@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/policy-packs/builtin/understanding-before-execution/inflight-records.js

@@ -1,618 +0,0 @@
-// Signed in-flight records for Agent-tool subagents (slice 1 of the
-// subagent-gate work, docs/decisions/2026-08-27-ug-auto-mode-approval.md
-// "Invariants", "Threat model", "Delegation marker shape").
-//
-// THE PROBLEM THIS CLOSES. An Agent-tool subagent shares its parent's
-// `session_id`; it has no way to call `harness approve understanding`
-// itself. The understanding gate's own boundary-expiry mechanism
-// (`applyPostToolUseExpiry`) deletes the parent's session marker the
-// moment the parent crosses a task boundary, even while a subagent it
-// spawned is still mid-flight — stranding that subagent with no
-// approval it can present. An in-flight record is what lets a
-// subagent keep the approval its parent held at the moment the
-// subagent STARTED, independent of what happens to the parent's own
-// marker afterwards.
-//
-// WHY ITS OWN DIRECTORY, NOT `.approvals/`. Exactly the delegation
-// precedent (`delegation-markers.ts`'s module header): a record is
-// evidence that a parent was once approved, not itself an approval a
-// human granted, so it stays out of every `.approvals/` scan (the
-// doctor `approvedBy`-prefix listing, `checkApprovalMarker`'s own
-// directory) and out of `.delegations/` (a different artifact kind,
-// scoped to `claude -p` children, not Agent-tool subagents). A record
-// copied onto either of those directories fails signature verification
-// there on markerId mismatch, mirroring the delegation module's own
-// two-way argument.
-//
-// CONTAINMENT: an authority artifact is read only when every directory
-// segment this reader owns is a plain directory according to `lstat`.
-// A symlinked or non-directory root reads as absent/fail-closed; following
-// a link out of an authority directory never opens the gate. This applies
-// to approval markers, delegations, adoption ledgers, and in-flight records.
-//
-// WHY EVERY BINDING TRAVELS INSIDE `approvedBy`. `signMarker` signs
-// exactly the tuple `(markerId, approvedAt, approvedBy,
-// reportContentHash)` plus, when present, the optional `claimTaskId`
-// (see `canonicalPayload`); any other new signed field is a `SIGNING_ALG` bump.
-// So the one thing this record signs beyond the marker id and the
-// issue timestamp — which parent authority actually matched — rides in
-// `approvedBy` as `inflight:<agentType>:parent=<task|session>`, the
-// same shape choice `delegation-markers.ts` and the auto-approval path
-// already made for their own extra bindings.
-//
-// SIGNATURE SCOPE, DELIBERATELY NARROW. The signed tuple binds
-// `markerId` (which is itself `inflight:<sessionId>:<agentId>`),
-// `approvedAt`, `approvedBy`, and a `null` report hash; it does NOT
-// cover the `sessionId`/`agentId` fields stored in the body for
-// convenience. A verifier that only recomputed the signature could
-// therefore be fooled by a record left in place with its own body
-// fields edited to claim a different agent id than the path it lives
-// at — the signature over `inflight:<sessionId>:<agentId>` would still
-// verify because `markerId` is derived from the REQUESTED ids, not
-// from the body. `verifyInflightRecord` closes that gap with an
-// explicit equality check between the body's own `sessionId`/`agentId`
-// and the ids the caller is asking about, independent of the signature
-// check: a record copied onto a different id's path recomputes the
-// SAME signature (the markerId is derived from the requested ids, which
-// still match its new path), so this equality check is the only thing
-// that catches that shape of forgery.
-//
-// UNSIGNED CONVENIENCE FIELDS ARE NEVER LOAD-BEARING ON THEIR OWN. The
-// body also carries `startedAt`, `agentType` and `parentSource` outside
-// the signed tuple, for display and for readers (`listInflightRecords`,
-// `harness gc`) that intentionally skip signature verification because
-// they are deciding retention, not trust. `verifyInflightRecord` treats
-// every one of those unsigned fields as untrustworthy on its own: it
-// requires `startedAt` to equal the SIGNED `approvedAt` byte-for-byte
-// (the writer always sets them to the same instant), and it requires
-// `agentType`/`parentSource` to equal the values parsed back out of the
-// SIGNED `approvedBy` string. Either disagreement is `forged`, never a
-// silent fallback to the signed value — an editable field that could
-// diverge from its signed twin without consequence would be exactly the
-// same hole as trusting the unsigned field outright. Staleness itself is
-// therefore computed from `approvedAt` (signed), not `startedAt`
-// (unsigned): reviving an expired record by rewriting its unsigned
-// timestamp is closed by verification failing outright, not merely by
-// picking "the right" field to trust.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { atomicWriteFile } from "../../../io/atomic-write.js";
-import { readRegularFileRejectingSymlink } from "../../../io/read-regular-file.js";
-import { safeJsonParse } from "../../../io/safe-json-parse.js";
-import { signMarker, verifyMarkerSignature } from "../../../runtime/approval-signing.js";
-import { rejectMalformedSessionId } from "../../../runtime/reject-malformed-session-id.js";
-/** Directory holding in-flight records, a sibling of `.approvals/` and `.delegations/` under `generatedDir`. */
-export const INFLIGHT_RECORD_DIRNAME = ".inflight";
-/** Default staleness window: a record older than this is treated as dead weight even though nothing ever cleared it. */
-export const DEFAULT_INFLIGHT_STALE_AFTER_MS = 24 * 60 * 60 * 1000;
-/** Prefix of the signed markerId, mirroring `delegation-<child-sid>`. */
-const INFLIGHT_MARKER_ID_PREFIX = "inflight:";
-/**
- * An agent id is a value Claude Code hands the hook, never one the
- * repository's own path-traversal-sensitive session ids need to share
- * a shape with, but it lands in `path.join` the same way, so it gets
- * its own narrow allowlist rather than reusing
- * `rejectMalformedSessionId`'s looser "no `/`, `\`, `..`" rule: 1..128
- * characters, first character alphanumeric (so it can never literally
- * be `.` or `..`), every other character one of
- * `[A-Za-z0-9._-]` (no control characters, no path separators).
- */
-const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-/** Rejects an agent id outside the allowlist above. Throws; never returns a value. */
-export function rejectMalformedAgentId(agentId) {
-    if (agentId.length === 0) {
-        throw new Error("agentId is empty");
-    }
-    if (agentId.length > 128) {
-        throw new Error(`agentId exceeds 128 characters (got ${agentId.length})`);
-    }
-    if (!AGENT_ID_RE.test(agentId)) {
-        throw new Error(`agentId must start with an alphanumeric character and contain only letters, digits, ".", "_", or "-": ${JSON.stringify(agentId)}`);
-    }
-}
-/**
- * The signed markerId for a record: `inflight:<sessionId>:<agentId>`.
- * Binding both ids into the signed payload is what stops a validly
- * signed record from being copied onto another agent id, or another
- * session, and still verifying.
- */
-export function inflightMarkerIdFor(sessionId, agentId) {
-    return `${INFLIGHT_MARKER_ID_PREFIX}${sessionId}:${agentId}`;
-}
-/**
- * Filesystem path of a subagent's in-flight record:
- * `<generatedDir>/.inflight/<sessionId>/<agentId>`. Validates both ids
- * before they reach `path.join`, the same defensive posture every
- * other marker path function in this pack takes.
- */
-export function inflightRecordPathFor(generatedDir, sessionId, agentId) {
-    rejectMalformedSessionId(sessionId);
-    rejectMalformedAgentId(agentId);
-    return path.join(generatedDir, INFLIGHT_RECORD_DIRNAME, sessionId, agentId);
-}
-/**
- * `agentType` is a Claude-Code-supplied label (e.g. `general-purpose`)
- * that rides inside the signed `approvedBy` string as a `:`-delimited
- * segment, so it gets the narrowest allowlist that keeps it from ever
- * introducing a `:` (which `parseInflightApprovedBy` relies on to find
- * the `:parent=` boundary) or a control character: 1..64 characters,
- * first character alphanumeric, every other character one of
- * `[A-Za-z0-9._-]`.
- */
-const AGENT_TYPE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-/**
- * Clock-skew tolerance for a record's signed `approvedAt`: an approval
- * timestamp more than this far in the future cannot come from a clock
- * this process trusts, so it is never matched — but unlike a forgery it
- * is not evidence of tampering (a clock can simply be wrong), so it is
- * reported as `stale`, the same bucket `harness gc` and the doctor
- * listing already sweep on the aged side of the window.
- */
-const INFLIGHT_FUTURE_SKEW_MS = 5 * 60 * 1000;
-/** The exact shape `writeInflightRecord` signs into `approvedBy`. */
-const INFLIGHT_APPROVED_BY_RE = /^inflight:([A-Za-z0-9][A-Za-z0-9._-]{0,63}):parent=(task|session)$/;
-/**
- * Parse a signed `approvedBy` string back into the bindings it carries.
- * `null` on anything that does not match the exact shape
- * `writeInflightRecord` produces — this is the reader half of "every
- * binding travels inside `approvedBy`" (see the module header): a
- * value the writer could not have produced is never trusted as a source
- * of bindings, even though its bytes passed HMAC verification (a valid
- * signature only proves the bytes were signed by this key, not that
- * they match the shape a caller can safely destructure).
- */
-function parseInflightApprovedBy(approvedBy) {
-    const match = INFLIGHT_APPROVED_BY_RE.exec(approvedBy);
-    if (match === null)
-        return null;
-    const [, agentType, parentSource] = match;
-    return { agentType: agentType, parentSource: parentSource };
-}
-/**
- * Write a signed in-flight record, but only when `parent` names a
- * MATCHED operator approval — a record is a copy of authority the
- * parent already had, never a new grant, so an unmatched parent
- * refuses outright with nothing written: the guard below is the entire
- * enforcement point, not a redundant belt-and-suspenders check on top
- * of some other gate. Atomic and mode 0600, like every other marker
- * write in this pack.
- */
-export function writeInflightRecord(opts) {
-    if (!opts.parent.matched || opts.parent.source === null) {
-        return {
-            ok: false,
-            reason: "parent_not_approved",
-            detail: "refusing to write an in-flight record: the parent has no matched operator approval",
-        };
-    }
-    if (!AGENT_TYPE_RE.test(opts.agentType)) {
-        return {
-            ok: false,
-            reason: "malformed_agent_type",
-            detail: `agentType must be 1-64 characters, first character alphanumeric, every other character one of letters, digits, ".", "_", or "-": ${JSON.stringify(opts.agentType)}`,
-        };
-    }
-    let filePath;
-    try {
-        filePath = inflightRecordPathFor(opts.generatedDir, opts.sessionId, opts.agentId);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            reason: "invalid-input",
-            detail: err instanceof Error ? err.message : String(err),
-        };
-    }
-    const parentSource = opts.parent.source;
-    const startedAt = (opts.now ?? new Date()).toISOString();
-    const markerId = inflightMarkerIdFor(opts.sessionId, opts.agentId);
-    const signed = signMarker(opts.generatedDir, markerId, {
-        approvedAt: startedAt,
-        approvedBy: `inflight:${opts.agentType}:parent=${parentSource}`,
-        reportContentHash: null,
-    });
-    const body = {
-        sessionId: opts.sessionId,
-        agentId: opts.agentId,
-        agentType: opts.agentType,
-        startedAt,
-        parentSource,
-        parentDetail: opts.parent.detail,
-        ...signed,
-    };
-    try {
-        atomicWriteFile(filePath, `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
-    }
-    catch (err) {
-        return {
-            ok: false,
-            reason: "write-failed",
-            detail: err instanceof Error ? err.message : String(err),
-        };
-    }
-    return { ok: true, filePath };
-}
-/**
- * Consult the in-flight record for `(sessionId, agentId)`. Checks, in
- * order: the `.inflight/` root and the session directory are real
- * directories, not symlinks (module header, "CONTAINMENT"); the
- * requested `agentId` names an EXACT directory entry, not merely a path
- * that resolves (guards a case-insensitive filesystem); the file is
- * present and JSON-readable; its signature verifies against
- * `inflight:<sessionId>:<agentId>` RECOMPUTED FROM THE REQUESTED ids
- * (never from anything stored in the body); its own `sessionId`/`agentId`
- * fields agree with those requested ids (the check the signature alone
- * cannot make, see the module header); it is not older than the
- * staleness window.
- *
- * Fail-closed shape mirrors `verifyDelegation`: every refusal names a
- * distinct reason, `forged` and `stale` are reachable only from the
- * branches documented above, and there is no branch that turns a
- * missing, malformed, moved, or aged record into `matched: true`.
- */
-export function verifyInflightRecord(generatedDir, sessionId, agentId, opts = {}) {
-    let filePath;
-    try {
-        filePath = inflightRecordPathFor(generatedDir, sessionId, agentId);
-    }
-    catch (err) {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `invalid sessionId/agentId for in-flight record: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    // lstat the root and the session directory before ever reading the
-    // leaf, mirroring `listInflightRecords`' own guard: a `readdirSync` or
-    // `readFileSync` reached only by following a symlink out of
-    // `.inflight/` would let a linked root or session directory smuggle a
-    // record from elsewhere on disk. Absent, a symlink, or not a directory
-    // all read as "no record" here, never `forged`: none of them is
-    // evidence of a tampered signature, only that the expected containment
-    // does not hold.
-    const rootDir = path.join(generatedDir, INFLIGHT_RECORD_DIRNAME);
-    const sessionDir = path.join(rootDir, sessionId);
-    for (const dir of [rootDir, sessionDir]) {
-        let dirStat;
-        try {
-            dirStat = fs.lstatSync(dir);
-        }
-        catch {
-            return { matched: false, forged: false, stale: false, detail: `no in-flight record at ${filePath}` };
-        }
-        if (!dirStat.isDirectory()) {
-            return {
-                matched: false,
-                forged: false,
-                stale: false,
-                detail: `no in-flight record at ${filePath} (${dir} is not a plain directory)`,
-            };
-        }
-    }
-    // The requested agentId must name an EXACT entry in the session
-    // directory, not merely a path `path.join` can resolve to. On a
-    // case-insensitive filesystem the read below would happily open a
-    // differently-cased sibling's record; its signature — recomputed from
-    // the REQUESTED, case-variant id — would then fail to verify and be
-    // classified forged, even though nothing was tampered with. A
-    // case-variant request simply names no record; `readdirSync` lists
-    // literal entry names regardless of the filesystem's own case
-    // sensitivity, so this is the one check that can tell the two apart.
-    //
-    // ONLY the agentId segment gets this exact-entry check. The sessionId
-    // segment (the `sessionDir` lstat above) inherits whatever the
-    // underlying filesystem does with `path.join` + `lstatSync`: on a
-    // case-insensitive volume a case-variant sessionId still resolves to
-    // the same directory, so the lstat passes, and the record is read and
-    // signature-checked against the REQUESTED (case-variant) sessionId —
-    // which the SIGNED body never matches, so it comes back `forged`, not
-    // "no record". This is the same fail-closed outcome the module header
-    // argues for generally; it is merely a less precise diagnostic than
-    // the agentId case gets (see the ADR's "TTL, cwd, and subagents"
-    // section for the write side that never produces one anyway: session
-    // ids are runtime-generated UUIDs, not operator-chosen strings, so a
-    // case collision is not a realistic write-time input).
-    let sessionEntries;
-    try {
-        sessionEntries = fs.readdirSync(sessionDir);
-    }
-    catch {
-        return { matched: false, forged: false, stale: false, detail: `no in-flight record at ${filePath}` };
-    }
-    if (!sessionEntries.includes(agentId)) {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `no in-flight record at ${filePath} (no exact entry named ${JSON.stringify(agentId)} in ${sessionDir})`,
-        };
-    }
-    const read = readRegularFileRejectingSymlink(filePath);
-    if (read.kind === "missing") {
-        return { matched: false, forged: false, stale: false, detail: `no in-flight record at ${filePath}` };
-    }
-    if (read.kind === "symlink") {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `in-flight record is a symlink, refusing for safety: ${filePath}`,
-        };
-    }
-    if (read.kind === "not-regular") {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `in-flight record path is not a regular file: ${filePath}`,
-        };
-    }
-    if (read.kind === "unreadable") {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `in-flight record at ${filePath} exists but could not be read (I/O error); treating as absent since its signature cannot be verified`,
-        };
-    }
-    const parsed = safeJsonParse(read.content);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `unparsable in-flight record body at ${filePath}`,
-        };
-    }
-    const body = parsed;
-    const markerId = inflightMarkerIdFor(sessionId, agentId);
-    const verification = verifyMarkerSignature(generatedDir, markerId, body);
-    if (!verification.ok) {
-        if (verification.kind === "key-unavailable") {
-            // Fail-closed I/O problem, not evidence of tampering — same
-            // distinction `verifyDelegation` draws for its own `unreadable`.
-            return {
-                matched: false,
-                forged: false,
-                stale: false,
-                detail: `in-flight record at ${filePath} could not be verified: ${verification.reason}`,
-            };
-        }
-        return {
-            matched: false,
-            forged: true,
-            stale: false,
-            detail: `forged/unsigned in-flight record rejected: ${verification.reason} (${filePath})`,
-        };
-    }
-    const bodySessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : undefined;
-    const bodyAgentId = typeof body["agentId"] === "string" ? body["agentId"] : undefined;
-    if (bodySessionId !== sessionId || bodyAgentId !== agentId) {
-        return {
-            matched: false,
-            forged: true,
-            stale: false,
-            detail: `in-flight record at ${filePath} disagrees with its own path (body sessionId=${JSON.stringify(bodySessionId)}, agentId=${JSON.stringify(bodyAgentId)}, expected ${sessionId}/${agentId})`,
-        };
-    }
-    // `verifyMarkerSignature` already rejected a non-string/empty
-    // `approvedAt` before returning `ok: true`, so this cast is safe; the
-    // finite-instant check below still guards against a signed-but-garbage
-    // value (e.g. a non-date string that happens to be non-empty).
-    const approvedAt = body["approvedAt"];
-    const approvedAtMs = Date.parse(approvedAt);
-    if (!Number.isFinite(approvedAtMs)) {
-        return {
-            matched: false,
-            forged: true,
-            stale: false,
-            detail: `in-flight record at ${filePath} has a signed approvedAt that is not a valid instant: ${JSON.stringify(approvedAt)}`,
-        };
-    }
-    // The unsigned `startedAt` convenience field must agree with the
-    // SIGNED `approvedAt` byte-for-byte (the writer always sets them to
-    // the same instant). Divergence means the unsigned copy was edited
-    // after signing — the shape that would revive an aged, genuinely
-    // stale record by rewriting only its unsigned timestamp.
-    const startedAt = typeof body["startedAt"] === "string" ? body["startedAt"] : undefined;
-    if (startedAt !== approvedAt) {
-        return {
-            matched: false,
-            forged: true,
-            stale: false,
-            detail: `in-flight record at ${filePath} has an unsigned startedAt that disagrees with its signed approvedAt (startedAt=${JSON.stringify(startedAt)}, approvedAt=${JSON.stringify(approvedAt)})`,
-        };
-    }
-    // `approvedBy` is likewise guaranteed a non-empty string by
-    // `verifyMarkerSignature`. Its parsed bindings must agree with the
-    // unsigned `agentType`/`parentSource` fields the body carries for
-    // display — an attacker who could edit only the unsigned pair (the
-    // signed `approvedBy` unchanged) would otherwise reach the success
-    // detail below with a body/approvedBy that disagree.
-    const approvedBy = body["approvedBy"];
-    const bindings = parseInflightApprovedBy(approvedBy);
-    const bodyAgentType = typeof body["agentType"] === "string" ? body["agentType"] : undefined;
-    const bodyParentSource = typeof body["parentSource"] === "string" ? body["parentSource"] : undefined;
-    if (bindings === null || bindings.agentType !== bodyAgentType || bindings.parentSource !== bodyParentSource) {
-        return {
-            matched: false,
-            forged: true,
-            stale: false,
-            detail: `in-flight record at ${filePath} has an approvedBy binding that disagrees with its own body (approvedBy=${JSON.stringify(approvedBy)}, body agentType=${JSON.stringify(bodyAgentType)}, parentSource=${JSON.stringify(bodyParentSource)})`,
-        };
-    }
-    const nowMs = (opts.now ?? new Date()).getTime();
-    const staleAfterMs = opts.staleAfterMs ?? DEFAULT_INFLIGHT_STALE_AFTER_MS;
-    // A clock this process trusts would never see its own signed approval
-    // land more than a few minutes in the future; treat it like staleness
-    // (not a forgery) since a clock skew is not evidence of tampering.
-    if (approvedAtMs - nowMs > INFLIGHT_FUTURE_SKEW_MS) {
-        return {
-            matched: false,
-            forged: false,
-            stale: true,
-            detail: `in-flight record at ${filePath} is dated more than ${INFLIGHT_FUTURE_SKEW_MS / 60_000} minutes in the future: approved at ${approvedAt}`,
-        };
-    }
-    // `nowMs - approvedAtMs > staleAfterMs`, not the reverse: swapping the
-    // comparison would mark a fresh record stale and a genuinely stale one
-    // fresh.
-    if (nowMs - approvedAtMs > staleAfterMs) {
-        return {
-            matched: false,
-            forged: false,
-            stale: true,
-            detail: `in-flight record at ${filePath} is stale: approved at ${approvedAt}`,
-        };
-    }
-    return {
-        matched: true,
-        forged: false,
-        stale: false,
-        detail: `in-flight record matched: agent ${agentId} (${bindings.agentType}), parent=${bindings.parentSource}, approved at ${approvedAt}`,
-    };
-}
-/**
- * Remove a subagent's in-flight record, then best-effort remove its
- * now-possibly-empty session directory. Never throws when the record,
- * or the session directory, is already gone — mirrors
- * `clearApprovalMarker` / `clearTaskApprovalMarker`.
- */
-export function clearInflightRecord(generatedDir, sessionId, agentId) {
-    let filePath;
-    try {
-        filePath = inflightRecordPathFor(generatedDir, sessionId, agentId);
-    }
-    catch {
-        return;
-    }
-    try {
-        fs.rmSync(filePath);
-    }
-    catch {
-        /* already gone */
-    }
-    try {
-        fs.rmdirSync(path.dirname(filePath));
-    }
-    catch {
-        /* not empty, or already gone */
-    }
-}
-/**
- * Read-only audit listing of every in-flight record on disk, mirroring
- * `buildUgDelegations`'s own shape: no signature check (this is
- * evidence for `harness doctor` and `harness gc`, not a trust
- * decision), tolerant of a missing `.inflight/` directory (empty
- * result rather than an error), and an entry gc/doctor cannot make
- * sense of is `skipped` rather than silently dropped.
- *
- * lstat the root itself first, not a bare `readdirSync`-then-catch: a
- * `readdirSync` on a symlinked `.inflight/` would happily follow it and
- * list whatever real directory it points at, the same trap
- * `sweepInflightRecords` in `src/cli/gc/index.ts` already guards
- * against one level up. A symlinked or non-directory root reads as
- * absent here too, for the same reason `buildUgInflight` already lstats
- * before calling this function: it must not report on records reached
- * only by following a link out of `.inflight/`.
- */
-export function listInflightRecords(generatedDir, now, staleAfterMs) {
-    const dir = path.join(generatedDir, INFLIGHT_RECORD_DIRNAME);
-    const nowMs = (now ?? new Date()).getTime();
-    const effectiveStaleAfterMs = staleAfterMs ?? DEFAULT_INFLIGHT_STALE_AFTER_MS;
-    let rootStat;
-    try {
-        rootStat = fs.lstatSync(dir);
-    }
-    catch {
-        return { total: 0, stale: 0, sessions: [], skipped: [] };
-    }
-    if (!rootStat.isDirectory()) {
-        return { total: 0, stale: 0, sessions: [], skipped: [] };
-    }
-    let sessionDirents;
-    try {
-        sessionDirents = fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return { total: 0, stale: 0, sessions: [], skipped: [] };
-    }
-    let total = 0;
-    let stale = 0;
-    const sessions = [];
-    const skipped = [];
-    for (const sessionDirent of sessionDirents) {
-        const sessionPath = path.join(dir, sessionDirent.name);
-        if (!sessionDirent.isDirectory()) {
-            skipped.push(sessionPath);
-            continue;
-        }
-        try {
-            rejectMalformedSessionId(sessionDirent.name);
-        }
-        catch {
-            skipped.push(sessionPath);
-            continue;
-        }
-        let agentDirents;
-        try {
-            agentDirents = fs.readdirSync(sessionPath, { withFileTypes: true });
-        }
-        catch {
-            skipped.push(sessionPath);
-            continue;
-        }
-        const agentIds = [];
-        for (const agentDirent of agentDirents) {
-            const full = path.join(sessionPath, agentDirent.name);
-            if (!agentDirent.isFile()) {
-                skipped.push(full);
-                continue;
-            }
-            try {
-                rejectMalformedAgentId(agentDirent.name);
-            }
-            catch {
-                skipped.push(full);
-                continue;
-            }
-            const read = readRegularFileRejectingSymlink(full);
-            if (read.kind !== "ok") {
-                skipped.push(full);
-                continue;
-            }
-            const parsed = safeJsonParse(read.content);
-            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                skipped.push(full);
-                continue;
-            }
-            const body = parsed;
-            // No signature check here (audit listing, not a trust decision —
-            // see the function doc), so this reads the SAME `approvedAt`
-            // field `verifyInflightRecord` trusts only once it has verified
-            // the signature: an unsigned `startedAt` copy is never consulted,
-            // by either reader, for a staleness decision.
-            const approvedAt = typeof body["approvedAt"] === "string" ? body["approvedAt"] : undefined;
-            const approvedAtMs = approvedAt !== undefined ? Date.parse(approvedAt) : NaN;
-            if (approvedAt === undefined || !Number.isFinite(approvedAtMs)) {
-                skipped.push(full);
-                continue;
-            }
-            total += 1;
-            agentIds.push(agentDirent.name);
-            // Aged past the window, or dated implausibly far in the future
-            // (clock skew, or a tampered field this listing does not verify):
-            // both count as `stale` here, mirroring `verifyInflightRecord`'s
-            // own future-skew handling.
-            if (nowMs - approvedAtMs > effectiveStaleAfterMs || approvedAtMs - nowMs > INFLIGHT_FUTURE_SKEW_MS) {
-                stale += 1;
-            }
-        }
-        if (agentIds.length > 0) {
-            sessions.push({ sessionId: sessionDirent.name, agentIds });
-        }
-    }
-    return { total, stale, sessions, skipped };
-}
-//# sourceMappingURL=inflight-records.js.map

package/dist/policy-packs/builtin/understanding-before-execution/inflight-records.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inflight-records.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/inflight-records.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,8DAA8D;AAC9D,+DAA+D;AAC/D,oEAAoE;AACpE,qBAAqB;AACrB,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,oEAAoE;AACpE,wDAAwD;AACxD,qEAAqE;AACrE,gFAAgF;AAChF,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,oEAAoE;AACpE,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,iEAAiE;AACjE,mEAAmE;AACnE,sEAAsE;AACtE,sCAAsC;AAEtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAG3F,gHAAgH;AAChH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE,yEAAyE;AACzE,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEzD,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,yGAAyG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IACpE,OAAO,GAAG,yBAAyB,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC5F,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,oEAAoE,CAAC;AAErG;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,UAAkB;IAElB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,SAAmB,EAAE,YAAY,EAAE,YAAoC,EAAE,CAAC;AAChG,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,oIAAoI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;SAC7K,CAAC;IACJ,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAyB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;QACrD,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,YAAY,IAAI,CAAC,SAAS,WAAW,YAAY,EAAE;QAC/D,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,YAAY;QACZ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAChC,GAAG,MAAM;KACV,CAAC;IACF,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,OAAoC,EAAE;IAEtC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,4DAA4D;IAC5D,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0BAA0B,QAAQ,KAAK,GAAG,4BAA4B;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,8DAA8D;IAC9D,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,EAAE;IACF,sEAAsE;IACtE,+DAA+D;IAC/D,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,uDAAuD;IACvD,IAAI,cAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B,QAAQ,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,UAAU,GAAG;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uDAAuD,QAAQ,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gDAAgD,QAAQ,EAAE;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,sGAAsG;SAC9I,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uCAAuC,QAAQ,EAAE;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAE/C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,EAAE;aACxF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,uBAAuB,QAAQ,gDAAgD,IAAI,CAAC,SAAS,CAC3F,aAAa,CACd,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,IAAI,OAAO,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,yDAAyD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC7H,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,yDAAyD;IACzD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,mFAAmF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;SACjM,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QAC5G,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,2EAA2E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG;SACnP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,+BAA+B,CAAC;IAE1E,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,uBAAuB,uBAAuB,GAAG,MAAM,uCAAuC,UAAU,EAAE;SAClJ,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,SAAS;IACT,IAAI,KAAK,GAAG,YAAY,GAAG,YAAY,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,0BAA0B,UAAU,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,mCAAmC,OAAO,KAAK,QAAQ,CAAC,SAAS,aAAa,QAAQ,CAAC,YAAY,iBAAiB,UAAU,EAAE;KACzI,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC1F,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,GAAU,EACV,YAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,qBAAqB,GAAG,YAAY,IAAI,+BAA+B,CAAC;IAE9E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,QAAQ,GAAqD,EAAE,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,wBAAwB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,IAAI,YAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAiC,CAAC;YAC/C,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,YAAY,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7E,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,4BAA4B;YAC5B,IAAI,KAAK,GAAG,YAAY,GAAG,qBAAqB,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;gBACnG,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/ledger.d.ts

@@ -1,25 +0,0 @@
-import { type LedgerEntry } from "../../../policies/index.js";
-export declare const APPROVED_LEDGER_TAG_PREFIX = "understanding-approved:";
-/** Build the per-session ledger tag the pack searches for. */
-export declare function approvedLedgerTagFor(sessionId: string): string;
-/**
- * Phase 6 #6 — substring-pollution defence shared by every PreToolUse
- * blocker (Claude Code + Codex). Drops policy_decision rows so a
- * `understanding-approved:<sess>` substring inside an audit row's
- * JSON-encoded `reason` cannot accidentally satisfy the gate.
- */
-export declare function isPolicyDecisionRow(e: LedgerEntry): boolean;
-/**
- * Match a ledger fetch against the per-session approval tag. Kept for
- * the audit / forensics path only: a ledger entry tagged
- * `understanding-approved:<sid>` is no longer a sufficient signal to
- * unblock the gate (agent-tasks/88ca4bb3: the agent has the same MCP
- * surface and could self-write the row). Use `checkApprovalMarker`
- * for the gate decision; this helper now serves `harness audit` /
- * `harness explain --trace` style read paths that surface the
- * historic ledger trail without granting approval power.
- */
-export declare function matchLedgerEntries(entries: LedgerEntry[], sessionId: string): {
-    matched: boolean;
-    detail: string;
-};