@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/hook-solution-acceptance-writeguard.js

@@ -1,337 +0,0 @@
-// `harness pack hook solution-acceptance-writeguard` — PreToolUse
-// anti-forgery write-guard for the `solution-acceptance` policy pack.
-//
-// This is the load-bearing closure of the gate. The completion-gate alone
-// is forgeable: relocating the verdict dir does NOT help because
-// understanding-gate allows all Bash once approved, so an approved agent
-// could `echo '{...ready:true}' > <verdict-dir>/<id>.json` and walk the gate.
-// This hook restores the invariant that the ONLY writer of the verdict dir
-// is the producer (the operator-launched grounding-mcp MCP server, which
-// runs real preflight and does not flow through the agent's gated tools).
-//
-// It denies, on the agent's tool surface:
-//   - Write / Edit / MultiEdit / NotebookEdit whose target file resolves
-//     inside the verdict dir.
-//   - Codex `apply_patch` whose patch body references the verdict dir.
-//   - Bash that is NOT provably read-only AND references the verdict dir
-//     (covers `echo >`, `$SOLUTION_VERDICT_DIR` spellings, `tee`, `mv`/`cp`/
-//     `ln`/`install`, `python3 -c '...path...'`, and `chmod`/`chattr` that
-//     would loosen perms) — or whose shell cwd is inside the dir.
-//     Merely NAMING one of the pack's own source files (its doc, hook,
-//     runtime module or tests) is not a reference: `bashReferencesVerdictDir`
-//     scrubs the pack name out of plain words before its glob/brace
-//     leaf-word scan (task e8c9edaf; skipped when the command carries
-//     runtime-construction syntax), so editing those files from the shell
-//     is allowed while a command that also reaches the dir stays blocked.
-//   - Bash `cd` whose RESOLVED target is inside the verdict dir. `cd` itself
-//     is provably read-only (task fb67b402 added it to the shared
-//     read-only-bash floor: it mutates only the invoking shell's own cwd,
-//     never the filesystem), so it no longer reaches the "not read-only"
-//     checks below. But stepping into the dir is the setup half of a
-//     two-call forge (`cd <dir>` then, in a LATER un-chained Bash call,
-//     a bare relative write): this pre-check keeps that first step blocked
-//     as defense-in-depth, ahead of (not instead of) the cwd-inside check
-//     below, which is what actually closes the later relative-write call
-//     once cwd has genuinely moved. A `cd` target that `path.resolve`
-//     cannot literally evaluate does NOT get `cd`'s read-only fast path
-//     either: it falls through to the same reference-based checks as any
-//     other non-read-only Bash. `CD_TARGET_UNRESOLVABLE_CHARS` documents
-//     exactly WHICH expansions this enumerates (quoting, `$`/env-var,
-//     `~`, glob, and `{...}` brace expansion) — that list is what this
-//     check catches, not a claim that every shell-expansion class is
-//     closed. Known-open residual, pre-existing (not introduced by this
-//     branch, since it applies to `bashReferencesVerdictDir`'s textual
-//     match on ANY Bash command, not just `cd`): a backslash-escaped
-//     spelling of the leaf, e.g. `cd <parent>/solution\-verdicts`, still
-//     navigates into the dir under bash (verified against bash 3.2.57)
-//     while `bashReferencesVerdictDir` returns false — the backslash
-//     breaks the literal-leaf substring match and no metacharacter here
-//     triggers the glob/brace fallback either. Closing it needs
-//     shell-unescaping in the textual check itself, which is more than
-//     this task absorbs; do not assume the class is closed.
-//     A SECOND residual of the same class, and on a macOS operator
-//     machine the more reachable of the two: case variance.
-//     `cd <parent>/SOLUTION-VERDICTS` navigates into the dir on a
-//     case-insensitive APFS volume, but `isInsideDir` compares with a
-//     case-sensitive `path.relative` and the textual check uses a
-//     case-sensitive `includes`, so both return false. Also allowed:
-//     a trailing backslash, `cd <DIR>\`. Both pre-existing; closing
-//     them needs case-folding in the textual check.
-//
-// Pure reads (`cat <dir>/x.json`) are allowed so the guard is not over-broad.
-//
-// No manifest is consulted: the decision is a pure target-vs-dir check, so
-// the guard cannot be broken by a manifest issue and never blocks a write
-// that does not target the verdict dir. The hook is only wired into settings
-// when the pack is enabled, so a disabled pack never invokes it. It yields to
-// `harness pause` like every other gate.
-//
-// Honest residual (operator decision, 2026-05-30): v1 closes the ENUMERATED
-// write paths above. A path constructed at runtime inside an interpreter
-// with no textual reference is NOT caught; marker signing (a cross-repo
-// follow-up) closes content-authenticity against an unguarded write
-// primitive. The `cd`-target check added later (task fb67b402) has its own
-// enumerated, not exhaustive, expansion list — see the bullet above and
-// `CD_TARGET_UNRESOLVABLE_CHARS`'s docstring for the backslash-escaping
-// residual specifically.
-import { bashReferencesVerdictDir, isInsideDir, PACK_NAME, verdictDir as resolveVerdictDir, } from "../../policy-packs/builtin/solution-acceptance-runtime.js";
-import { isReadOnlyBashCommand } from "../../runtime/read-only-bash.js";
-import { checkHookPause, readStdin, runGateWithStdinRefusal, stdoutBlockRefusal, } from "./hook-bootstrap.js";
-/** Single-file target for path-mutating tools, or null when not applicable. */
-function pathToolTarget(toolName, toolInput) {
-    if (typeof toolInput !== "object" || toolInput === null)
-        return null;
-    const input = toolInput;
-    switch (toolName) {
-        case "Write":
-        case "Edit":
-        case "MultiEdit": {
-            const fp = input["file_path"];
-            return typeof fp === "string" && fp.length > 0 ? fp : null;
-        }
-        case "NotebookEdit": {
-            const np = input["notebook_path"];
-            return typeof np === "string" && np.length > 0 ? np : null;
-        }
-        default:
-            return null;
-    }
-}
-function bashCommandOf(toolInput) {
-    if (typeof toolInput !== "object" || toolInput === null)
-        return "";
-    const cmd = toolInput["command"];
-    return typeof cmd === "string" ? cmd : "";
-}
-/**
- * Extract `cd`'s destination argument from a Bash command string, or null
- * when the command is not a `cd` invocation or has no statically resolvable
- * destination. Whitespace-tokenized, same as `read-only-bash.ts`'s own
- * classifier (this hook does not shell-parse either).
- *
- * Deliberately narrow:
- *   - Only fires when the FIRST token is exactly `cd`. `env cd x` or a
- *     chained `foo && cd x` do not match here (tokens[0] would be `env` /
- *     `foo`); those are unaffected by this pre-check and are still governed
- *     by the existing not-read-only + `bashReferencesVerdictDir` checks
- *     below, which already close the `cd <parent> && write <relative>`
- *     descent via the leaf-segment match.
- *   - `cd`'s own flags (`-L`, `-P`, `-e`, `-@`, and combinations) are
- *     skipped to find the first positional path argument.
- *   - `cd -` (switch to `$OLDPWD`) and a bare `cd` (goes to `$HOME`) have no
- *     destination this function can resolve without ambient shell state;
- *     both return null (not flagged), the same conservative stance as the
- *     rest of this module's enumerated-path checks.
- *   - A single layer of surrounding quotes (`"..."` or `'...'`) is stripped
- *     from the returned token before the caller does anything with it, so
- *     `cd "<path>"` and `cd <path>` are treated identically (both the
- *     resolved-path inside-dir check AND the unresolvable-chars check see
- *     the same unquoted value). Without this, a quoted literal that merely
- *     shares a text prefix with the verdict dir (`cd "<dir>-decoy"`) would
- *     route to the textual leaf match and be wrongly blocked, while the
- *     unquoted `cd <dir>-decoy` correctly passes via the resolved-path
- *     check — spelling-dependent behavior for what is the same destination.
- */
-function cdTargetArgument(command) {
-    const tokens = command.trim().split(/\s+/);
-    if (tokens[0] !== "cd")
-        return null;
-    for (let i = 1; i < tokens.length; i += 1) {
-        const t = tokens[i];
-        if (t === undefined)
-            break;
-        if (t === "-")
-            return null;
-        if (t.startsWith("-"))
-            continue;
-        return stripSurroundingQuotes(t);
-    }
-    return null;
-}
-/**
- * Strip one layer of surrounding double or single quotes from `token`, or
- * return it unchanged if it is not fully wrapped in a matching pair. Does
- * NOT attempt any other shell-quoting semantics (no backslash-escape
- * handling, no nested-quote handling) — this is a narrow normalization so a
- * simple quoted literal reads the same as its unquoted form, not a shell
- * parser.
- */
-function stripSurroundingQuotes(token) {
-    if (token.length >= 2 &&
-        ((token.startsWith('"') && token.endsWith('"')) ||
-            (token.startsWith("'") && token.endsWith("'")))) {
-        return token.slice(1, -1);
-    }
-    return token;
-}
-/**
- * Characters/sequences that make a `cd` destination token something
- * `path.resolve` cannot literally evaluate: quoting (`"`, `'` — the residual
- * case after `stripSurroundingQuotes` has already removed a clean single
- * layer, e.g. an unbalanced or embedded quote), env-var expansion (`$`),
- * home-directory expansion (`~`), shell globbing (`*`, `?`, `[`), and brace
- * expansion (`{`, `}`, `,`). `path.resolve` treats the raw token as a
- * literal path segment, so `cd "$SOLUTION_VERDICT_DIR"`, `cd
- * ~/.../solution-verdicts`, or `cd <parent>/{solution-verdicts,x}` all
- * resolve to a nonsense path that is never "inside" the dir even though a
- * real shell would expand each of them TO (or, for the brace form, INTO)
- * the dir. A `cd` target containing any of these must therefore NOT take
- * the read-only fast path in `evaluateWriteGuard`: control must fall
- * through to the same `bashReferencesVerdictDir` text-reference check any
- * other non-read-only Bash command goes through, which DOES recognize
- * these spellings (the env-var token, the `agent-grounding/solution-verdicts`
- * tail, and — after the matching widening in
- * `solution-acceptance-runtime.ts`'s glob-metacharacter test — glob- and
- * brace-obscured leaf words).
- *
- * This list is enumerated, not exhaustive: it is exactly the expansion
- * classes this check has been reasoned about, not a claim that every way a
- * shell can rewrite a `cd` argument is covered. A known-open residual
- * (pre-existing, not introduced by this check) is backslash escaping — see
- * the module header's "Known-open residual" note.
- */
-const CD_TARGET_UNRESOLVABLE_CHARS = /[$~*?[{},"']/;
-/**
- * Pure write-guard decision for a tool event. Exported for direct unit
- * testing of the full forge-attempt matrix without spinning up the CLI.
- */
-export function evaluateWriteGuard(toolName, toolInput, dir, cwd) {
-    // Path-mutating tools: block iff the target resolves inside the dir.
-    const target = pathToolTarget(toolName, toolInput);
-    if (target !== null) {
-        if (isInsideDir(target, dir, cwd)) {
-            return {
-                blocked: true,
-                reason: `${toolName} target resolves inside the harness-protected solution-verdict dir (${dir}); the verdict marker may only be written by the grounding-mcp producer`,
-            };
-        }
-        return { blocked: false, reason: `${toolName} target is outside the verdict dir` };
-    }
-    // Codex apply_patch: best-effort textual reference check on the patch body.
-    if (toolName === "apply_patch") {
-        const input = typeof toolInput === "object" && toolInput !== null
-            ? toolInput
-            : {};
-        const body = typeof input["patch"] === "string"
-            ? input["patch"]
-            : typeof input["input"] === "string"
-                ? input["input"]
-                : JSON.stringify(toolInput ?? "");
-        if (bashReferencesVerdictDir(body, dir)) {
-            return {
-                blocked: true,
-                reason: `apply_patch references the harness-protected solution-verdict dir (${dir})`,
-            };
-        }
-        return { blocked: false, reason: "apply_patch does not reference the verdict dir" };
-    }
-    // Bash: allow provable reads; block non-read-only commands that reference
-    // the dir, or whose shell cwd is inside it.
-    if (toolName === "Bash") {
-        const command = bashCommandOf(toolInput);
-        if (command === "")
-            return { blocked: false, reason: "empty Bash command" };
-        // Defense-in-depth, ahead of the read-only fast path below: `cd` itself
-        // cannot write, but `cd`ing into the verdict dir is the setup half of a
-        // two-call forge (see the module header). Only a RESOLVED-path check
-        // (via the shared `isInsideDir`, not a substring match) so a sibling
-        // that merely shares a text prefix with the dir (`solution-verdicts-decoy`,
-        // or a parent directory of it) is not wrongly flagged.
-        const cdTarget = cdTargetArgument(command);
-        if (cdTarget !== null && isInsideDir(cdTarget, dir, cwd)) {
-            return {
-                blocked: true,
-                reason: `cd targets the harness-protected solution-verdict dir (${dir}); stepping into it would set up a later un-chained relative write to forge the verdict marker`,
-            };
-        }
-        // A `cd` target containing one of the enumerated unresolvable
-        // expansions (see `CD_TARGET_UNRESOLVABLE_CHARS`'s docstring for the
-        // exact list and its non-exhaustive scope) must not take `cd`'s
-        // read-only fast path below: without this, `cd "$SOLUTION_VERDICT_DIR"`
-        // etc. would be waved through by `isReadOnlyBashCommand` (true for ANY
-        // `cd`, per the shared read-only-bash floor) before ever reaching the
-        // reference check that recognizes these exact spellings.
-        const cdTargetUnresolvable = cdTarget !== null && CD_TARGET_UNRESOLVABLE_CHARS.test(cdTarget);
-        if (!cdTargetUnresolvable && isReadOnlyBashCommand(command)) {
-            return { blocked: false, reason: "read-only Bash command" };
-        }
-        if (isInsideDir(".", dir, cwd)) {
-            return {
-                blocked: true,
-                reason: `non-read-only Bash with a shell cwd inside the harness-protected solution-verdict dir (${dir})`,
-            };
-        }
-        if (bashReferencesVerdictDir(command, dir)) {
-            return {
-                blocked: true,
-                reason: `non-read-only Bash references the harness-protected solution-verdict dir (${dir}); the verdict marker may only be written by the grounding-mcp producer`,
-            };
-        }
-        return { blocked: false, reason: "non-read-only Bash does not reference the verdict dir" };
-    }
-    return { blocked: false, reason: `${toolName} is not a guarded write surface` };
-}
-function blockJson(toolName, reason) {
-    const text = `solution-acceptance write-guard: refusing ${toolName}. ${reason}.\n` +
-        `The solution-acceptance verdict marker is derived by the producer from a ` +
-        `real preflight run; hand-writing it would forge a green "done". ` +
-        `Run \`mcp__grounding-mcp__solution_evaluate({ id: "<task-id>" })\` instead, ` +
-        `which writes the marker for you.\n` +
-        `Operator override: \`harness pause\`.`;
-    return JSON.stringify({
-        decision: "block",
-        reason: text,
-        hookSpecificOutput: {
-            hookEventName: "PreToolUse",
-            permissionDecision: "deny",
-            permissionDecisionReason: text,
-        },
-    });
-}
-async function runPackHookSolutionAcceptanceWriteguardCliInner(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stdout = opts.stdout ?? process.stdout;
-    const stderr = opts.stderr ?? process.stderr;
-    const note = (msg) => {
-        stderr.write(`harness pack hook solution-acceptance-writeguard: ${msg}\n`);
-    };
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        /* event stays {} -> not a guarded surface -> allow */
-    }
-    if (checkHookPause(`${PACK_NAME}-writeguard`, stderr, opts).paused) {
-        const diagnostic = "harness paused; write-guard allowing without evaluating.";
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const toolName = typeof event.tool_name === "string" ? event.tool_name : "(unknown)";
-    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
-        ? opts.cwd
-        : typeof event.cwd === "string" && event.cwd.length > 0
-            ? event.cwd
-            : process.cwd();
-    const dir = opts.verdictDir ?? resolveVerdictDir();
-    const decision = evaluateWriteGuard(toolName, event.tool_input, dir, cwd);
-    if (!decision.blocked) {
-        const diagnostic = `allow — ${decision.reason}`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const diagnostic = `BLOCK — ${decision.reason}`;
-    note(diagnostic);
-    stdout.write(`${blockJson(toolName, decision.reason)}\n`);
-    return { exitCode: 0, blocked: true, diagnostic };
-}
-/**
- * `harness pack hook solution-acceptance-writeguard`. A stdin read that times out is refused here
- * instead of being handed to the gate as an empty or truncated event it would
- * treat as malformed input (task 7dfdcaaf). The operator pause still wins;
- * every other input runs the gate unchanged.
- */
-export function runPackHookSolutionAcceptanceWriteguardCli(opts = {}) {
-    return runGateWithStdinRefusal(opts, (stderr) => checkHookPause(`${PACK_NAME}-writeguard`, stderr, opts).paused, stdoutBlockRefusal("solution-acceptance-writeguard"), runPackHookSolutionAcceptanceWriteguardCliInner);
-}
-//# sourceMappingURL=hook-solution-acceptance-writeguard.js.map

package/dist/cli/pack/hook-solution-acceptance-writeguard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-solution-acceptance-writeguard.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-solution-acceptance-writeguard.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,iEAAiE;AACjE,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,0CAA0C;AAC1C,yEAAyE;AACzE,8BAA8B;AAC9B,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,uEAAuE;AACvE,8EAA8E;AAC9E,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,kEAAkE;AAClE,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,4DAA4D;AAC5D,mEAAmE;AACnE,4DAA4D;AAC5D,kEAAkE;AAClE,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,oEAAoE;AACpE,oDAAoD;AACpD,EAAE;AACF,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,yCAAyC;AACzC,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,yBAAyB;AAEzB,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,SAAS,EACT,UAAU,IAAI,iBAAiB,GAChC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EACL,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAwB7B,+EAA+E;AAC/E,SAAS,cAAc,CAAC,QAAgB,EAAE,SAAkB;IAC1D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YAClC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM;QAC3B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACjD,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,4BAA4B,GAAG,cAAc,CAAC;AAOpD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAkB,EAClB,GAAW,EACX,GAAW;IAEX,qEAAqE;IACrE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,GAAG,QAAQ,uEAAuE,GAAG,yEAAyE;aACvK,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,oCAAoC,EAAE,CAAC;IACrF,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAE,SAAqC;YACxC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;YAChC,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY;YAC5B,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAClC,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY;gBAC5B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,sEAAsE,GAAG,GAAG;aACrF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IACtF,CAAC;IAED,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAE5E,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,0DAA0D,GAAG,gGAAgG;aACtK,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,qEAAqE;QACrE,gEAAgE;QAChE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,oBAAoB,GACxB,QAAQ,KAAK,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,CAAC,oBAAoB,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,0FAA0F,GAAG,GAAG;aACzG,CAAC;QACJ,CAAC;QACD,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,6EAA6E,GAAG,yEAAyE;aAClK,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC7F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,iCAAiC,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,MAAc;IACjD,MAAM,IAAI,GACR,6CAA6C,QAAQ,KAAK,MAAM,KAAK;QACrE,2EAA2E;QAC3E,kEAAkE;QAClE,8EAA8E;QAC9E,oCAAoC;QACpC,uCAAuC,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,IAAI;QACZ,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,IAAI;SAC/B;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,+CAA+C,CAC5D,OAAoD,EAAE;IAEtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,qDAAqD,GAAG,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,cAAc,CAAC,GAAG,SAAS,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,0DAA0D,CAAC;QAC9E,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAEnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAAoD,EAAE;IAEtD,OAAO,uBAAuB,CAC5B,IAAI,EACJ,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,SAAS,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAC1E,kBAAkB,CAAC,gCAAgC,CAAC,EACpD,+CAA+C,CAChD,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-solution-acceptance.d.ts

@@ -1,157 +0,0 @@
-import { type VerdictReadOutcome } from "../../policy-packs/builtin/solution-acceptance-runtime.js";
-import { type LockCheckResult } from "../../io/lock.js";
-import { type Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookSolutionAcceptanceOptions extends LoaderOptions {
-    /** Defaults to process.stdin. */
-    stdin?: NodeJS.ReadableStream;
-    /** Defaults to process.stdout. */
-    stdout?: NodeJS.WritableStream;
-    /** Defaults to process.stderr. */
-    stderr?: NodeJS.WritableStream;
-    /** Override cwd resolution (test injection). */
-    cwd?: string;
-    /** Inject a manifest (test). */
-    manifest?: Manifest;
-    /** Override the harness.generated/ directory (test injection). */
-    generatedDir?: string;
-    /** Override the verdict directory (test injection; default = producer default). */
-    verdictDir?: string;
-    /** Override the active-claim resolution (test injection). */
-    activeClaim?: string | null;
-    /** Override process.env (test injection); defaults to process.env. */
-    env?: NodeJS.ProcessEnv;
-}
-export interface PackHookSolutionAcceptanceResult {
-    exitCode: number;
-    blocked: boolean;
-    diagnostic: string;
-}
-/**
- * Staleness window this hook applies when READING the attempt-lock anchor:
- * the producer's own DOCUMENTED default, `DEFAULT_ATTEMPT_LOCK_STALE_MS`
- * (grounding-mcp-v0.12.0 packages/grounding-mcp/src/solution-attempt-log.ts:102,
- * `= 30_000`), the `staleMs` `acquireAttemptLock` passes straight through
- * to `lockfile.lock(anchor, { retries: 0, realpath: false, stale:
- * options.staleMs, ... })` (same file, lines 472-475) on every DEFAULT
- * acquisition, pinned here as a literal rather than imported (this package
- * has no dependency on grounding-mcp's internals). This hook applies the
- * producer's documented default window pinned to grounding-mcp-v0.12.0; it
- * diverges from what the producer actually enforces for a given attempt
- * if the producer's own default changes in a later release, or if a
- * caller of `acquireAttemptLock` overrides `staleMs` away from that
- * default (the producer's own option is caller-settable, same file),
- * since neither is observable from this side of the lock: an operational
- * pin, not a mathematical guarantee, that needs re-checking on every
- * grounding-mcp bump this pack's producer floor moves past.
- */
-export declare const ATTEMPT_LOCK_STALE_MS = 30000;
-export type NullVerdictReading = "live-attempt" | "never-evaluated" | "unreadable-marker";
-/**
- * WHY a present marker path yielded no verdict, carried straight from the
- * ONE `readVerdictDetailed` observation the gate decided on, never
- * re-derived from a second look at the path. Exactly the non-`ok`,
- * non-`missing`, non-`invalid-id` kinds of `VerdictReadOutcome`, so the
- * agent-facing line for reading (3) names what that read established
- * rather than restating a disjunction by hand.
- */
-export type RejectedMarkerKind = Exclude<VerdictReadOutcome["kind"], "ok" | "missing" | "invalid-id">;
-/**
- * Every state the null-verdict note renders a line for, as data. The note
- * is a total function over this list (`coordinateOf` below maps each
- * `NullVerdictInfo` onto exactly one coordinate, and the compiler rejects a
- * member without a line), and
- * `tests/cli/pack-hook-solution-acceptance.test.ts` iterates it to assert
- * the state table has a row per member. A state added to the classifier
- * without a row therefore fails the build or the suite, instead of
- * shipping an unpinned line to an agent.
- */
-export declare const NULL_VERDICT_NOTE_STATES: readonly ["unusable-id", "never-evaluated", "marker-symlink", "marker-not-regular", "marker-unreadable", "marker-invalid-record", "live-attempt"];
-export type NullVerdictNoteState = (typeof NULL_VERDICT_NOTE_STATES)[number];
-/**
- * The two states whose line carries no liveness clause: the unusable-id
- * line (nothing was read, so no liveness exists to name) and the
- * live-attempt line (its liveness is `"live"` by definition). Every other
- * state's line names what the lock check said, so it exists once per
- * clause.
- */
-export declare const NULL_VERDICT_CLAUSE_FREE_STATES: readonly ["unusable-id", "live-attempt"];
-type ClauseFreeNoteState = (typeof NULL_VERDICT_CLAUSE_FREE_STATES)[number];
-type ClauseNoteState = Exclude<NullVerdictNoteState, ClauseFreeNoteState>;
-/**
- * Three-valued liveness read, never a boolean: `"live"`, `"not-live"` (no
- * lock directory, or one past the stale window: `proper-lockfile`'s own
- * check answers `false` for both, swallowing the absent-lock `ENOENT`
- * inside the library), or `"unknown"` (the check threw: an unreadable
- * directory, a symlink loop, ...). `"unknown"` must never be
- * treated as `"not-live"` downstream: that would assert an attempt is
- * confirmed absent when liveness simply could not be determined (see
- * `classifyNullVerdictReading` and `nullVerdictReadingNote` below, which
- * keep the two states distinct all the way into the agent-facing text).
- */
-export type AttemptLockLiveness = LockCheckResult;
-/**
- * The lock-check results a clause-carrying line can render. `"live"` is
- * absent on purpose: a live lock is settled as the live-attempt state
- * before any marker line is chosen, so no marker line is ever rendered for
- * it. Spelled out rather than derived from `AttemptLockLiveness`, so a new
- * lock-check result fails the typecheck at the classifier instead of
- * reaching the renderer's runtime throw inside the deny path.
- */
-type ClauseLiveness = "not-live" | "unknown";
-/**
- * One reachable (note state, liveness) combination, the coordinate a line
- * is rendered at. Unreachable pairs have no member: `"live"` exists only
- * with the live-attempt state, and the unusable-id state carries no
- * liveness at all (no placeholder value to mistake for an observation).
- */
-export type NullVerdictNoteCoordinate = {
-    state: ClauseFreeNoteState;
-} | {
-    state: ClauseNoteState;
-    liveness: ClauseLiveness;
-};
-/**
- * One line per note state, as a total `Record` keyed by
- * `NULL_VERDICT_NOTE_STATES`: a state added to the list without a line
- * here fails the build, which is what makes the list a checklist rather
- * than a convention.
- *
- * Invariant across every line: it states only what the gate established,
- * and never a cause that was not observed. The liveness clause names what
- * the lock check said ("no attempt reads as currently live" vs "liveness
- * could not be determined") instead of always asserting absence, and the
- * marker lines come from the gate's OWN read of the marker, never from a
- * second look at the path. `tests/cli/pack-hook-solution-acceptance.test.ts`
- * pins one exact expected line per state and asserts every member of the
- * list has a row, so a future state whose line would overstate fails there
- * rather than reaching an agent.
- */
-export declare const NULL_VERDICT_NOTE_RENDERERS: Record<NullVerdictNoteState, (taskId: string, clause: string) => string>;
-/**
- * Every reachable coordinate, derived from `NULL_VERDICT_NOTE_STATES`: one
- * per clause-free state, one per liveness clause for every other state. The
- * state table in `tests/cli/pack-hook-solution-acceptance.test.ts` requires
- * a row per member and derives its "no other line appears" set from it, so
- * a state added to the list joins both without anyone extending a list.
- */
-export declare const NULL_VERDICT_NOTE_COORDINATES: readonly NullVerdictNoteCoordinate[];
-/**
- * The exact line a coordinate renders for `taskId`. The one place a state
- * and a liveness become a line: the hook renders through it, and the state
- * table derives its "no other line appears" set and checks each row's
- * declared coordinate against it. Total over reachable coordinates only: a
- * pair the type excludes (`"live"` beside a clause-carrying state, any
- * liveness beside a clause-free one) throws instead of rendering a line
- * that would misstate what was observed, for a caller that bypasses the
- * type.
- */
-export declare function renderNullVerdictNote(coordinate: NullVerdictNoteCoordinate, taskId: string): string;
-/**
- * `harness pack hook solution-acceptance`. A stdin read that times out is refused here
- * instead of being handed to the gate as an empty or truncated event it would
- * treat as malformed input (task 7dfdcaaf). The operator pause still wins;
- * every other input runs the gate unchanged.
- */
-export declare function runPackHookSolutionAcceptanceCli(opts?: PackHookSolutionAcceptanceOptions): Promise<PackHookSolutionAcceptanceResult>;
-export {};