@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/approve-escape.d.ts

@@ -1,19 +0,0 @@
-export interface ApproveReportHeredoc {
-    /** The executable command part (first line, heredoc intro stripped). */
-    command: string;
-    /** The heredoc delimiter word. */
-    delimiter: string;
-    /** The heredoc body — the Understanding Report markdown. */
-    body: string;
-}
-/**
- * Parse the report-heredoc shape. Returns null unless the WHOLE command
- * is exactly one clean `harness approve ...` line plus one single-quoted
- * heredoc and nothing else.
- */
-export declare function parseApproveReportHeredoc(command: string): ApproveReportHeredoc | null;
-/**
- * The operator-approval command `harness approve ...`. See module
- * header for the accepted shapes and the rationale for strictness.
- */
-export declare function isEscapeCommand(command: string): boolean;

package/dist/cli/pack/approve-escape.js

@@ -1,190 +0,0 @@
-// Escape-command matcher for the understanding-gate PreToolUse hook.
-//
-// The operator-approval command `harness approve ...` must not be
-// hard-denied by the gate (denying the unblock surface makes the gate
-// un-recoverable from inside the session), so the hook defers it to the
-// interactive permission prompt instead. This module decides what
-// qualifies. Deliberately strict: anything that could smuggle other work
-// past the gate (chaining, substitution, redirection) is rejected.
-//
-// Two accepted shapes:
-//   1. Single line: `harness approve ...` with no shell metacharacters.
-//   2. Report heredoc (task 61fd36db): the same command with the
-//      Understanding Report attached as a quoted heredoc on stdin:
-//
-//        harness approve understanding <<'UNDERSTANDING_REPORT'
-//        ## Understanding Report
-//        ...
-//        UNDERSTANDING_REPORT
-//
-//      This is the report-capture channel for the interactive/operator
-//      path: the Stop-hook producer fires only at END of turn (after
-//      approve already ran), and current Claude Code builds do not
-//      reliably persist mid-turn assistant text to the transcript
-//      JSONL within the same instant this hook fires, so the command
-//      itself is the only channel that reliably carries the report to
-//      `harness approve understanding` for a human reading the prompt
-//      right now. As a bonus the operator reads the full report inside
-//      the permission prompt before approving.
-//
-//      Under `-p` (no operator to read a prompt), slice 3's delegation
-//      path does not depend on this heredoc: the report lands in the
-//      transcript shortly afterwards, within a bounded poll window, and
-//      the child's own PreToolUse hook polls for it there instead (see
-//      `docs/okf/understanding-gate-auto-mode-signals.md`, "Chosen
-//      `report_scan.max_wait` default").
-//
-// Heredoc safety: the delimiter must be single-quoted (no parameter or
-// command substitution inside the body), the command part before `<<`
-// must match a strict character WHITELIST (so no quoting/escaping trick
-// can change how the shell tokenizes the line — see
-// heredocCommandPartIsClean), the terminator is the FIRST line exactly
-// equal to the delimiter (mirroring shell semantics for a plain `<<'X'`
-// intro, which the whitelist guarantees is the only intro that can
-// reach it), and nothing but whitespace may follow it. Any deviation —
-// unquoted delimiter, second redirect, escaped/quote-obscured intro,
-// trailing commands, unterminated body — fails closed to the ordinary
-// gate block.
-/** Metacharacters rejected in the executable (non-heredoc-body) part. */
-const COMMAND_META_RE = /[;&|<>]/;
-// bash's actual lexical blank set: SPACE and TAB, nothing else.
-// Ground-truthed against GNU bash with a PATH-stub harness (task
-// 623640a5): of the 25 codepoints JS's generic `\s` class matches, only
-// these two are stripped by bash as an insignificant separator between
-// tokens on a line. Setting LF and CR aside (see below), the remaining
-// 21 (NBSP U+00A0 and 18 further Unicode space-separator/line-separator/
-// BOM codepoints; VT/FF too) glue onto the adjacent token as an ordinary
-// word-constituent character instead. `\s` used to accept those
-// characters here as if bash agreed they were whitespace, which let a
-// report heredoc's delimiter word, as bash actually reads it, diverge
-// from the word this matcher extracts (see `parseApproveReportHeredoc`
-// below for the exploitable shape that produced). Every regex in this
-// module that means "a separator bash will actually treat as blank
-// here" uses `[ \t]`, never `\s`. LF and CR (the last 2 of the 23
-// non-bash-blank codepoints) are deliberately excluded from this class:
-// LF already splits lines before any of these regexes run, and CR is
-// rejected by an explicit check in both callers, so neither needs
-// blank-class treatment here. (25 total - 2 bash blanks = 23 non-bash-
-// blank; 23 - 2 LF/CR = 21 = 1 NBSP + 18 further + 2 VT/FF; enumeration
-// and exact figures pinned in tests/cli/pack-approve-escape.test.ts.)
-function commandPartIsClean(part) {
-    if (COMMAND_META_RE.test(part))
-        return false;
-    if (part.includes("`") || part.includes("$("))
-        return false;
-    return /^harness[ \t]+approve\b/.test(part);
-}
-// The heredoc command part is held to a WHITELIST, not the blacklist
-// above (review 2026-07-10, HIGH): a backslash-escaped redirect
-// (`harness approve understanding \<<'UR'`) slipped the blacklist —
-// the `<` characters were consumed by the heredoc-intro regex and `\`
-// is not a rejected metachar — but bash reads `\<` as a literal `<`
-// plus a file redirect, so no heredoc exists and the "body" lines
-// execute as ordinary commands. A legitimate approve command part only
-// ever contains the binary name, subcommand, flags, ids, and paths;
-// everything else (backslashes, quotes, `$`, parens, globs) fails
-// closed. The single-line shape keeps the blacklist for back-compat:
-// it admits no `<` at all, so this divergence class cannot arise there.
-const HEREDOC_COMMAND_PART_ALLOWED_RE = /^[A-Za-z0-9_ \t,./=:@~-]*$/;
-function heredocCommandPartIsClean(part) {
-    if (!HEREDOC_COMMAND_PART_ALLOWED_RE.test(part))
-        return false;
-    return commandPartIsClean(part);
-}
-// Top-level boundary trim for the whole incoming command, used by both
-// `isEscapeCommand` and `parseApproveReportHeredoc` before any parsing
-// starts. MUST NOT be the generic `.trim()` (task 508a2d81, residual of
-// 623640a5): `.trim()` strips every JS `\s` codepoint from the string's
-// edges, which deletes a TRAILING line made only of a non-bash-blank
-// whitespace codepoint (NBSP, U+2028, VT, FF, ...) before the
-// `after.every(/^[ \t]*$/)` check a few lines below ever gets to see it
-// — making that check unreachable through the public API for exactly the
-// shape it exists to reject. Only TAB (0x09), SPACE (0x20), LF (0x0A),
-// and CR (0x0D) are stripped here, and that is provably safe: TAB/SPACE
-// are bash's actual lexical blanks (see the comment above
-// `commandPartIsClean`), and a boundary run made of nothing but LF/CR
-// can never hide non-blank content — it only ever produces additional,
-// already-inert empty lines (LF is the line separator the module splits
-// on; CR is independently rejected wherever it appears, mid-string or
-// not, by the explicit `\r` checks in both callers below). Every OTHER
-// `\s` codepoint is left untouched so it survives to the after-check
-// (or, for a leading occurrence, so it correctly fails the strict
-// `harness[ \t]+approve` / heredoc-intro matching instead of being
-// silently normalized away as if it were insignificant).
-function trimCommandBoundary(command) {
-    return command.replace(/^[ \t\r\n]+/, "").replace(/[ \t\r\n]+$/, "");
-}
-/**
- * Parse the report-heredoc shape. Returns null unless the WHOLE command
- * is exactly one clean `harness approve ...` line plus one single-quoted
- * heredoc and nothing else.
- */
-export function parseApproveReportHeredoc(command) {
-    const trimmed = trimCommandBoundary(command);
-    const nl = trimmed.indexOf("\n");
-    if (nl === -1)
-        return null;
-    const head = trimmed.slice(0, nl);
-    // CR anywhere in the head means the line structure is not what the
-    // shell will see; fail closed. (Body CRs are inert data.)
-    if (head.includes("\r"))
-        return null;
-    // Lazy `.*?` + end-anchor: a second redirect after the heredoc intro
-    // forces the intro into the command part, where the metachar check
-    // rejects it. `[ \t]*` (not `\s*`) around the delimiter word: see the
-    // bash-blank comment above `commandPartIsClean` (task 623640a5): a
-    // non-bash-blank character here (e.g. NBSP) used to be accepted as
-    // insignificant trailing/leading whitespace, while bash actually glues
-    // it onto the quoted word, widening the REAL heredoc delimiter beyond
-    // what this capture group extracts and letting a body line close the
-    // heredoc a line early.
-    const m = /^(.*?)<<[ \t]*'([A-Z_][A-Z0-9_]*)'[ \t]*$/.exec(head);
-    if (!m)
-        return null;
-    // [ \t]-only right-trim (not the generic .trimEnd(), which strips every
-    // JS `\s` codepoint): a non-bash-blank character immediately before
-    // `<<` must reach heredocCommandPartIsClean's whitelist so it gets
-    // rejected there, not be silently stripped away first as if it were an
-    // insignificant separator bash would also treat as blank (task
-    // 623640a5 review). See the bash-blank comment above
-    // `commandPartIsClean`.
-    const commandPart = m[1].replace(/[ \t]*$/, "");
-    const delimiter = m[2];
-    if (!heredocCommandPartIsClean(commandPart))
-        return null;
-    const rest = trimmed.slice(nl + 1).split("\n");
-    // First line EXACTLY equal to the delimiter terminates the body — the
-    // same rule the shell applies — so a delimiter line smuggled early in
-    // the body shifts the terminator up and the trailing content check
-    // below rejects the command as a whole.
-    const termIdx = rest.findIndex((line) => line === delimiter);
-    if (termIdx === -1)
-        return null;
-    const after = rest.slice(termIdx + 1);
-    // [ \t]-only blank check (not the generic .trim(), which treats every
-    // JS `\s` codepoint as blank): a post-terminator line made only of
-    // non-bash-blank whitespace (e.g. NBSP, U+2028) is NOT inert to bash.
-    // PATH-stub-verified (task 623640a5 review) that bash actually looks
-    // up and attempts to execute such a line as a real command.
-    if (!after.every((line) => /^[ \t]*$/.test(line)))
-        return null;
-    return {
-        command: commandPart,
-        delimiter,
-        body: rest.slice(0, termIdx).join("\n"),
-    };
-}
-/**
- * The operator-approval command `harness approve ...`. See module
- * header for the accepted shapes and the rationale for strictness.
- */
-export function isEscapeCommand(command) {
-    const trimmed = trimCommandBoundary(command);
-    if (!trimmed.includes("\n")) {
-        if (trimmed.includes("\r"))
-            return false;
-        return commandPartIsClean(trimmed);
-    }
-    return parseApproveReportHeredoc(trimmed) !== null;
-}
-//# sourceMappingURL=approve-escape.js.map

package/dist/cli/pack/approve-escape.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approve-escape.js","sourceRoot":"","sources":["../../../src/cli/pack/approve-escape.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,mEAAmE;AACnE,EAAE;AACF,uBAAuB;AACvB,wEAAwE;AACxE,iEAAiE;AACjE,mEAAmE;AACnE,EAAE;AACF,gEAAgE;AAChE,iCAAiC;AACjC,aAAa;AACb,8BAA8B;AAC9B,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,yCAAyC;AACzC,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,oDAAoD;AACpD,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,cAAc;AAEd,yEAAyE;AACzE,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC,gEAAgE;AAChE,iEAAiE;AACjE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,qEAAqE;AACrE,gEAAgE;AAChE,oEAAoE;AACpE,sEAAsE;AACtE,oEAAoE;AACpE,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,kEAAkE;AAClE,qEAAqE;AACrE,wEAAwE;AACxE,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAErE,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,8DAA8D;AAC9D,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,0DAA0D;AAC1D,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,yDAAyD;AACzD,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe;IAEf,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,mEAAmE;IACnE,0DAA0D;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,wBAAwB;IACxB,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,+DAA+D;IAC/D,qDAAqD;IACrD,wBAAwB;IACxB,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACtC,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,yBAAyB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/cli/pack/auto-approve-path.d.ts

@@ -1,146 +0,0 @@
-import type { LedgerWriteFn } from "../../runtime/ledger-writer.js";
-/**
- * Source string the CLAUDE CODE hook records on the audit-only ledger
- * fact — the verb that actually made the write.
- */
-export declare const AUTO_APPROVE_LEDGER_SOURCE = "harness-pack-hook-pre-tool-use";
-/**
- * The Codex hook's counterpart. A shared body must not stamp the Claude
- * verb on a Codex write: the ledger fact is an audit surface, and an
- * auditor reading `harness-pack-hook-pre-tool-use` on a Codex session
- * would be reading a fact about a hook that never ran (reviewer round-1
- * finding on slice 2). The `approvedBy` segment already distinguishes
- * the runtimes; this makes the ledger row agree with it.
- */
-export declare const AUTO_APPROVE_LEDGER_SOURCE_CODEX = "harness-pack-hook-codex-pre-tool-use";
-/**
- * Which second input the payload's own `session_id` is held against
- * (ADR hardening item 1), chosen by the calling hook because the
- * evidence a runtime actually provides differs:
- *
- * - `env`: the hook process carries the harness's session id in an
- *   environment variable (`$CLAUDE_CODE_SESSION_ID` for Claude Code).
- *   The payload field must equal it.
- * - `transcript-path`: the payload names the session's transcript file
- *   and the hook checks that the NAME carries this session id and that
- *   the path resolves to an existing regular file (Codex, which carries
- *   no session-id environment variable at all).
- *
- * NEITHER IS A SECURITY BOUNDARY, and the comments inside the check say
- * so. Both are CONSISTENCY checks of the same class: an agent that can
- * compose the payload can compose both fields, and on Codex it can also
- * create a file through Bash. What they buy is that a forgery has to
- * fake two agreeing inputs (plus, on Codex, a file at the named path)
- * instead of one, and that the mismatch is forensically distinct in the
- * stderr trail.
- */
-export type SessionConsistencyCheck = {
-    kind: "env";
-    variable: string;
-} | {
-    kind: "transcript-path";
-    transcriptPath: unknown;
-};
-export interface AutoApproveAttemptArgs {
-    /** `harness.generated/`; `undefined` when it could not be resolved (injected-manifest test path). */
-    generatedDir: string | undefined;
-    /** The hook's resolved session id (equals `payloadSessionId` on every path that can succeed). */
-    sessionId: string;
-    /** RAW `session_id` from the event payload — NOT the env fallback (hardening item 1). */
-    payloadSessionId: unknown;
-    /** RAW `permission_mode` from the event payload. */
-    permissionMode: unknown;
-    /**
-     * Harness identifier baked into the minted marker's `approvedBy`
-     * (`auto-mode:<harness>:<mode>`). `CLAUDE_CODE_HARNESS` from the
-     * Claude Code hook, `CODEX_HARNESS` from the Codex hook.
-     */
-    harness: string;
-    /**
-     * Source string for the audit-only ledger fact: the calling hook's own
-     * verb ({@link AUTO_APPROVE_LEDGER_SOURCE} /
-     * {@link AUTO_APPROVE_LEDGER_SOURCE_CODEX}).
-     */
-    ledgerSource: string;
-    /**
-     * stderr prefix for every line this path writes, so a Codex-side
-     * diagnostic reads `harness pack hook codex: ...` like the rest of
-     * that hook's output. Defaults to the Claude Code hook's prefix.
-     */
-    label?: string;
-    /** Which session-consistency evidence this runtime offers; see {@link SessionConsistencyCheck}. */
-    sessionConsistency: SessionConsistencyCheck;
-    /** The pack's `config` block, unparsed. */
-    packConfig: unknown;
-    /** Persisted-report directory. */
-    reportsDir: string;
-    /** Step 3's verdict: a marker FILE existed and failed signature verification. */
-    markerForged: boolean;
-    /**
-     * Names WHICH artifact tripped `markerForged` above, so the decline
-     * diagnostic can say what was actually forged instead of always saying
-     * "marker" (review finding: the flag already folds a forged in-flight
-     * subagent record into `markerForged`, but the wording never said so).
-     * Optional and defaults to `"marker"` when `markerForged` is true and
-     * this is omitted, matching the wording every caller produced before
-     * this field existed — the Codex hook still passes only `markerForged`
-     * and is unaffected.
-     */
-    forgedKind?: "marker" | "inflight";
-    /**
-     * Slice 3 (agent-tasks 37ad0b05, ADR "Decision: two-key design"): a
-     * VALID, unexpired, cwd/task-matching delegation the calling hook has
-     * already verified for this child session. Present means key one is
-     * satisfied by the delegation instead of by a `when`-listed
-     * `permission_mode`, so a `-p` child whose payload carries `default`
-     * (or no mode at all) can still reach the report check.
-     *
-     * It is a PRE-AUTHORIZATION, not an approval: every other condition in
-     * this function stays exactly as it was, key two (the child's own
-     * `pending` report) very much included. The caller is responsible for
-     * the verification; this function never reads a delegation file
-     * itself, so there is no second, weaker verifier to keep in sync.
-     */
-    delegation?: {
-        parentSessionId: string;
-    };
-    stderr: {
-        write(s: string): void;
-    };
-    /**
-     * Audit-only ledger writer, resolved LAZILY: called only after the
-     * opt-in (`auto_approve` parses) and the `when` allowlist have both
-     * passed, i.e. only on a call that could actually reach the ledger
-     * write later in this function. Every earlier decline (opt-in absent,
-     * mode not allowlisted, forged marker, session mismatch, key absent,
-     * report not eligible) never invokes this thunk, so an unconfigured or
-     * expensive ledger resolution costs nothing on the overwhelming
-     * majority of gated calls that never opted in. `write: null` means
-     * the ledger is unreachable (no `grounding-mcp` in the manifest, or
-     * the caller chose not to resolve one); the auto path then logs one
-     * line and continues. The ledger is never a gate input.
-     */
-    resolveLedger: () => {
-        write: LedgerWriteFn | null;
-        reason?: string;
-    };
-}
-export type AutoApproveAttempt = {
-    approved: true;
-    /** `checkOperatorApprovalMarkers` detail for the freshly written marker. */
-    detail: string;
-    /** `auto-mode:<harness>:<mode>` as written into the signed marker. */
-    approvedBy: string;
-    markerPath: string;
-    reportPath: string;
-    reportContentHash: string;
-} | {
-    approved: false;
-    reason: string;
-};
-/**
- * Attempt the operator-opted-in auto-approval for this PreToolUse call.
- * See the module header for placement and the fail-closed contract; the
- * numbered steps below are conditions 1-6 of the ADR's Option A.
- */
-export declare function attemptAutoApproval(args: AutoApproveAttemptArgs): Promise<AutoApproveAttempt>;