@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/approve/risk.d.ts

@@ -1,112 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface ApproveRiskOptions extends LoaderOptions {
-    /** Explicit session id (overrides $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID / $CODEX_SESSION_ID). */
-    session?: string;
-    /**
-     * Restrict the ledger tag this verb writes to one Risk Gate ARM
-     * instead of the shared production tag (task d03af8f6, review round
-     * 2, HIGH 2 fix). `"deletion"` writes
-     * `risk-approved:deletion:${SESSION_ID}` — the tag
-     * `gate-dev-unsafe-deletion` alone consults — instead of the default
-     * `risk-approved:${SESSION_ID}` that BOTH `gate-prod-destructive-
-     * approval` and (before this fix) `gate-dev-unsafe-deletion` used to
-     * share. The measured bug this closes: approving a routine `rm -rf
-     * dist` on a task branch used to clear `gate-prod-destructive-
-     * approval` for the rest of the session too, since both policies
-     * consulted the exact same tag. Omitted (the default) writes ONLY the
-     * production tag, unchanged from before this option existed — an
-     * operator who never passes `--scope` sees no behavior change at all.
-     * Ignored when `force` is set (a forced override always writes the
-     * deny-tier `risk-override:` tag, which has no scope of its own).
-     */
-    scope?: "deletion";
-    /**
-     * Operator-deliberate override of a Risk Gate `deny` decision. Writes
-     * `risk-override:${SESSION_ID}:forced:<reason-slug>` instead of the
-     * default `risk-approved:${SESSION_ID}` tag, so the built-in
-     * `gate-prod-destructive` policy (which gates on `risk-override:`,
-     * see `src/cli/init/templates.ts`) clears. `deny` is by design not
-     * approvable, so this path is hard-gated behind operator-only checks:
-     * a TTY stdin OR explicit `iAmTheOperator` acknowledgement is
-     * required, mirroring `harness pause`. The reason becomes part of the
-     * audit trail and is sanitised to a tag-safe slug.
-     */
-    force?: {
-        reason: string;
-    };
-    /**
-     * Acknowledge a non-TTY / scripted invocation of `--force`. Without
-     * this flag a non-TTY `--force` refuses with a usage error.
-     */
-    iAmTheOperator?: boolean;
-    /**
-     * Override `process.stdin.isTTY` for tests; mirrors the pause/resume
-     * seam so the non-TTY refusal can be exercised hermetically.
-     */
-    stdinIsTTY?: boolean;
-    /** Override the harness.generated/ directory (test injection). */
-    generatedDir?: string;
-    /** Inject a manifest (test); bypasses `loadManifest`. */
-    manifest?: Manifest;
-    /** Override the ledger writer (test). */
-    ledgerAdd?: (sessionId: string, content: string) => Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-    }>;
-}
-export interface ApproveRiskResult {
-    sessionId: string;
-    /** Where `sessionId` came from — surfaced so the operator can sanity-check it. */
-    sessionSource: "flag" | "env-claude-code" | "env-claude" | "env-codex" | "pending-approval";
-    /**
-     * True when the verb wrote a `risk-override:` tag via `--force`
-     * instead of the default `risk-approved:`. The CLI surfaces this so
-     * the operator can see at a glance that they exercised the deny-tier
-     * override, not a clean require_approval approval.
-     */
-    forced: boolean;
-    ledger: {
-        ok: boolean;
-        tag: string;
-        reason?: string;
-    };
-}
-/**
- * The evidence-ledger tag a Risk Gate `require_approval` policy
- * consults. With no `scope`, this is the SHARED production tag
- * `gate-prod-destructive-approval` consults (unchanged since Phase 7
- * #6). `scope: "deletion"` (task d03af8f6, review round 2) writes the
- * dev-context deletion arm's OWN tag instead — `gate-dev-unsafe-
- * deletion` consults `risk-approved:deletion:${SESSION_ID}` exclusively,
- * so approving one does not clear the other. See `ApproveRiskOptions.scope`.
- */
-export declare function riskApprovedTagFor(sessionId: string, scope?: "deletion"): string;
-/**
- * The evidence-ledger tag a Risk Gate `deny`-tier policy with
- * `requires.ledger_tag: risk-override:${SESSION_ID}` consults. The
- * `:forced:<reason>` suffix is additive metadata: the built-in
- * policy's matcher pins the `risk-override:<session>` substring, so the
- * suffix never affects whether the gate clears. It exists for the
- * audit trail (`harness audit` can grep `:forced:` to surface every
- * operator-deliberate override).
- */
-export declare function riskOverrideTagFor(sessionId: string, reason: string): string;
-/**
- * Resolve the target session id and write its `risk-approved:` ledger
- * tag. Session id precedence mirrors `harness approve understanding`
- * tiers 1-4: explicit `--session`, then `$CLAUDE_CODE_SESSION_ID`
- * (the var Claude Code itself sets), then `$CLAUDE_SESSION_ID` (legacy
- * / docs name), then `$CODEX_SESSION_ID`, then the `.pending-approval`
- * file the gate hook staged on its last block. There is no
- * persisted-report tier-5 guess: the Risk Gate produces no persisted
- * reports.
- *
- * Throws `HarnessExitError(EX_FAIL)` when no session id can be resolved.
- * A degraded ledger (grounding-mcp absent / unreachable) is surfaced in
- * the result, not thrown — same best-effort contract as `approve
- * understanding`'s ledger write.
- */
-export declare function approveRisk(opts?: ApproveRiskOptions): Promise<ApproveRiskResult>;

package/dist/cli/approve/risk.js

@@ -1,197 +0,0 @@
-// Phase 7 #6 — `harness approve risk [--session <id>]` CLI verb.
-//
-// The operator's grant for a Risk Gate `require_approval` decision.
-// When `harness policy intercept` blocks a risky action with outcome
-// `require_approval`, the policy's `requires:` names a `risk-approved:
-// ${SESSION_ID}` ledger tag; this verb writes that tag so the next
-// evaluation of the same policy passes and the outcome becomes `allow`.
-//
-// Deliberately simpler than `harness approve understanding`: the Risk
-// Gate's requires-evaluator reads the evidence ledger (it is the same
-// Phase 4 evaluator), so an ordinary `ledger_add` entry IS the approval.
-// There is no persisted-report flip and no filesystem marker — the
-// ledger tag is the single source of truth, exactly as Phase 7's design
-// (docs/risk-gate.md "Decision model") specifies. `agent-grounding`
-// needs no change: it already stores arbitrary tags through `ledger_add`.
-import { addLedgerFact } from "../../runtime/ledger-add.js";
-import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
-import { resolveApprovalSessionId } from "../../runtime/session-id.js";
-import { EX_FAIL, EX_USAGE, HarnessExitError } from "../exit-codes.js";
-import { loadManifest, resolvePaths } from "../loader.js";
-const RISK_APPROVED_PREFIX = "risk-approved";
-const RISK_OVERRIDE_PREFIX = "risk-override";
-/**
- * The evidence-ledger tag a Risk Gate `require_approval` policy
- * consults. With no `scope`, this is the SHARED production tag
- * `gate-prod-destructive-approval` consults (unchanged since Phase 7
- * #6). `scope: "deletion"` (task d03af8f6, review round 2) writes the
- * dev-context deletion arm's OWN tag instead — `gate-dev-unsafe-
- * deletion` consults `risk-approved:deletion:${SESSION_ID}` exclusively,
- * so approving one does not clear the other. See `ApproveRiskOptions.scope`.
- */
-export function riskApprovedTagFor(sessionId, scope) {
-    return scope === "deletion"
-        ? `${RISK_APPROVED_PREFIX}:deletion:${sessionId}`
-        : `${RISK_APPROVED_PREFIX}:${sessionId}`;
-}
-/**
- * The evidence-ledger tag a Risk Gate `deny`-tier policy with
- * `requires.ledger_tag: risk-override:${SESSION_ID}` consults. The
- * `:forced:<reason>` suffix is additive metadata: the built-in
- * policy's matcher pins the `risk-override:<session>` substring, so the
- * suffix never affects whether the gate clears. It exists for the
- * audit trail (`harness audit` can grep `:forced:` to surface every
- * operator-deliberate override).
- */
-export function riskOverrideTagFor(sessionId, reason) {
-    return `${RISK_OVERRIDE_PREFIX}:${sessionId}:forced:${sanitiseReasonSlug(reason)}`;
-}
-/**
- * Reduce an operator-supplied free-form reason to a tag-safe slug. Keeps
- * `[A-Za-z0-9._-]`, collapses any other run to a single `-`, trims
- * leading / trailing `-`, lowercases, caps at 64 chars. An empty result
- * (e.g. the operator passed only punctuation) is rejected upstream.
- */
-function sanitiseReasonSlug(reason) {
-    const slug = reason
-        .toLowerCase()
-        .replace(/[^a-z0-9._-]+/g, "-")
-        .replace(/^-+|-+$/g, "")
-        .slice(0, 64);
-    return slug.length > 0 ? slug : "operator-override";
-}
-function refuseForcedIfNonTTY(opts) {
-    if (!opts.force)
-        return;
-    if (opts.iAmTheOperator === true)
-        return;
-    // Deliberate divergence from `harness pause`'s twin guard
-    // (`src/cli/pause/index.ts`'s `refuseIfAgentShell`): this verb is
-    // designed to be runnable from inside `!`-prefixed Claude Code shells
-    // where `$CLAUDE_SESSION_ID` is set (the session-id resolver below
-    // reads it as a fallback tier). Refusing on that env var would gut
-    // the `! ` UX. Operator intent is gated by the non-empty `<reason>`
-    // and the TTY / `--i-am-the-operator` check; that is sufficient.
-    const tty = opts.stdinIsTTY !== undefined ? opts.stdinIsTTY : process.stdin.isTTY === true;
-    if (tty)
-        return;
-    throw new HarnessExitError([
-        "harness approve risk --force refuses to run with non-TTY stdin (looks scripted).",
-        "",
-        "This is the load-bearing guardrail against `--force` becoming an agent-driven",
-        "bypass of a deny-tier Risk Gate decision. Run the verb from your own operator",
-        "shell (in Claude Code: prefix the command with `! `), or pass --i-am-the-operator",
-        "to acknowledge a one-off recovery script.",
-    ].join("\n"), EX_USAGE);
-}
-function findGroundingMcp(manifest) {
-    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
-}
-async function writeLedgerTag(manifest, sessionId, content, opts) {
-    if (opts.ledgerAdd)
-        return opts.ledgerAdd(sessionId, content);
-    const server = findGroundingMcp(manifest);
-    if (!server) {
-        return { ok: false, reason: "grounding-mcp not declared in manifest" };
-    }
-    // No `~` expansion here: `addLedgerFact` expands leading `~/` in every
-    // command token itself, so a second pass would be dead work.
-    const command = Array.isArray(server.command)
-        ? server.command
-        : server.command.trim().split(/\s+/);
-    return addLedgerFact({
-        mcpCommand: command,
-        ...(server.env && { mcpEnv: server.env }),
-        timeoutMs: server.health?.timeout_ms ?? 5_000,
-        sessionId,
-        content,
-        source: "harness-approve-risk",
-    });
-}
-/**
- * Resolve the target session id and write its `risk-approved:` ledger
- * tag. Session id precedence mirrors `harness approve understanding`
- * tiers 1-4: explicit `--session`, then `$CLAUDE_CODE_SESSION_ID`
- * (the var Claude Code itself sets), then `$CLAUDE_SESSION_ID` (legacy
- * / docs name), then `$CODEX_SESSION_ID`, then the `.pending-approval`
- * file the gate hook staged on its last block. There is no
- * persisted-report tier-5 guess: the Risk Gate produces no persisted
- * reports.
- *
- * Throws `HarnessExitError(EX_FAIL)` when no session id can be resolved.
- * A degraded ledger (grounding-mcp absent / unreachable) is surfaced in
- * the result, not thrown — same best-effort contract as `approve
- * understanding`'s ledger write.
- */
-export async function approveRisk(opts = {}) {
-    // --force is operator-deliberate; guard before any side effect. The
-    // session-id resolution below intentionally still runs the agent-shell
-    // env tier (CLAUDE_CODE_SESSION_ID etc.), since the operator may be
-    // running from `!` with --i-am-the-operator and the session id has to
-    // come from somewhere.
-    refuseForcedIfNonTTY(opts);
-    const generatedDir = opts.generatedDir ??
-        resolveGeneratedDir({
-            ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-            manifestPath: resolvePaths(opts).base,
-        });
-    // Session id precedence mirrors `harness approve understanding` tiers 1-5:
-    // explicit --session, then $CLAUDE_CODE_SESSION_ID (canonical Claude Code
-    // var), then $CLAUDE_SESSION_ID (legacy), then $CODEX_SESSION_ID, then the
-    // .pending-approval file staged by the gate hook or preflight. No
-    // persisted-report tier: the Risk Gate produces no persisted reports.
-    const { sessionId, sessionSource: rawSessionSource } = resolveApprovalSessionId({
-        session: opts.session,
-        generatedDir,
-    });
-    // Cast is safe: no newestReportFallback passed, so "newest-report" is
-    // unreachable at runtime. The wider return type of resolveApprovalSessionId
-    // requires the cast for TypeScript.
-    const sessionSource = rawSessionSource;
-    if (sessionId === "") {
-        throw new HarnessExitError([
-            "no session id available. Pass --session <id>, or set one of",
-            "$CLAUDE_CODE_SESSION_ID (Claude Code) / $CLAUDE_SESSION_ID (legacy) /",
-            "$CODEX_SESSION_ID (Codex).",
-            "",
-            "The understanding-gate PreToolUse hook and `harness preflight` both stage the",
-            `session id in ${generatedDir}/.pending-approval, so an arg-less`,
-            "`harness approve risk` works after either has fired. An empty result means",
-            "neither has run for the current session yet.",
-            "",
-            "From inside the running agent you can also read the id directly:",
-            "Claude Code exposes $CLAUDE_CODE_SESSION_ID; Codex exposes $CODEX_SESSION_ID.",
-        ].join("\n"), EX_FAIL);
-    }
-    // The manifest is needed only for the grounding-mcp command. If it
-    // cannot load, the ledger write degrades to a surfaced warning rather
-    // than aborting — the operator still learns the resolved session id.
-    let manifest = null;
-    try {
-        manifest = opts.manifest ?? loadManifest(opts).manifest;
-    }
-    catch {
-        /* swallow; ledger write becomes a degraded-ok */
-    }
-    // Forced override writes a different tag prefix (`risk-override:`)
-    // that the deny-tier `gate-prod-destructive` policy template consults.
-    // The audit-only `:forced:<reason>` suffix lets `harness audit` and
-    // `harness explain --trace` distinguish a clean require_approval
-    // approval from a deliberate deny override.
-    const forced = opts.force !== undefined;
-    const tag = forced
-        ? riskOverrideTagFor(sessionId, opts.force.reason)
-        : riskApprovedTagFor(sessionId, opts.scope);
-    const ledgerResult = manifest
-        ? await writeLedgerTag(manifest, sessionId, tag, opts)
-        : { ok: false, reason: "manifest unreadable; skipped ledger write" };
-    return {
-        sessionId,
-        sessionSource,
-        forced,
-        ledger: ledgerResult.ok
-            ? { ok: true, tag }
-            : { ok: false, tag, reason: ledgerResult.reason },
-    };
-}
-//# sourceMappingURL=risk.js.map

package/dist/cli/approve/risk.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../../src/cli/approve/risk.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,oEAAoE;AACpE,0EAA0E;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AA2E9E,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAC7C,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,KAAkB;IACtE,OAAO,KAAK,KAAK,UAAU;QACzB,CAAC,CAAC,GAAG,oBAAoB,aAAa,SAAS,EAAE;QACjD,CAAC,CAAC,GAAG,oBAAoB,IAAI,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc;IAClE,OAAO,GAAG,oBAAoB,IAAI,SAAS,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,IAAI,GAAG,MAAM;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACtD,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO;IACxB,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO;IACzC,0DAA0D;IAC1D,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IAC3F,IAAI,GAAG;QAAE,OAAO;IAChB,MAAM,IAAI,gBAAgB,CACxB;QACE,kFAAkF;QAClF,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,mFAAmF;QACnF,2CAA2C;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAkB,EAClB,SAAiB,EACjB,OAAe,EACf,IAAwB;IAExB,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;QAC7C,SAAS;QACT,OAAO;QACP,MAAM,EAAE,sBAAsB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAAE;IAE7B,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,uBAAuB;IACvB,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,wBAAwB,CAAC;QAC9E,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY;KACb,CAAC,CAAC;IACH,sEAAsE;IACtE,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,aAAa,GAAG,gBAAsD,CAAC;IAE7E,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB;YACE,6DAA6D;YAC7D,uEAAuE;YACvE,4BAA4B;YAC5B,EAAE;YACF,+EAA+E;YAC/E,iBAAiB,YAAY,oCAAoC;YACjE,4EAA4E;YAC5E,8CAA8C;YAC9C,EAAE;YACF,kEAAkE;YAClE,+EAA+E;SAChF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,iEAAiE;IACjE,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM;QAChB,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAM,CAAC,MAAM,CAAC;QACnD,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAEhF,OAAO;QACL,SAAS;QACT,aAAa;QACb,MAAM;QACN,MAAM,EAAE,YAAY,CAAC,EAAE;YACrB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/cli/approve/stdin-report.d.ts

@@ -1,57 +0,0 @@
-import { type UnderstandingGateMode } from "@lannguyensi/understanding-gate";
-export type StdinReportOutcome = {
-    ok: true;
-    filePath: string;
-} | {
-    ok: false;
-    reason: string;
-    parseErrorLogPath?: string;
-};
-export interface PersistStdinReportArgs {
-    /** The heredoc body: Understanding Report markdown. */
-    markdown: string;
-    /** Directory the approve flow lists reports from. */
-    reportsDir: string;
-    /** Resolved session id; stamped onto the persisted JSON. */
-    sessionId: string;
-    /** Clock injection for deterministic tests. */
-    now: Date;
-    /**
-     * Gap-fill mode default, used only when the report's own `**Metadata**`
-     * block declares none. Callers with pack-config context (the real
-     * `approve understanding` CLI path) should pass the harness-resolved
-     * mode (Env > config.mode > DEFAULT_MODE — see
-     * `resolveMode`/`toPackageMode` in
-     * policy-packs/builtin/understanding-before-execution.ts) so a report
-     * that omits `mode:` still gets validated against the operator's
-     * actually-configured mode instead of silently defaulting to
-     * `fast_confirm` regardless of `config.mode` (harness task 5d73d78d).
-     * Defaults to `"fast_confirm"` — the pre-fix behaviour — for callers
-     * without pack-config context.
-     */
-    mode?: UnderstandingGateMode;
-}
-/** Reports are a few KB; anything beyond this is not a report. */
-export declare const STDIN_REPORT_MAX_BYTES: number;
-export interface PipedStdinResult {
-    text: string;
-    /**
-     * True only when the stream ended cleanly within the size cap. A
-     * timeout with partial data, a stream error, or a size-cap hit all
-     * yield `complete: false` — the caller must NOT feed such text into
-     * the capture path, or a truncated-but-still-parseable report could
-     * be persisted and approved as if it were whole (review 2026-07-10).
-     */
-    complete: boolean;
-}
-/**
- * Read piped stdin fully, with a hang guard. The caller must already
- * have established that stdin is NOT a TTY. The timeout exists because
- * this read sits on the operator-approval path: if some harness wires
- * the CLI to an open-but-idle pipe, a blocked read here would brick
- * approvals — after `timeoutMs` we proceed with whatever arrived
- * (a real heredoc is delivered immediately by the shell), flagged
- * `complete: false`.
- */
-export declare function readPipedStdin(stream: NodeJS.ReadableStream, maxBytes?: number, timeoutMs?: number): Promise<PipedStdinResult>;
-export declare function persistStdinReport(args: PersistStdinReportArgs): StdinReportOutcome;

package/dist/cli/approve/stdin-report.js

@@ -1,145 +0,0 @@
-// Report capture for `harness approve understanding` (task 61fd36db).
-//
-// The Understanding Report arrives as a heredoc on the approve command's
-// stdin (see src/cli/pack/approve-escape.ts for why this is the only
-// channel that reliably carries it: the Stop-hook producer fires after
-// approve already ran, and current Claude Code builds do not reliably
-// persist mid-turn assistant text to the transcript JSONL). This module
-// parses the markdown with the canonical parser from
-// `@lannguyensi/understanding-gate` and persists it — session-bound and
-// `pending` — into the same reports directory the Stop hook targets, so
-// the approve flow's existing selection / validation / flip path picks
-// it up via a strict sessionId match.
-//
-// On parse failure it writes a parse-error log in the exact format the
-// standalone Stop hook uses (JSON header incl. sessionId, `--- raw ---`
-// separator, raw markdown), so `findLatestParseError` in
-// approve/understanding.ts surfaces the reason on the `report:` line
-// instead of a silent dead end.
-import * as path from "node:path";
-import { createHash } from "node:crypto";
-import { parseReport } from "@lannguyensi/understanding-gate";
-import { atomicWriteFile } from "../../io/atomic-write.js";
-/** Mirror of the standalone package's slug rule (persistence.ts). */
-function sanitizeSlug(raw) {
-    const cleaned = raw.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
-    return cleaned.slice(0, 40);
-}
-function summarizeParseError(error) {
-    if (error.message.length > 0)
-        return error.message;
-    const missing = error.missing.length > 0 ? ` (missing: ${error.missing.join(", ")})` : "";
-    return `${error.reason}${missing}`;
-}
-/** Reports are a few KB; anything beyond this is not a report. */
-export const STDIN_REPORT_MAX_BYTES = 512 * 1024;
-/**
- * Read piped stdin fully, with a hang guard. The caller must already
- * have established that stdin is NOT a TTY. The timeout exists because
- * this read sits on the operator-approval path: if some harness wires
- * the CLI to an open-but-idle pipe, a blocked read here would brick
- * approvals — after `timeoutMs` we proceed with whatever arrived
- * (a real heredoc is delivered immediately by the shell), flagged
- * `complete: false`.
- */
-export function readPipedStdin(stream, maxBytes = STDIN_REPORT_MAX_BYTES, timeoutMs = 2_000) {
-    return new Promise((resolve) => {
-        const chunks = [];
-        let length = 0;
-        let done = false;
-        const finish = (complete) => {
-            if (done)
-                return;
-            done = true;
-            clearTimeout(timer);
-            resolve({
-                text: Buffer.concat(chunks).toString("utf8"),
-                complete: complete && length <= maxBytes,
-            });
-        };
-        const timer = setTimeout(() => finish(false), timeoutMs);
-        // Let a finished CLI exit even if the timer is still pending.
-        timer.unref?.();
-        stream.on("data", (chunk) => {
-            if (done)
-                return;
-            if (length < maxBytes) {
-                const remaining = maxBytes - length;
-                chunks.push(chunk.length > remaining ? chunk.subarray(0, remaining) : chunk);
-            }
-            length += chunk.length;
-        });
-        stream.on("end", () => finish(true));
-        stream.on("error", () => finish(false));
-    });
-}
-export function persistStdinReport(args) {
-    // Defaults mirror the standalone Stop hook (handle-stop.ts): the
-    // report's own `**Metadata**` block wins for any field it declares;
-    // these only fill gaps. approvalStatus is forced to "pending" by
-    // parseReport regardless of input.
-    const result = parseReport(args.markdown, {
-        taskId: args.sessionId,
-        createdAt: args.now.toISOString(),
-        mode: args.mode ?? "fast_confirm",
-        riskLevel: "medium",
-    });
-    const stamp = args.now.toISOString().replace(/[:.]/g, "-");
-    if (!result.ok) {
-        const summary = summarizeParseError(result.error);
-        // Same side-channel location + format as the standalone Stop hook:
-        // <reportsDir>/../parse-errors/<stamp>.log with a JSON header that
-        // carries sessionId (findLatestParseError skips logs it cannot
-        // attribute to the approving session).
-        const parseErrorDir = path.join(path.dirname(args.reportsDir), "parse-errors");
-        const malformedSections = result.error.malformedSections ?? [];
-        const payload = `${JSON.stringify({
-            reason: result.error.reason,
-            missing: result.error.missing,
-            malformedSections,
-            schemaErrors: result.error.schemaErrors,
-            message: result.error.message,
-            stamp,
-            sessionId: args.sessionId,
-            source: "harness-approve-stdin",
-        }, null, 2)}\n\n--- raw ---\n${args.markdown}\n`;
-        let parseErrorLogPath;
-        try {
-            parseErrorLogPath = path.join(parseErrorDir, `${stamp}.log`);
-            atomicWriteFile(parseErrorLogPath, payload);
-        }
-        catch {
-            // Best-effort side channel; the loud `stdin:` line still names the
-            // parse failure even when the log write itself fails.
-            parseErrorLogPath = undefined;
-        }
-        return {
-            ok: false,
-            reason: `report on stdin did not parse: ${summary}`,
-            ...(parseErrorLogPath !== undefined ? { parseErrorLogPath } : {}),
-        };
-    }
-    // The standalone package's saveReport cannot be used here: its
-    // canonical serializer whitelists the schema keys and would strip the
-    // sessionId binding, which is exactly what makes the approve flow's
-    // strict match (and the tier-6 session-id fallback) work. Persist the
-    // same JSON shape plus `sessionId`, with the package's filename
-    // convention (<isoStamp>-<slug>-<hash8>.json) so directory listings
-    // read uniformly.
-    const persisted = { ...result.report, sessionId: args.sessionId };
-    const json = `${JSON.stringify(persisted, null, 2)}\n`;
-    const hash = createHash("sha256").update(json).digest("hex").slice(0, 8);
-    const slug = sanitizeSlug(result.report.taskId) || "report";
-    const filePath = path.join(args.reportsDir, `${stamp}-${slug}-${hash}.json`);
-    try {
-        atomicWriteFile(filePath, json);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            reason: `report parsed but could not be persisted to ${filePath}: ${err.message}`,
-        };
-    }
-    return { ok: true, filePath };
-}
-//# sourceMappingURL=stdin-report.js.map

package/dist/cli/approve/stdin-report.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stdin-report.js","sourceRoot":"","sources":["../../../src/cli/approve/stdin-report.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,qDAAqD;AACrD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,yDAAyD;AACzD,qEAAqE;AACrE,gCAAgC;AAEhC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAA8B,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA+B3D,qEAAqE;AACrE,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IACC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;AACrC,CAAC;AAmBD,kEAAkE;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAcjD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,WAAmB,sBAAsB,EACzC,SAAS,GAAG,KAAK;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,QAAiB,EAAQ,EAAE;YACzC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5C,QAAQ,EAAE,QAAQ,IAAI,MAAM,IAAI,QAAQ;aACzC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,8DAA8D;QAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAA4B;IAC7D,iEAAiE;IACjE,oEAAoE;IACpE,iEAAiE;IACjE,mCAAmC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,IAAI,CAAC,SAAS;QACtB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,cAAc;QACjC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/E,MAAM,iBAAiB,GACpB,MAAM,CAAC,KAAyC,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAC/B;YACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,iBAAiB;YACjB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YACvC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,uBAAuB;SAChC,EACD,IAAI,EACJ,CAAC,CACF,oBAAoB,IAAI,CAAC,QAAQ,IAAI,CAAC;QACvC,IAAI,iBAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;YAC7D,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,sDAAsD;YACtD,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kCAAkC,OAAO,EAAE;YACnD,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,gEAAgE;IAChE,oEAAoE;IACpE,kBAAkB;IAClB,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+CAA+C,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}