
-    // the legacy "branch-protection: refusing ..." vocabulary is
-    // suppressed. The stderr BLOCK diagnostic keeps the engine reason
-    // (`detail`) for operator audit. `${BRANCH}` / `${TOOL_NAME}` /
-    // `${SESSION_ID}` substitute against the pack runtime context.
-    let reasonText;
-    if (ux) {
-        reasonText = renderAgentFacing(ux, {
-            BRANCH: branch,
-            TOOL_NAME: toolName,
-            SESSION_ID: sessionId,
-        });
-    }
-    else {
-        const minutes = Math.round(PRODUCER_FRESHNESS_MS / 60000);
-        reasonText =
-            `branch-protection: refusing ${toolName} on protected branch "${branch}". ` +
-                `${detail}\n` +
-                `To proceed, cut a feature branch and re-run the producer:\n` +
-                `  git checkout -b <feature-slug>\n` +
-                `  harness session-start branch-check\n` +
-                `Once the gate sees a fresh ${NON_PROTECTED_TAG_PREFIX} tag (within ${minutes}m), this tool call will succeed.\n` +
-                `\n` +
-                `Override (operator only): the operator runs, from an un-hooked shell:\n` +
-                `  harness approve branch-protection --session ${sessionId}\n` +
-                `which writes the canonical approval marker the gate consults. ` +
-                `A \`${ACK_TAG_PREFIX}:<reason>\` ledger tag is no longer a sufficient override on its own ` +
-                `(it is agent-writable); the marker file under harness.generated/ is the trusted signal.\n` +
-                `\n` +
-                `Protected branches: ${protectedList.join(", ")}.`;
-    }
+function claudeBlockEnvelope(reason) {
     return JSON.stringify({
         decision: "block",
-        reason: reasonText,
+        reason,
         hookSpecificOutput: {
             hookEventName: "PreToolUse",
             permissionDecision: "deny",
-            permissionDecisionReason: reasonText,
+            permissionDecisionReason: reason,
         },
     });
 }
-async function runPackHookBranchProtectionCliInner(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
+/** Agent-facing text for a protected branch: the ux block, or the default. */
+function protectedBranchText(toolName, branch, dir, protectedList, ux, sessionId) {
+    if (ux) {
+        return renderAgentFacing(ux, { BRANCH: branch, TOOL_NAME: toolName, SESSION_ID: sessionId });
+    }
+    return (`branch-protection: refusing ${toolName} on protected branch "${branch}" (checked in ${dir}).\n` +
+        `Create a feature branch first, then retry:\n` +
+        `  git checkout -b <feature>\n` +
+        `Protected branches: ${protectedList.join(", ")}.`);
+}
+/**
+ * `harness pack hook branch-protection`. `opts.runtime` selects the block
+ * contract; an unknown value refuses with exit 2, which both runtimes read as
+ * a block.
+ */
+export async function runPackHookBranchProtectionCli(opts = {}) {
+    const now = opts.now ?? Date.now;
+    const startedAt = now();
     const stdout = opts.stdout ?? process.stdout;
     const stderr = opts.stderr ?? process.stderr;
+    // Before the first write of any kind: a reader that has gone makes a write
+    // fail with EPIPE, and the error is emitted while this function is still
+    // awaiting git, so a listener attached only at exit comes too late.
+    // The exit code is the decision's, whatever happens to the pipe.
+    tolerateClosedStdio([stdout, stderr]);
     const note = (msg) => {
         stderr.write(`harness pack hook branch-protection: ${msg}\n`);
     };
-    // Defensive stdin parse. Empty / malformed input resolves to BLOCK
-    // (the inverse of understanding-before-execution's allow-on-malformed
-    // default): we'd rather block a Write we couldn't classify than let
-    // it through silently.
-    const raw = await readStdin(stdin);
-    let event = {};
+    const allow = (diagnostic) => {
+        note(diagnostic);
+        return { exitCode: 0, blocked: false, diagnostic };
+    };
+    const runtime = opts.runtime ?? "claude-code";
+    if (!BRANCH_PROTECTION_RUNTIMES.includes(runtime)) {
+        // The value comes from the command line, so the diagnostic is bounded like every other block detail.
+        const diagnostic = boundUtf8(`BLOCK: unknown --runtime ${JSON.stringify(runtime)} (expected ${BRANCH_PROTECTION_RUNTIMES.join(" or ")}); refusing`);
+        note(diagnostic);
+        return { exitCode: CODEX_EXIT_BLOCK, blocked: true, diagnostic };
+    }
+    // Every block flows through here, so the detail and the agent text are cut
+    // to a fixed size once, whatever they embed (a manifest parse error grows
+    // with the manifest). The envelope is built from the cut text with
+    // JSON.stringify, so the cut cannot break the JSON.
+    const block = async (detail, agentText) => {
+        const diagnostic = boundUtf8(`BLOCK: ${detail}`);
+        const bounded = boundUtf8(agentText);
+        note(diagnostic);
+        if (runtime === "codex") {
+            stderr.write(`${bounded}\n`);
+            return { exitCode: CODEX_EXIT_BLOCK, blocked: true, diagnostic };
+        }
+        const written = await writeAndAwait(stdout, `${claudeBlockEnvelope(bounded)}\n`, STDIO_DRAIN_TIMEOUT_MS);
+        if (written.delivered)
+            return { exitCode: 0, blocked: true, diagnostic };
+        // Exit 0 without the envelope would be read as an allow, so the block
+        // falls back to the exit code both runtimes read as one.
+        try {
+            stderr.write(`harness pack hook branch-protection: the block envelope could not be written to stdout (${written.why}); ` +
+                `exiting ${CODEX_EXIT_BLOCK} so the refusal still counts as a block.\n${bounded}\n`);
+        }
+        catch {
+            // best effort: stderr may be gone as well; the exit code carries the decision
+        }
+        return { exitCode: CODEX_EXIT_BLOCK, blocked: true, diagnostic };
+    };
+    // A read that timed out never received the whole event, so nothing can be
+    // judged: refuse (fail closed).
+    const read = await readStdinChecked(opts.stdin ?? process.stdin);
+    if (read.timedOut) {
+        const reason = `stdin timeout: no complete event arrived and closed on stdin within ${read.idleTimeoutMs} ms, ` +
+            `so branch-protection cannot judge the tool call and refuses it (fail closed). Retry the tool call.`;
+        return await block(reason, reason);
+    }
+    let parsed;
     try {
-        event = JSON.parse(raw.trim() || "{}");
+        parsed = JSON.parse(read.text);
     }
     catch {
-        /* event stays {} — handled by the sessionId check below */
+        parsed = undefined;
     }
-    // Pause sentinel — even branch-protection (the strictest gate) yields
-    // to an operator pause. The whole point of the incident-mode flow is
-    // pushing a hotfix to a protected branch when normal gates are in the
-    // way.
-    if (checkHookPause("branch-protection", stderr, opts).paused) {
-        const diagnostic = "harness paused; branch-protection allowing without evaluating.";
-        return { exitCode: 0, blocked: false, diagnostic };
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        const detail = "the event on stdin is not a JSON object";
+        return await block(detail, `branch-protection: refusing the tool call: ${detail}, so it cannot be judged.`);
     }
-    const sessionId = (typeof event.session_id === "string" ? event.session_id : undefined) ??
-        process.env.CLAUDE_CODE_SESSION_ID ??
-        process.env.CLAUDE_SESSION_ID ??
-        "";
-    const toolName = typeof event.tool_name === "string" ? event.tool_name : "(unknown)";
-    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
-        ? opts.cwd
-        : typeof event.cwd === "string" && event.cwd.length > 0
-            ? event.cwd
-            : process.cwd();
-    // Load manifest to resolve the protected-branches list AND the
-    // grounding-mcp wiring. A manifest load failure forces BLOCK with a
-    // clear hint — we can't know if the gate should fire if we can't
-    // read its config.
-    // Resolved manifest path feeds the harness.generated/ lookup below (the
-    // override-marker directory). An injected manifest (tests) has no
-    // on-disk path, so `generatedDir` falls back to opts.generatedDir.
+    const event = parsed;
+    const toolName = pickString(event.tool_name, event.tool) ?? "(unknown)";
+    const sessionId = pickString(event.session_id) ?? "";
+    const cwdText = pickString(opts.cwd, event.cwd) ?? process.cwd();
+    // Without the manifest the gate cannot know whether it is enabled or what
+    // is protected, so a load failure refuses.
     let manifest;
-    let manifestPath;
     try {
-        ({ manifest, manifestPath } = loadManifestOrInjected(opts, opts.manifest));
+        ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
     }
     catch (err) {
-        const reason = `manifest load failed (${err.message}); refusing on failsafe`;
-        const diagnostic = `BLOCK — ${reason}`;
-        note(diagnostic);
-        // Manifest didn't load, so no ux config to honour; legacy
-        // envelope is the only available surface here.
-        stdout.write(`${blockJson(toolName, "(unresolvable)", reason, DEFAULT_PROTECTED_BRANCHES, undefined, sessionId)}\n`);
-        return { exitCode: 0, blocked: true, diagnostic };
+        const detail = `the harness manifest could not be loaded (${err.message})`;
+        return await block(`${detail}; refusing on failsafe`, `branch-protection: refusing ${toolName}: ${detail}.`);
     }
     const pack = manifest.policy_packs.find((p) => p.name === PACK_NAME);
-    if (!pack) {
-        const diagnostic = `pack "${PACK_NAME}" not declared in manifest, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    if (!pack.enabled) {
-        const diagnostic = `pack "${PACK_NAME}" is enabled:false, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
+    if (!pack)
+        return allow(`pack "${PACK_NAME}" not declared in manifest, allowing`);
+    if (!pack.enabled)
+        return allow(`pack "${PACK_NAME}" is enabled:false, allowing`);
     const { branches: protectedList } = resolveProtectedBranches(pack);
     const configUx = parseConfigUx(pack.config["ux"], stderr, "harness pack hook branch-protection");
-    // Resolve the branch context to gate against. For tools that target a
-    // single file (Write, Edit, MultiEdit, NotebookEdit), the relevant
-    // branch is whatever repo OWNS the target path — not cwd. Without this
-    // step, a Write to `~/.claude/memory/foo.md` from inside a checkout on
-    // a protected branch would be wrongly blocked, even though the target
-    // is outside any repo (memory files), or inside an unrelated repo, and
-    // the protection rules of cwd's repo have no bearing on it. For
-    // path-less tools (Bash, etc.) we fall back to cwd as before.
-    const targetPath = extractTargetPath(toolName, event.tool_input);
-    let branchSourceDir = cwd;
-    let branchSource = "cwd";
-    if (targetPath !== null) {
-        const absTarget = path.isAbsolute(targetPath)
-            ? targetPath
-            : path.resolve(cwd, targetPath);
-        branchSourceDir = path.dirname(absTarget);
-        branchSource = "target";
-    }
-    const { branch } = resolveGitContext(branchSourceDir);
-    // Outside a git work tree (or detached HEAD) we can't tell what the
-    // edit would land on. We choose to allow here — the alternative is
-    // blocking every Write in non-git workspaces, which would be hostile
-    // to standalone-script workflows and to writes that target machine
-    // state under $HOME / /tmp. A detached HEAD on an in-repo target also
-    // lands here; arguably should block, but detached-HEAD edits don't
-    // auto-push to a protected ref so the downstream
-    // `preflight-before-push` gate still catches the actual hazard.
-    if (branch === "") {
-        const diagnostic = `${branchSource} is not on a named branch (detached HEAD or outside a git work tree); allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    if (!protectedList.includes(branch)) {
-        const diagnostic = `branch "${branch}" is not in the protected list (${protectedList.join(", ")}); allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    // On a protected branch: probe the ledger for either gate path.
-    if (sessionId === "") {
-        const reason = `no session_id resolvable from stdin or $CLAUDE_CODE_SESSION_ID/$CLAUDE_SESSION_ID; cannot consult ledger`;
-        const diagnostic = `BLOCK — ${reason}`;
-        note(diagnostic);
-        stdout.write(`${blockJson(toolName, branch, reason, protectedList, configUx, sessionId)}\n`);
-        return { exitCode: 0, blocked: true, diagnostic };
-    }
-    const check = await probeLedger(manifest, sessionId, opts);
-    // Override path (operator-only). The canonical override signal is a
-    // marker file under harness.generated/.approvals/ that only a process
-    // the operator launched can write — NOT the `branch-protection-ack`
-    // ledger tag, which the agent can self-write via its own ledger_add MCP
-    // access (audit finding #39; the understanding gate closed the identical
-    // backdoor in agent-tasks/88ca4bb3). The ledger ack, if present, is
-    // surfaced as a best-effort audit echo only. `generatedDir` is
-    // unresolvable only on the test-injection path (an injected manifest has
-    // no on-disk path and no opts.generatedDir); there the override is
-    // simply unavailable and the gate falls through to the producer check.
-    const generatedDir = opts.generatedDir ??
-        (manifestPath !== undefined
-            ? resolveGeneratedDir({
-                ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-                manifestPath,
-            })
-            : undefined);
-    // Best-effort audit echo of the now-untrusted ledger ack, appended to
-    // diagnostics so an operator chasing the gate can see the historic tag
-    // without it being mistaken for the thing that opened (or failed to
-    // open) the gate.
-    const ackEcho = check.hasAck
-        ? ` [audit: ledger ${check.ackContent ?? ACK_TAG_PREFIX} present, no longer satisfies the gate]`
-        : "";
-    // Distinct audit note when the override marker FILE existed but failed
-    // signature verification (harness/f9485cc7) — missing/invalid signature,
-    // wrong alg, or a tampered payload — so it reads apart from the routine
-    // "no operator override marker" case below.
-    let markerForgedNote = "";
-    if (generatedDir !== undefined) {
-        const markerCheck = checkBranchProtectionMarker(generatedDir, sessionId);
-        if (markerCheck.matched) {
-            const diagnostic = `branch-protection override marker active (${markerCheck.detail}); allowing${ackEcho}`;
-            note(diagnostic);
-            return { exitCode: 0, blocked: false, diagnostic };
-        }
-        if (markerCheck.forged) {
-            markerForgedNote = ` [forged/unsigned override marker rejected: ${markerCheck.detail}]`;
+    const deadlineMs = opts.gitDeadlineMs ?? GIT_READ_DEADLINE_MS;
+    const perCallMs = opts.gitTimeoutMs ?? GIT_BRANCH_TIMEOUT_MS;
+    const deadline = startedAt + deadlineMs;
+    const bound = { overBound: () => now() >= deadline, memo: new Map() };
+    const asWritten = {
+        targets: (res) => asWrittenTargets(toolName, event.tool_input, path.resolve(cwdText), res),
+        at: (dir) => ({ kind: "path", path: dir }),
+    };
+    const physical = {
+        targets: (res) => checkTargets(toolName, event, absolutePath(cwdText), res),
+        at: resolveDirectory,
+    };
+    // Both judgments, the as-written one first: the hook allows only what both allow.
+    const judgments = [asWritten, physical];
+    // Each directory git ran in is read once per event.
+    const answers = new Map();
+    const sources = [];
+    const seen = [];
+    try {
+        for (const judgment of judgments) {
+            const targets = judgment.targets(bound);
+            if (!sources.includes(targets.source))
+                sources.push(targets.source);
+            for (const dir of targets.dirs) {
+                const remaining = deadline - now();
+                if (remaining <= 0) {
+                    const detail = `the branch of ${dir} was not checked: the hook passed its ${deadlineMs} ms bound`;
+                    return await block(detail, `branch-protection: refusing ${toolName}: git could not report the branch of ${dir} (${detail}).`);
+                }
+                const at = judgment.at(dir);
+                let branchRead;
+                if (at.kind === "error") {
+                    branchRead = at;
+                }
+                else {
+                    const known = answers.get(at.path);
+                    if (known !== undefined)
+                        continue;
+                    branchRead = await readBranchAt(at.path, {
+                        ...(opts.gitReader !== undefined ? { reader: opts.gitReader } : {}),
+                        timeoutMs: Math.min(perCallMs, remaining),
+                    });
+                    answers.set(at.path, branchRead);
+                }
+                switch (branchRead.kind) {
+                    case "error":
+                        return await block(`git could not report the branch of ${dir}: ${branchRead.detail}`, `branch-protection: refusing ${toolName}: git could not report the branch of ${dir} (${branchRead.detail}).`);
+                    case "branch":
+                        if (isProtectedBranch(branchRead.name, protectedList)) {
+                            return await block(`branch "${branchRead.name}" of ${dir} is protected (${protectedList.join(", ")})`, protectedBranchText(toolName, branchRead.name, dir, protectedList, configUx, sessionId));
+                        }
+                        seen.push(`${dir}: branch "${branchRead.name}" is not in the protected list (${protectedList.join(", ")})`);
+                        break;
+                    case "detached":
+                        seen.push(`${dir}: detached HEAD`);
+                        break;
+                    case "outside":
+                        seen.push(`${dir}: outside any git repository`);
+                        break;
+                }
+            }
         }
     }
-    if (check.hasFreshProducer) {
-        const diagnostic = `fresh producer tag (${check.freshProducerContent ?? NON_PROTECTED_TAG_PREFIX}); allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
+    catch (err) {
+        // Fail closed: a path that could not be resolved within the bound, or
+        // any other failure while judging, refuses.
+        const detail = err instanceof PathBoundError
+            ? `the paths of the tool call were not resolved: the hook passed its ${deadlineMs} ms bound`
+            : `the tool call could not be judged (${err instanceof Error ? err.message : String(err)})`;
+        return await block(detail, `branch-protection: refusing ${toolName}: ${detail}.`);
     }
-    const why = check.degraded !== null
-        ? `ledger degraded (${check.degraded}); refusing on failsafe`
-        : `no fresh ${NON_PROTECTED_TAG_PREFIX} tag (${check.totalEntries} entries scanned) and no operator override marker${ackEcho}${markerForgedNote}`;
-    const diagnostic = `BLOCK — ${why}`;
-    note(diagnostic);
-    stdout.write(`${blockJson(toolName, branch, why, protectedList, configUx, sessionId)}\n`);
-    return { exitCode: 0, blocked: true, diagnostic };
-}
-/**
- * `harness pack hook branch-protection`. A stdin read that times out is refused here
- * instead of being handed to the gate as an empty or truncated event it would
- * treat as malformed input (task 7dfdcaaf). The operator pause still wins;
- * every other input runs the gate unchanged.
- */
-export function runPackHookBranchProtectionCli(opts = {}) {
-    return runGateWithStdinRefusal(opts, (stderr) => checkHookPause("branch-protection", stderr, opts).paused, stdoutBlockRefusal("branch-protection"), runPackHookBranchProtectionCliInner);
+    return allow(`${sources.join("+")} ${seen.join("; ")}; allowing`);
 }
 //# sourceMappingURL=hook-branch-protection.js.map