@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/hook-stay-in-scope.js

@@ -1,128 +0,0 @@
-// `harness pack hook stay-in-scope` is an optional, informational
-// PostToolUse integration. It reads its complete behavior from the current
-// pack configuration so a stale generated hook safely no-ops after disable.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { resolveHomeDir } from "../../runtime/home-dir.js";
-import { toolNameMatchesAny } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { taskIdFromToolResponse } from "../../runtime/task-providers/agent-tasks.js";
-import { evaluateStayInScopeMatch, extractConfiguredParentUrl, resolveStayInScopeConfig, } from "../../policy-packs/builtin/understanding-before-execution/stay-in-scope-config.js";
-import { checkHookPause, loadManifestOrInjected, pickString, readStdin, resolveToolInput, } from "./hook-bootstrap.js";
-const PACK_NAME = "understanding-before-execution";
-export const STAY_IN_SCOPE_DISABLED_ENV = "STAY_IN_SCOPE_DISABLED";
-export const STAY_IN_SCOPE_LOG_ENV = "STAY_IN_SCOPE_LOG";
-export const REMINDERS_SUBDIR = "reminders";
-export const STAY_IN_SCOPE_LOG_BASENAME = "stay-in-scope.log";
-function noop(diagnostic, stderr, partial = {}) {
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, matched: false, matchedRule: "none", logged: false, secondOrder: false, logPath: null, diagnostic, ...partial };
-}
-function objectValue(input, key) {
-    return typeof input === "object" && input !== null && !Array.isArray(input)
-        ? input[key]
-        : undefined;
-}
-function extractLabels(toolInput) {
-    const labels = objectValue(toolInput, "labels");
-    return Array.isArray(labels) ? labels.filter((value) => typeof value === "string") : [];
-}
-function extractDescription(toolInput) {
-    const description = objectValue(toolInput, "description");
-    return typeof description === "string" ? description : "";
-}
-function extractTitle(toolInput) {
-    const title = objectValue(toolInput, "title");
-    return typeof title === "string" && title.length > 0 ? title : null;
-}
-// Reuses the shared MCP tool_response unwrap (taskIdFromToolResponse) so
-// this hook reads the real Claude Code content-block shape the same way
-// the active-claim tracker does, instead of a second, plain-object-only
-// parser (harness task b5e65f5e).
-function extractTaskId(toolInput, toolResponse) {
-    const taskId = objectValue(toolInput, "taskId");
-    if (typeof taskId === "string" && taskId.length > 0)
-        return taskId;
-    const wrappedId = taskIdFromToolResponse(toolResponse);
-    return wrappedId.length > 0 ? wrappedId : null;
-}
-function resolveLogPath(opts, env) {
-    if (typeof opts.logPath === "string" && opts.logPath.length > 0)
-        return opts.logPath;
-    const configured = env[STAY_IN_SCOPE_LOG_ENV];
-    if (typeof configured === "string" && configured.length > 0)
-        return configured;
-    const home = resolveHomeDir(opts.homeDir === undefined ? {} : { homeDir: opts.homeDir });
-    return path.join(home.path, REMINDERS_SUBDIR, STAY_IN_SCOPE_LOG_BASENAME);
-}
-function appendAuditRow(logPath, record) {
-    try {
-        fs.mkdirSync(path.dirname(logPath), { recursive: true });
-        fs.appendFileSync(logPath, `${JSON.stringify(record)}\n`, "utf8");
-        return { ok: true };
-    }
-    catch (error) {
-        return { ok: false, reason: error.message };
-    }
-}
-export async function runPackHookStayInScopeCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const env = opts.env ?? process.env;
-    let event;
-    try {
-        const parsed = JSON.parse((await readStdin(stdin)).trim() || "{}");
-        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-            return noop("harness pack hook stay-in-scope: malformed event JSON, skipping", stderr);
-        }
-        event = parsed;
-    }
-    catch {
-        return noop("harness pack hook stay-in-scope: malformed event JSON, skipping", stderr);
-    }
-    if (checkHookPause("stay-in-scope", stderr, opts, opts.generatedDir).paused) {
-        return noop("harness paused; stay-in-scope skipping without evaluating.", stderr);
-    }
-    if (env[STAY_IN_SCOPE_DISABLED_ENV] === "1") {
-        return noop(`harness pack hook stay-in-scope: ${STAY_IN_SCOPE_DISABLED_ENV}=1, skipping`, stderr);
-    }
-    let manifest;
-    try {
-        ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
-    }
-    catch (error) {
-        return noop(`harness pack hook stay-in-scope: manifest load failed (${error.message}), skipping`, stderr);
-    }
-    const declared = manifest.policy_packs.find((pack) => pack.name === (opts.pack ?? PACK_NAME));
-    const config = declared?.enabled ? resolveStayInScopeConfig(declared.config["stay_in_scope"]) : null;
-    if (config === null) {
-        return noop("harness pack hook stay-in-scope: integration absent, disabled, or invalid, skipping", stderr);
-    }
-    const toolName = pickString(event.tool_name, event.tool) ?? "";
-    if (!toolNameMatchesAny(toolName, config.tools)) {
-        return noop(`harness pack hook stay-in-scope: tool ${toolName || "(missing)"} not in watch list, skipping`, stderr);
-    }
-    const toolInput = resolveToolInput(event);
-    const labels = extractLabels(toolInput);
-    const description = extractDescription(toolInput);
-    const evaluation = evaluateStayInScopeMatch(config, labels, description);
-    if (!evaluation.matched) {
-        return noop(`harness pack hook stay-in-scope: ${toolName} payload carries no configured marker, skipping`, stderr);
-    }
-    const taskId = extractTaskId(toolInput, event.tool_response);
-    const record = {
-        ts: (opts.now ?? new Date()).toISOString(), taskId, title: extractTitle(toolInput), labels,
-        parentPrUrl: extractConfiguredParentUrl(config, description, evaluation.parentReference),
-        secondOrder: evaluation.secondOrder, matchedRule: evaluation.matchedRule,
-    };
-    const logPath = resolveLogPath(opts, env);
-    const appendResult = appendAuditRow(logPath, record);
-    const prefix = evaluation.secondOrder ? "[stay-in-scope: SECOND-ORDER]" : "[stay-in-scope]";
-    const taskIdNote = taskId === null ? "" : ` task=${taskId}`;
-    const configuredMessage = evaluation.secondOrder ? config.messages.secondOrder : config.messages.reminder;
-    stderr.write(`${prefix} follow-up created from review context${taskIdNote}. ${configuredMessage}\n`);
-    const logNote = appendResult.ok ? `; audit appended to ${logPath}` : `; audit append FAILED (${appendResult.reason})`;
-    const diagnostic = `harness pack hook stay-in-scope: matched=${evaluation.matchedRule} secondOrder=${evaluation.secondOrder}${logNote}`;
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, matched: true, matchedRule: evaluation.matchedRule, logged: appendResult.ok, secondOrder: evaluation.secondOrder, logPath: appendResult.ok ? logPath : null, diagnostic };
-}
-//# sourceMappingURL=hook-stay-in-scope.js.map

package/dist/cli/pack/hook-stay-in-scope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-stay-in-scope.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-stay-in-scope.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,2EAA2E;AAC3E,4EAA4E;AAE5E,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sEAAsE,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAE3F,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AA2C9D,SAAS,IAAI,CAAC,UAAkB,EAAE,MAA6B,EAAE,UAA8C,EAAE;IAC/G,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;AACxI,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,GAAW;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC,CAAC,GAAG,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAkB;IAC5C,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC1D,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,SAAkB;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,kCAAkC;AAClC,SAAS,aAAa,CAAC,SAAkB,EAAE,YAAqB;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAgC,EAAE,GAAsB;IAC9E,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACrF,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC9C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,MAA8B;IACrE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAmC,EAAE;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,iEAAiE,EAAE,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,GAAG,MAAuB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iEAAiE,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,4DAA4D,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,0BAA0B,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,oCAAoC,0BAA0B,cAAc,EAAE,MAAM,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,0DAA2D,KAAe,CAAC,OAAO,aAAa,EAAE,MAAM,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,qFAAqF,EAAE,MAAM,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,yCAAyC,QAAQ,IAAI,WAAW,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,oCAAoC,QAAQ,iDAAiD,EAAE,MAAM,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM;QAC1F,WAAW,EAAE,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,eAAe,CAAC;QACxF,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW;KACzE,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC;IAC5D,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,yCAAyC,UAAU,KAAK,iBAAiB,IAAI,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC,CAAC,0BAA0B,YAAY,CAAC,MAAM,GAAG,CAAC;IACtH,MAAM,UAAU,GAAG,4CAA4C,UAAU,CAAC,WAAW,gBAAgB,UAAU,CAAC,WAAW,GAAG,OAAO,EAAE,CAAC;IACxI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;AAClM,CAAC"}

package/dist/cli/pack/hook-subagent-start.d.ts

@@ -1,23 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookSubagentStartOptions extends LoaderOptions {
-    pack?: string;
-    generatedDir?: string;
-    stdin?: NodeJS.ReadableStream;
-    stderr?: NodeJS.WritableStream;
-    manifest?: Manifest;
-    /** Override the persisted-report directory (test injection). */
-    reportsDir?: string;
-    /** Override the issue timestamp for deterministic tests. */
-    now?: Date;
-}
-export interface PackHookSubagentStartResult {
-    exitCode: number;
-    /** Was an in-flight record actually written? */
-    recordWritten: boolean;
-    sessionId: string | null;
-    agentId: string | null;
-    /** Diagnostic line emitted to stderr. */
-    diagnostic: string;
-}
-export declare function runPackHookSubagentStartCli(opts?: PackHookSubagentStartOptions): Promise<PackHookSubagentStartResult>;

package/dist/cli/pack/hook-subagent-start.js

@@ -1,88 +0,0 @@
-// `harness pack hook subagent-start` — write an in-flight record for a
-// newly-started Agent-tool subagent (docs/decisions/2026-08-27-ug-auto-
-// mode-approval.md "TTL, cwd, and subagents").
-//
-// SubagentStart fires on the PARENT session's `session_id` (subagents
-// share it, they never get one of their own); Claude Code additionally
-// carries `agent_id` and `agent_type` on this event. This hook consults
-// the same operator-approval authority the PreToolUse blocker does
-// (`checkOperatorApprovalMarkers`) and, only when it matches, copies
-// that approval into a signed in-flight record keyed by
-// `(session_id, agent_id)` — see inflight-records.ts's module header
-// for why this is a COPY of authority already granted, never a new
-// grant. When the parent holds no valid approval at spawn time, nothing
-// is written and the subagent gets no record to present later. A matched
-// marker whose signed report hash no longer matches any persisted report
-// (the approved report was edited after approval, the same cross-check
-// both PreToolUse hooks apply after a match) counts as no valid
-// approval: the PreToolUse hooks refuse that marker, so a record minted
-// under it would outlive the refusal and open the gate for the subagent.
-//
-// Never blocks: this hook has no gating role of its own (a later slice
-// teaches the PreToolUse blocker to consult the record it produces
-// here). Every error and refusal path resolves to exit 0 + stderr
-// diagnostic, mirroring every other hook in this pack.
-import { checkOperatorApprovalMarkers, defaultReportsDir, rejectMalformedAgentId, verifyMatchedMarkerReport, writeInflightRecord, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { pickString, readStdin, resolveSubagentHookContext, } from "./hook-bootstrap.js";
-const PACK_NAME = "understanding-before-execution";
-const HOOK_LABEL = "harness pack hook: subagent-start";
-function noop(diagnostic, stderr, sessionId = null, agentId = null) {
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, recordWritten: false, sessionId, agentId, diagnostic };
-}
-export async function runPackHookSubagentStartCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const packName = opts.pack ?? PACK_NAME;
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        return noop(`${HOOK_LABEL}: malformed event JSON, skipping`, stderr);
-    }
-    // Pause sentinel checked before anything else, ids resolved, then pack
-    // context resolved — same as every other hook in this pack.
-    const ctxResult = resolveSubagentHookContext(HOOK_LABEL, "subagent-start", packName, event, rejectMalformedAgentId, { ...opts, stderr });
-    if (!ctxResult.ok) {
-        return noop(ctxResult.diagnostic, stderr, ctxResult.sessionId, ctxResult.agentId);
-    }
-    const { sessionId, agentId, declared, generatedDir } = ctxResult.context;
-    const agentType = pickString(event.agent_type) ?? "unknown";
-    const approval = checkOperatorApprovalMarkers(generatedDir, sessionId, declared.config, stderr);
-    if (!approval.matched) {
-        const diagnostic = `${HOOK_LABEL}: parent session ${sessionId} holds no valid approval; no in-flight record for agent ${agentId}`;
-        stderr.write(`${diagnostic}\n`);
-        return { exitCode: 0, recordWritten: false, sessionId, agentId, diagnostic };
-    }
-    // Same gate-read cross-check as both PreToolUse hooks: a marker whose
-    // signed report content is no longer on disk is not an approval, so no
-    // record may be copied from it.
-    const reportsDir = opts.reportsDir ?? defaultReportsDir();
-    const reportHash = verifyMatchedMarkerReport(reportsDir, approval);
-    if (!reportHash.ok) {
-        const diagnostic = `${HOOK_LABEL}: parent session ${sessionId} approval refused, ${reportHash.detail}; no in-flight record for agent ${agentId}`;
-        stderr.write(`${diagnostic}\n`);
-        return { exitCode: 0, recordWritten: false, sessionId, agentId, diagnostic };
-    }
-    const writeOpts = {
-        generatedDir,
-        sessionId,
-        agentId,
-        agentType,
-        // The marker that actually verified (the session marker when a task
-        // marker failed the check and the session marker behind it held).
-        parent: { ...approval, source: reportHash.source, detail: reportHash.detail },
-    };
-    if (opts.now)
-        writeOpts.now = opts.now;
-    const result = writeInflightRecord(writeOpts);
-    if (!result.ok) {
-        return noop(`${HOOK_LABEL}: writeInflightRecord failed for agent ${agentId} (${result.reason}: ${result.detail})`, stderr, sessionId, agentId);
-    }
-    const diagnostic = `${HOOK_LABEL}: wrote in-flight record for agent ${agentId} (parent=${reportHash.source})`;
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, recordWritten: true, sessionId, agentId, diagnostic };
-}
-//# sourceMappingURL=hook-subagent-start.js.map

package/dist/cli/pack/hook-subagent-start.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-subagent-start.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-subagent-start.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,qEAAqE;AACrE,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,kEAAkE;AAClE,uDAAuD;AAEvD,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAG9E,OAAO,EACL,UAAU,EACV,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AA8BvD,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B,EAC7B,YAA2B,IAAI,EAC/B,UAAyB,IAAI;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAA2B,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,UAAU,kCAAkC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,uEAAuE;IACvE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,0BAA0B,CAC1C,UAAU,EACV,gBAAgB,EAChB,QAAQ,EACR,KAAK,EACL,sBAAsB,EACtB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CACpB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IAE5D,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,YAAY,EACZ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,UAAU,oBAAoB,SAAS,2DAA2D,OAAO,EAAE,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,GAAG,UAAU,oBAAoB,SAAS,sBAAsB,UAAU,CAAC,MAAM,mCAAmC,OAAO,EAAE,CAAC;QACjJ,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,SAAS,GAA8C;QAC3D,YAAY;QACZ,SAAS;QACT,OAAO;QACP,SAAS;QACT,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;KAC9E,CAAC;IACF,IAAI,IAAI,CAAC,GAAG;QAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,IAAI,CACT,GAAG,UAAU,0CAA0C,OAAO,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,EACrG,MAAM,EACN,SAAS,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,UAAU,sCAAsC,OAAO,YAAY,UAAU,CAAC,MAAM,GAAG,CAAC;IAC9G,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC9E,CAAC"}

package/dist/cli/pack/hook-subagent-stop.d.ts

@@ -1,19 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookSubagentStopOptions extends LoaderOptions {
-    pack?: string;
-    generatedDir?: string;
-    stdin?: NodeJS.ReadableStream;
-    stderr?: NodeJS.WritableStream;
-    manifest?: Manifest;
-}
-export interface PackHookSubagentStopResult {
-    exitCode: number;
-    /** Was clearInflightRecord actually invoked (ids valid, pack enabled)? */
-    cleared: boolean;
-    sessionId: string | null;
-    agentId: string | null;
-    /** Diagnostic line emitted to stderr. */
-    diagnostic: string;
-}
-export declare function runPackHookSubagentStopCli(opts?: PackHookSubagentStopOptions): Promise<PackHookSubagentStopResult>;

package/dist/cli/pack/hook-subagent-stop.js

@@ -1,41 +0,0 @@
-// `harness pack hook subagent-stop` — remove the in-flight record a
-// `subagent-start` invocation wrote for this `(session_id, agent_id)`
-// pair (docs/decisions/2026-08-27-ug-auto-mode-approval.md "TTL, cwd,
-// and subagents"). The subagent has finished; its copy of the parent's
-// approval no longer has anything to authorize.
-//
-// Idempotent and never blocks: a missing record (never written, already
-// cleared, or the parent never had approval to copy) is a no-op, same
-// as `clearInflightRecord` itself. Every path resolves to exit 0 +
-// stderr diagnostic.
-import { clearInflightRecord, rejectMalformedAgentId, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { readStdin, resolveSubagentHookContext } from "./hook-bootstrap.js";
-const PACK_NAME = "understanding-before-execution";
-const HOOK_LABEL = "harness pack hook: subagent-stop";
-function noop(diagnostic, stderr, sessionId = null, agentId = null) {
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, cleared: false, sessionId, agentId, diagnostic };
-}
-export async function runPackHookSubagentStopCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const packName = opts.pack ?? PACK_NAME;
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        return noop(`${HOOK_LABEL}: malformed event JSON, skipping`, stderr);
-    }
-    const ctxResult = resolveSubagentHookContext(HOOK_LABEL, "subagent-stop", packName, event, rejectMalformedAgentId, { ...opts, stderr });
-    if (!ctxResult.ok) {
-        return noop(ctxResult.diagnostic, stderr, ctxResult.sessionId, ctxResult.agentId);
-    }
-    const { sessionId, agentId, generatedDir } = ctxResult.context;
-    clearInflightRecord(generatedDir, sessionId, agentId);
-    const diagnostic = `${HOOK_LABEL}: cleared in-flight record for agent ${agentId}`;
-    stderr.write(`${diagnostic}\n`);
-    return { exitCode: 0, cleared: true, sessionId, agentId, diagnostic };
-}
-//# sourceMappingURL=hook-subagent-stop.js.map

package/dist/cli/pack/hook-subagent-stop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-subagent-stop.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-subagent-stop.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,qBAAqB;AAErB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sEAAsE,CAAC;AAG9E,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAE5E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAyBtD,SAAS,IAAI,CACX,UAAkB,EAClB,MAA6B,EAC7B,YAA2B,IAAI,EAC/B,UAAyB,IAAI;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAA0B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAA0B,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,UAAU,kCAAkC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAC1C,UAAU,EACV,eAAe,EACf,QAAQ,EACR,KAAK,EACL,sBAAsB,EACtB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CACpB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC;IAE/D,mBAAmB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,GAAG,UAAU,wCAAwC,OAAO,EAAE,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACxE,CAAC"}

package/dist/cli/pack/hook-track-active-claim.d.ts

@@ -1,27 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export declare const TOOL_NAME_TASK_START = "mcp__agent-tasks__task_start";
-export declare const TOOL_NAME_TASK_FINISH = "mcp__agent-tasks__task_finish";
-export declare const TOOL_NAME_TASK_ABANDON = "mcp__agent-tasks__task_abandon";
-export declare const TOOL_NAME_TASKS_TRANSITION = "mcp__agent-tasks__tasks_transition";
-export declare const TOOL_NAME_TASK_MERGE = "mcp__agent-tasks__task_merge";
-export declare const TRACK_ACTIVE_CLAIM_TOOLS: readonly string[];
-export interface PackHookTrackActiveClaimOptions extends LoaderOptions {
-    pack?: string;
-    generatedDir?: string;
-    stdin?: NodeJS.ReadableStream;
-    stderr?: NodeJS.WritableStream;
-    manifest?: Manifest;
-}
-export interface PackHookTrackActiveClaimResult {
-    exitCode: number;
-    /** Was the active-claim file written (task_start path)? */
-    claimWritten: boolean;
-    /** Was the active-claim file cleared (task_finish / abandon path)? */
-    claimCleared: boolean;
-    /** The taskId acted on, or null when the event carried none. */
-    taskId: string | null;
-    /** Diagnostic line emitted to stderr. */
-    diagnostic: string;
-}
-export declare function runPackHookTrackActiveClaimCli(opts?: PackHookTrackActiveClaimOptions): Promise<PackHookTrackActiveClaimResult>;

package/dist/cli/pack/hook-track-active-claim.js

@@ -1,275 +0,0 @@
-// `harness pack hook track-active-claim` — agent-tasks claim tracking.
-//
-// PostToolUse hook for the understanding-before-execution pack
-// (harness/494fd1e5). Maintains a small file at
-// `<generatedDir>/active-claim` that names the currently-claimed
-// agent-tasks task id. The file lets `harness approve understanding`
-// auto-resolve the task id when --task is absent, so the operator
-// does not have to type the UUID by hand on every approval.
-//
-// File lifecycle:
-//   - `mcp__agent-tasks__task_start` with `tool_input.taskId` → write
-//     the taskId into the file (atomic).
-//   - `mcp__agent-tasks__task_finish` → remove the file UNLESS the
-//     resulting status is `review` (v2 semantics keep the work claim
-//     there); `mcp__agent-tasks__task_abandon` / `task_merge` → always
-//     remove it (idempotent), but ONLY when the current file already
-//     names the task id this call acted on (a release verb on an
-//     UNRELATED task id keeps the file instead of clearing it, see
-//     `releaseResult` below). The release/keep decision is made in ONE
-//     place, `claimEffectForAgentTasksTool` (`src/runtime/
-//     task-providers/agent-tasks.ts`), which this hook only presents
-//     (task c86e3c4a); the id-equality guard and the fail-safe-shape
-//     diagnostic are this hook's own presentation detail on top of that
-//     decision, not a re-derivation of it.
-//
-// The hook is intentionally separate from `hook-post-tool-use` because
-// the existing marker-expiry hook fires on a configurable list of
-// task-boundary verbs (`expire_on_tool_match`) that does NOT include
-// `task_start`. Folding task_start in there would either expand that
-// matcher's semantics (now "boundary + start") or require a parallel
-// config field. A dedicated hook keeps each surface single-purpose.
-//
-// Failure mode mirrors `hook-post-tool-use`: every error path resolves
-// to no-op + stderr log. The active-claim file is an ergonomic shortcut,
-// not a security-relevant signal — `harness approve understanding`
-// still treats explicit --task as authoritative, and falls back to
-// session-scoped marker when no claim is resolved.
-//
-// Hardcoded agent-tasks tool names: the v2 contract is agent-tasks
-// specific. Operators on Linear / JIRA can ignore this hook (the
-// matcher will never fire for them); a config-driven extension can
-// land later if a second tasking system asks for it.
-//
-// Codex parity (task cf4cdc93): this hook is now also wired on the
-// Codex adapter (`understanding-before-execution.ts`, `runtime ===
-// "codex"` branch), reusing this exact command — no Codex-specific
-// CLI verb needed. The tool-name comparisons below are alias-aware
-// (through the task-provider adapter): a Codex session can emit an
-// MCP tool name in a variant form for the identical tool (server
-// hyphen/underscore swap, the `mcp__server__.tool` dotted form), and
-// the emitted Codex matcher is alias-EXPANDED at `harness apply` time
-// (`expandCodexHookMatchPattern`) so the dispatcher DOES invoke this
-// hook for a variant — a raw `===` here would then silently miss it,
-// the exact bug class task a1348c89 fixed once already for the
-// marker-expiry PostToolUse hook.
-//
-// Review finding on task cf4cdc93 (empirically confirmed, MEDIUM): the
-// event envelope's field NAMES also vary across the tolerated Codex
-// synonyms — `tool` as well as `tool_name`, `raw_input` as well as
-// `tool_input` (`hook-codex-post-tool-use.ts`'s own doc comment and
-// `docs/policy-packs/understanding-before-execution.md`'s wire-format
-// block both document this). A payload shaped `{ tool, raw_input }`
-// (or any mix) used to silently no-op here while the sibling
-// `codex-post-tool-use` hook already handled it via its own
-// `pickString(event.tool_name, event.tool)` / `resolveToolInput`. Now
-// mirrored via the same shared helpers (`hook-bootstrap.ts`).
-import { clearActiveClaim, readActiveClaim, writeActiveClaim, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { ACTIVE_CLAIM_TOOL_NAMES, claimEffectForAgentTasksTool, describeToolResponseShape, matchesAgentTasksRuntimeVerb, taskFinishReleaseIsUnreadable, taskIdFromInput, taskIdFromToolResponse, tasksTransitionStatusFromInput, TASK_ABANDON_TOOL, TASK_FINISH_TOOL, TASK_MERGE_TOOL, TASK_START_TOOL, TASKS_TRANSITION_TOOL, } from "../../runtime/task-providers/agent-tasks.js";
-import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
-import { checkHookPause, loadManifestOrInjected, pickString, readStdin, resolveToolInput, } from "./hook-bootstrap.js";
-const PACK_NAME = "understanding-before-execution";
-export const TOOL_NAME_TASK_START = TASK_START_TOOL;
-export const TOOL_NAME_TASK_FINISH = TASK_FINISH_TOOL;
-export const TOOL_NAME_TASK_ABANDON = TASK_ABANDON_TOOL;
-// Legacy v1 verb: takes an explicit `status` param ("open" | "in_progress" |
-// "review" | "done"). Only `done` is a terminal "work claim released" state
-// in v2 semantics (per task_finish docs: "The work claim is cleared when
-// going to done and kept when going to review"). open / review / in_progress
-// keep the claim, so the hook treats them as no-op (PR #200, agent-tasks
-// 9e06175f). Adding this verb closes the marker-GC gap left by PR #198,
-// which fixed the auto-bypass but did not GC the stale markers themselves.
-export const TOOL_NAME_TASKS_TRANSITION = TASKS_TRANSITION_TOOL;
-export const TOOL_NAME_TASK_MERGE = TASK_MERGE_TOOL;
-export const TRACK_ACTIVE_CLAIM_TOOLS = ACTIVE_CLAIM_TOOL_NAMES;
-function noop(diagnostic, stderr) {
-    stderr.write(`${diagnostic}\n`);
-    return {
-        exitCode: 0,
-        claimWritten: false,
-        claimCleared: false,
-        taskId: null,
-        diagnostic,
-    };
-}
-/**
- * Clear (or keep) the active-claim file after a release-effect verb
- * (task_finish -> non-review, task_abandon, task_merge) and return the
- * standard result shape. Shared by all three, which otherwise
- * byte-duplicate this body.
- *
- * Task c86e3c4a: a release verb used to
- * clear the marker unconditionally, so a caller holding an active-claim
- * WORK marker for task B who then ran task_merge (or finished / abandoned)
- * an UNRELATED task A lost marker B -- including the case of finishing a
- * REVIEW claim on A while B's work claim is what the marker names. Fixed
- * by reading the current marker before clearing and comparing it against
- * the task id this call actually acted on (`tool_input.taskId`, falling
- * back to the tool RESULT's `task.id` when the input carried none): only
- * a match clears. A mismatch keeps the marker and reports the near-miss
- * (`kept active-claim <B>: <verb> on <A>`) instead of silently losing it.
- * When the current marker is absent, or the acted-on id cannot be
- * resolved at all, the comparison is skipped and the old behaviour
- * applies (idempotent clear-of-nothing, or "cannot prove this call is for
- * a different task" -- both favor releasing, matching
- * `claimEffectForAgentTasksTool`'s own fail-safe direction, see its
- * doc comment for what that costs).
- *
- * Also, task c86e3c4a: when the clear is itself the
- * classifier's fail-safe fallback for an unreadable task_finish result
- * (rather than an intentional `done` release), the diagnostic says so by
- * name (`unreadable tool_response, shape=...`) instead of looking
- * identical to a normal release in the operator's stderr trail. This
- * reads `taskFinishReleaseIsUnreadable`/`describeToolResponseShape`
- * purely to LABEL the decision the classifier already made; it does not
- * re-derive the decision itself.
- */
-function releaseResult(toolName, toolInput, toolResponse, generatedDir, stderr) {
-    const actedOnTaskId = taskIdFromInput(toolInput) || taskIdFromToolResponse(toolResponse);
-    const currentClaim = readActiveClaim(generatedDir);
-    if (currentClaim !== null && actedOnTaskId !== "" && currentClaim !== actedOnTaskId) {
-        const diagnostic = `harness pack hook track-active-claim: kept active-claim ${currentClaim}: ${toolName} on ${actedOnTaskId}`;
-        stderr.write(`${diagnostic}\n`);
-        return {
-            exitCode: 0,
-            claimWritten: false,
-            claimCleared: false,
-            taskId: currentClaim,
-            diagnostic,
-        };
-    }
-    clearActiveClaim(generatedDir);
-    const unreadable = matchesAgentTasksRuntimeVerb(toolName, ["task_finish"]) &&
-        taskFinishReleaseIsUnreadable(toolResponse);
-    const diagnostic = unreadable
-        ? `harness pack hook track-active-claim: cleared active-claim after ${toolName} (unreadable tool_response, shape=${describeToolResponseShape(toolResponse)}, fail-safe release)`
-        : `harness pack hook track-active-claim: cleared active-claim after ${toolName}`;
-    stderr.write(`${diagnostic}\n`);
-    return {
-        exitCode: 0,
-        claimWritten: false,
-        claimCleared: true,
-        taskId: actedOnTaskId === "" ? null : actedOnTaskId,
-        diagnostic,
-    };
-}
-export async function runPackHookTrackActiveClaimCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const packName = opts.pack ?? PACK_NAME;
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        return noop("harness pack hook track-active-claim: malformed event JSON, skipping", stderr);
-    }
-    // Pause sentinel — skip claim-file mutations while paused.
-    if (checkHookPause("track-active-claim", stderr, opts, opts.generatedDir).paused) {
-        return noop("harness paused; track-active-claim skipping without evaluating.", stderr);
-    }
-    const toolName = pickString(event.tool_name, event.tool) ?? "";
-    if (toolName === "") {
-        return noop("harness pack hook track-active-claim: missing tool_name, skipping", stderr);
-    }
-    // Loader gate: pack must exist and be enabled. Mirrors the same
-    // structure as hook-post-tool-use so a single disabled-pack opt-out
-    // suppresses BOTH hooks.
-    let manifest;
-    let manifestPath;
-    try {
-        ({ manifest, manifestPath } = loadManifestOrInjected(opts, opts.manifest));
-    }
-    catch (err) {
-        return noop(`harness pack hook track-active-claim: manifest load failed (${err.message}), skipping`, stderr);
-    }
-    const declared = manifest.policy_packs.find((p) => p.name === packName);
-    if (!declared) {
-        return noop(`harness pack hook track-active-claim: pack "${packName}" not declared in manifest, skipping`, stderr);
-    }
-    if (!declared.enabled) {
-        return noop(`harness pack hook track-active-claim: pack "${packName}" is enabled:false, skipping`, stderr);
-    }
-    const generatedDir = opts.generatedDir ??
-        (manifestPath !== undefined
-            ? resolveGeneratedDir({
-                ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-                manifestPath,
-            })
-            : undefined);
-    if (generatedDir === undefined) {
-        return noop("harness pack hook track-active-claim: generatedDir unresolvable, skipping", stderr);
-    }
-    const toolInput = resolveToolInput(event);
-    const taskId = taskIdFromInput(toolInput);
-    // Single decider: claimEffectForAgentTasksTool (agent-tasks.ts) reads
-    // the tool RESULT for task_finish (task.status) to tell a finish that
-    // landed on `review` (work claim kept) apart from `done`/anything else
-    // (released); task_abandon and task_merge always release; task_start
-    // always acquires. This hook only presents that decision below, it
-    // does not re-derive it (task c86e3c4a).
-    const claimEffect = claimEffectForAgentTasksTool(toolName, toolInput, event.tool_response);
-    if (claimEffect === "acquire") {
-        if (taskId === "") {
-            return noop(`harness pack hook track-active-claim: task_start without tool_input.taskId, skipping`, stderr);
-        }
-        try {
-            writeActiveClaim(generatedDir, taskId);
-        }
-        catch (err) {
-            return noop(`harness pack hook track-active-claim: writeActiveClaim failed for ${taskId}: ${err.message}`, stderr);
-        }
-        const diagnostic = `harness pack hook track-active-claim: wrote active-claim for ${taskId}`;
-        stderr.write(`${diagnostic}\n`);
-        return {
-            exitCode: 0,
-            claimWritten: true,
-            claimCleared: false,
-            taskId,
-            diagnostic,
-        };
-    }
-    if (claimEffect === "release" &&
-        !matchesTransition(toolName)) {
-        return releaseResult(toolName, toolInput, event.tool_response, generatedDir, stderr);
-    }
-    if (matchesAgentTasksRuntimeVerb(toolName, ["task_finish"])) {
-        // claimEffect is "none" here (a "release" task_finish already
-        // returned above): the decider only returns "none" for task_finish
-        // when the resulting status was `review`.
-        const diagnostic = `harness pack hook track-active-claim: kept active-claim after ${toolName} (resulting status=review)`;
-        stderr.write(`${diagnostic}\n`);
-        return {
-            exitCode: 0,
-            claimWritten: false,
-            claimCleared: false,
-            taskId: taskId === "" ? null : taskId,
-            diagnostic,
-        };
-    }
-    if (matchesTransition(toolName)) {
-        const status = tasksTransitionStatusFromInput(toolInput);
-        if (claimEffect !== "release") {
-            // open / in_progress / review keep the work claim per v2 semantics
-            // (see task_finish docs). Malformed / missing status also falls
-            // here, since we cannot prove the agent meant to release.
-            return noop(`harness pack hook track-active-claim: tasks_transition status=${status || "(missing)"} keeps claim, skipping`, stderr);
-        }
-        clearActiveClaim(generatedDir);
-        const diagnostic = `harness pack hook track-active-claim: cleared active-claim after tasks_transition status=${status}`;
-        stderr.write(`${diagnostic}\n`);
-        return {
-            exitCode: 0,
-            claimWritten: false,
-            claimCleared: true,
-            taskId: taskId === "" ? null : taskId,
-            diagnostic,
-        };
-    }
-    return noop(`harness pack hook track-active-claim: tool ${toolName} not tracked, skipping`, stderr);
-}
-function matchesTransition(toolName) {
-    return matchesAgentTasksRuntimeVerb(toolName, ["tasks_transition"]);
-}
-//# sourceMappingURL=hook-track-active-claim.js.map