@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/hook-codex-post-tool-use.js

@@ -1,160 +0,0 @@
-// Task a1348c89 — `harness pack hook codex-post-tool-use` runtime verb.
-//
-// Codex sibling of the Claude Code marker-expiry hook
-// (hook-post-tool-use.ts): when the just-completed tool matches the
-// pack's `config.approval_lifecycle.expire_on_tool_match` /
-// `expire_on_bash_match` boundaries, clears the per-session (and, when
-// applicable, per-task) approval marker and expires the persisted
-// report, so the next Edit/apply_patch/Bash forces a fresh Understanding
-// Report. Before this hook existed, Codex sessions had NO PostToolUse
-// wiring at all (docs/okf/codex-adapter-parity-gaps.md gap #1) — an
-// approval only ever died via `approval_lifecycle.max_age` or a manual
-// `rm`, no matter how many tasks the session completed.
-//
-// Codex hook-surface finding (verified against the published Codex
-// hooks reference, developers.openai.com/codex/hooks, current as of
-// this task): `PostToolUse` IS a first-class Codex hook event —
-// `[[hooks.PostToolUse]]` with a `matcher` on `tool_name`, stdin payload
-// carrying `session_id`, `tool_name`, `tool_input`, `tool_response`, and
-// an allow/exit-0 or block/exit-2-with-stderr-reason contract identical
-// in shape to Claude Code's. `generate-codex-config.ts`'s `eventKey`
-// already mapped `"PostToolUse"` to the TOML table key `PostToolUse`
-// (added in #211 alongside the real `PreToolUse`/`Stop`/
-// `UserPromptSubmit` mappings) — the adapter could already EMIT this
-// hook group, it was simply never contributed by the pack. This file
-// closes that gap.
-//
-// Wire format on stdin: same generic envelope the sibling Codex hooks
-// read (`{ session_id?, tool_name?, tool?, tool_input?, raw_input?,
-// event? }`, docs/policy-packs/understanding-before-execution.md
-// "Adapter notes / Codex"). `tool_input` is tried first (the field name
-// real Codex sends, matching Claude Code's own convention); `raw_input`
-// is accepted as a fallback for any shim built against harness's
-// originally-published portable format (Phase 6 #6, when Codex's hook
-// contract was not yet documented/stable).
-//
-// Matching + clearing logic is shared with the Claude hook via
-// `matchPostToolUseBoundary` / `applyPostToolUseExpiry`
-// (understanding-before-execution-runtime.ts) — a hand-copied duplicate
-// here would repeat the exact Claude/Codex drift class task e7c2ec3c
-// fixed on the PreToolUse side.
-//
-// Failure mode: every error path resolves to no-op + stderr diagnostic,
-// exit 0. This hook never blocks — expiry is advisory cleanup, not a
-// gate; a buggy pause/config/manifest state must degrade to "marker
-// persists past the intended boundary" (the legacy per-session
-// contract), never to a blocked tool call.
-import { applyPostToolUseExpiry, defaultReportsDir, describePostToolUseExpiry, describePostToolUseTrigger, matchPostToolUseBoundary, parseApprovalLifecycle, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
-import { CODEX_SHELL_TOOLS } from "./hook-codex-pre-tool-use.js";
-import { checkHookPause, loadManifestOrInjected, pickString, readStdin, } from "./hook-bootstrap.js";
-const PACK_NAME = "understanding-before-execution";
-/** Prefer `tool_input` (the field name real Codex sends; matches Claude
- * Code's own convention) and fall back to `raw_input` (harness's
- * originally-published portable wire format, docs/policy-packs/
- * understanding-before-execution.md "Adapter notes / Codex") for any
- * shim still emitting the older shape. */
-function resolveToolInput(event) {
-    if (event.tool_input !== undefined)
-        return event.tool_input;
-    return event.raw_input;
-}
-function noop(diagnostic, stderr) {
-    stderr.write(`${diagnostic}\n`);
-    return {
-        exitCode: 0,
-        matchedExpiry: false,
-        markerCleared: false,
-        taskMarkerCleared: false,
-        persistedReportExpired: false,
-        diagnostic,
-    };
-}
-export async function runPackHookCodexPostToolUseCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const packName = opts.pack ?? PACK_NAME;
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        return noop("harness pack hook codex-post-tool-use: malformed event JSON, skipping marker expiry", stderr);
-    }
-    // Pause sentinel — skip marker expiry while paused, mirroring the
-    // Claude sibling, so a debug A/B-test does not silently invalidate
-    // the operator's approval state.
-    if (checkHookPause("codex-post-tool-use", stderr, opts, opts.generatedDir).paused) {
-        return noop("harness paused; codex-post-tool-use skipping marker expiry without evaluating.", stderr);
-    }
-    const sessionId = pickString(event.session_id) ??
-        process.env["CODEX_SESSION_ID"] ??
-        process.env["CLAUDE_CODE_SESSION_ID"] ??
-        process.env["CLAUDE_SESSION_ID"] ??
-        "";
-    const toolName = pickString(event.tool_name, event.tool) ?? "";
-    if (sessionId === "" || toolName === "") {
-        return noop(`harness pack hook codex-post-tool-use: missing session_id (${sessionId === "" ? "absent" : "ok"}) or tool_name (${toolName === "" ? "absent" : "ok"}), skipping`, stderr);
-    }
-    let manifest;
-    let manifestPath;
-    try {
-        ({ manifest, manifestPath } = loadManifestOrInjected(opts, opts.manifest));
-    }
-    catch (err) {
-        return noop(`harness pack hook codex-post-tool-use: manifest load failed (${err.message}), skipping`, stderr);
-    }
-    const declared = manifest.policy_packs.find((p) => p.name === packName);
-    if (!declared) {
-        return noop(`harness pack hook codex-post-tool-use: pack "${packName}" not declared in manifest, skipping`, stderr);
-    }
-    if (!declared.enabled) {
-        return noop(`harness pack hook codex-post-tool-use: pack "${packName}" is enabled:false, skipping`, stderr);
-    }
-    const lifecycle = parseApprovalLifecycle(declared.config["approval_lifecycle"], stderr);
-    if (lifecycle.legacyMode) {
-        return noop(`harness pack hook codex-post-tool-use: legacy-session mode, skipping`, stderr);
-    }
-    const noBoundariesConfigured = lifecycle.expireOnToolMatch.length === 0 && lifecycle.expireOnBashMatch.length === 0;
-    if (noBoundariesConfigured) {
-        return noop(`harness pack hook codex-post-tool-use: no expire_on_tool_match or expire_on_bash_match configured, skipping`, stderr);
-    }
-    const toolInput = resolveToolInput(event);
-    // Codex's shell surface has several accepted tool-name aliases
-    // (Bash/shell/exec_command/functions.exec_command, same set the
-    // sibling PreToolUse blocker treats as shell-equivalent); any of
-    // those counts as "the Bash tool" for expire_on_bash_match.
-    const boundary = matchPostToolUseBoundary(toolName, toolInput, lifecycle, CODEX_SHELL_TOOLS, event.tool_response);
-    if (!boundary.matched) {
-        const detail = !boundary.rawToolNameMatched
-            ? CODEX_SHELL_TOOLS.has(toolName)
-                ? `Bash command did not match any expire_on_bash_match regex`
-                : `tool ${toolName} not in expire_on_tool_match`
-            : `${toolName} keeps the work claim per the active-claim decider`;
-        return noop(`harness pack hook codex-post-tool-use: ${detail}, skipping`, stderr);
-    }
-    const generatedDir = opts.generatedDir ??
-        (manifestPath !== undefined
-            ? resolveGeneratedDir({
-                ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-                manifestPath,
-            })
-            : undefined);
-    if (generatedDir === undefined) {
-        return noop("harness pack hook codex-post-tool-use: generatedDir unresolvable, skipping marker expiry", stderr);
-    }
-    const reportsDir = opts.reportsDir ?? defaultReportsDir();
-    const expiry = applyPostToolUseExpiry(generatedDir, sessionId, toolInput, boundary.toolNameMatched, reportsDir, opts.now, describePostToolUseTrigger(toolName, boundary));
-    const diagnostic = describePostToolUseExpiry("harness pack hook codex-post-tool-use", sessionId, toolName, boundary.bashRegex, expiry);
-    stderr.write(`${diagnostic}\n`);
-    return {
-        exitCode: 0,
-        matchedExpiry: true,
-        markerCleared: expiry.wasMarkerPresent,
-        taskMarkerCleared: expiry.taskMarkerCleared,
-        persistedReportExpired: expiry.persistedReportExpired,
-        diagnostic,
-    };
-}
-//# sourceMappingURL=hook-codex-post-tool-use.js.map

package/dist/cli/pack/hook-codex-post-tool-use.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-codex-post-tool-use.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-codex-post-tool-use.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,sDAAsD;AACtD,oEAAoE;AACpE,4DAA4D;AAC5D,uEAAuE;AACvE,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,uEAAuE;AACvE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,gEAAgE;AAChE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AACrE,qEAAqE;AACrE,yDAAyD;AACzD,qEAAqE;AACrE,qEAAqE;AACrE,mBAAmB;AACnB,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,2CAA2C;AAC3C,EAAE;AACF,+DAA+D;AAC/D,wDAAwD;AACxD,wEAAwE;AACxE,qEAAqE;AACrE,gCAAgC;AAChC,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,+DAA+D;AAC/D,2CAA2C;AAE3C,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAsCnD;;;;0CAI0C;AAC1C,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAC5D,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAwC,EAAE;IAE1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAuB,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,qFAAqF,EACrF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,iCAAiC;IACjC,IAAI,cAAc,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAClF,OAAO,IAAI,CACT,gFAAgF,EAChF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CACT,8DAA8D,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,mBAAmB,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,aAAa,EACjK,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,gEAAiE,GAAa,CAAC,OAAO,aAAa,EACnG,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,gDAAgD,QAAQ,sCAAsC,EAC9F,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,gDAAgD,QAAQ,8BAA8B,EACtF,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACrC,QAAQ,CAAC,MAAkC,CAAC,oBAAoB,CAAC,EAClE,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,sEAAsE,EACtE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACvF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,6GAA6G,EAC7G,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,gEAAgE;IAChE,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,wBAAwB,CACvC,QAAQ,EACR,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB;YACzC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC/B,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,QAAQ,QAAQ,8BAA8B;YAClD,CAAC,CAAC,GAAG,QAAQ,oDAAoD,CAAC;QACpE,OAAO,IAAI,CACT,0CAA0C,MAAM,YAAY,EAC5D,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,mBAAmB,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,YAAY;aACb,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,0FAA0F,EAC1F,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,sBAAsB,CACnC,YAAY,EACZ,SAAS,EACT,SAAS,EACT,QAAQ,CAAC,eAAe,EACxB,UAAU,EACV,IAAI,CAAC,GAAG,EACR,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;IAEF,MAAM,UAAU,GAAG,yBAAyB,CAC1C,uCAAuC,EACvC,SAAS,EACT,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,MAAM,CACP,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,MAAM,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-codex-pre-tool-use.d.ts

@@ -1,48 +0,0 @@
-import { type LedgerEntry } from "../../policies/index.js";
-import { type ApprovalCheckResult } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { type LedgerWriteFn } from "../../runtime/ledger-writer.js";
-import { type Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookCodexPreToolUseOptions extends LoaderOptions {
-    /** Pack name to evaluate. Defaults to understanding-before-execution. */
-    pack?: string;
-    /** Override report directory (test injection). */
-    reportsDir?: string;
-    /** Override harness.generated/ directory (test injection). */
-    generatedDir?: string;
-    /** Override timeout per ledger call. */
-    ledgerTimeoutMs?: number;
-    /** Defaults to process.stdin. */
-    stdin?: NodeJS.ReadableStream;
-    /** Defaults to process.stderr. */
-    stderr?: NodeJS.WritableStream;
-    /** Inject an alternate manifest (test). */
-    manifest?: Manifest;
-    /** Inject a fake ledger query (test). */
-    ledgerQuery?: (sessionId: string) => Promise<LedgerEntry[] | {
-        degraded: string;
-    }>;
-    /**
-     * Inject the audit-only ledger WRITER that the auto-approval path
-     * records its fact through (test injection). Mirrors the Claude
-     * hook's option of the same name. Absent, the writer is resolved from
-     * the manifest, lazily, and only on a call that already passed the
-     * opt-in, `harnesses` and `when` checks.
-     */
-    writeLedger?: LedgerWriteFn;
-}
-export interface PackHookCodexPreToolUseResult {
-    exitCode: number;
-    blocked: boolean;
-    approvalCheck: ApprovalCheckResult;
-    /** Diagnostic line emitted to stderr (always; even on allow). */
-    diagnostic: string;
-}
-export declare const CODEX_SHELL_TOOLS: ReadonlySet<string>;
-/**
- * `harness pack hook codex-pre-tool-use`. A timed-out stdin read exits 2 with
- * the reason on stderr (the runtime's deny form) instead of running the gate on
- * an empty or truncated event it would allow (task 7dfdcaaf). The operator
- * pause still wins; every other input runs the gate unchanged.
- */
-export declare function runPackHookCodexPreToolUseCli(opts?: PackHookCodexPreToolUseOptions): Promise<PackHookCodexPreToolUseResult>;