@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/runtime/approval-signing.js

@@ -1,384 +0,0 @@
-// harness/f9485cc7 — HMAC signing for Understanding Gate / branch-protection
-// approval markers.
-//
-// BACKGROUND: the marker at `harness.generated/.approvals/<id>` is the
-// canonical "operator said go" signal (agent-tasks/88ca4bb3). Its integrity
-// has rested entirely on an UNENFORCED invariant: "no configured MCP exposes
-// a filesystem-write primitive" (understanding-before-execution.md
-// "Approval state"). Edit / Write / Bash are gated by the same PreToolUse
-// hook this marker satisfies, so today the agent has no path to WRITE the
-// marker file. But nothing technical stops a future MCP tool with local
-// file-write from silently reopening that hole: its tool name would not
-// match the pack's `Edit|Write|Bash` blocker matcher, so a write through it
-// would land un-gated. Before this module, the marker's contract was
-// "existence is enough" (see the removed `checkApprovalMarker` comment) —
-// exactly the shape a forger only needs a bare filesystem-write for. This
-// module makes forging also require the operator-side HMAC key, so a marker
-// planted through any write-primitive the blocker does not enumerate still
-// fails the gate unless it carries a valid signature.
-//
-// HONEST TRUST MODEL (read this before assuming more than it delivers):
-//
-//   - This does NOT create a read boundary. The `understanding-before-
-//     execution` PreToolUse blocker matches tool names `Edit|Write|Bash`
-//     only — it does not gate `Read`, and no permission profile in this
-//     repo scopes `Read` away from any path (see
-//     `src/policy-packs/permission-translator.ts`: `read` maps to
-//     `["Read", "Glob", "Grep"]` with `allow:true` in every v1 profile).
-//     So ANY file on local disk — including the signing key, wherever it
-//     lives — is readable by the ordinary, always-available `Read` tool,
-//     approved or not. Storing the key outside `harness.generated/` would
-//     not change this; the write barrier is per-tool-name, not per-path.
-//   - The residual this leaves: an agent (or anything running as the same
-//     OS user) that can (a) read arbitrary local files — true today, by
-//     design, via `Read` — AND (b) write to `harness.generated/.approvals/`
-//     through some primitive NOT covered by the `Edit|Write|Bash` blocker
-//     matcher, CAN forge a validly-signed marker: it reads the key with
-//     Read, computes the HMAC itself, and writes the result through the
-//     uncovered write path. Signing does not close this combined case; it
-//     closes the narrower (and, before this, the ONLY defended) case where
-//     the forger has a write primitive but no matching ability to also
-//     recompute a valid signature for it (e.g. a narrow single-purpose
-//     write channel, or a human/script that copies bytes without reading
-//     back the operator's key file), and it makes ANY forgery attempt one
-//     step more expensive and forensically visible (a key read is a
-//     distinguishable event; a bare unsigned-JSON write no longer is).
-//   - SECOND MINTING PATH (agent-tasks/74b4b17d, ADR
-//     docs/decisions/2026-08-27-ug-auto-mode-approval.md): the residual
-//     above was a CONJUNCTION, read the key AND write through an
-//     uncovered primitive. Since the `auto_approve` opt-in of the
-//     `understanding-before-execution` pack, the PreToolUse hook itself
-//     can write a validly signed session marker (`approvedBy:
-//     auto-mode:<harness>:<mode>`) when the payload's `permission_mode`
-//     is allowlisted and a strict-session `pending` report exists. Any
-//     process that can invoke `harness pack hook pre-tool-use` with a
-//     stdin payload and `CLAUDE_CODE_SESSION_ID` of its choosing therefore
-//     obtains a signed marker for that session id WITHOUT reading the
-//     key: the residual is now a DISJUNCTION, read the key, OR make the
-//     hook sign for you. Reach, honestly: pre-approval the oracle is
-//     unreachable (invoking it is a Bash call, and `pack` is not on the
-//     read-only allowlist in `src/runtime/read-only-bash.ts`), so this
-//     is not an escalation over the post-approval write class, which can
-//     already forge by the key-read route; it is a cheaper and less
-//     forensically visible post-approval route (no key read to notice),
-//     and it is why the auto path never creates the key (explicit
-//     key-exists precheck before the shared write path), consumes the
-//     report it used, declines on a forged marker, and applies only
-//     after every existing exemption branch has declined. The pack's
-//     doctor listing of `auto-mode:` markers is the audit surface for it.
-//   - THIRD SIGNED ARTIFACT KIND (agent-tasks/37ad0b05, ADR
-//     docs/decisions/2026-08-27-ug-auto-mode-approval.md, slice 3): a
-//     DELEGATION is a third kind of thing this module signs, alongside
-//     the approval marker and the branch-protection marker, and it is
-//     not an approval, it is a pre-authorization a parent session
-//     issues for a `claude -p` child before the child's own report even
-//     exists. It is written to its own directory,
-//     `<generatedDir>/.delegations/`, never `.approvals/`, under
-//     markerId `delegation-<child-sid>` (`delegation-markers.ts`), so a
-//     copy of one into the other directory fails signature verification
-//     on markerId mismatch in both directions. Every binding (parent
-//     session, cwd, task, expiry, and, in the fallback shape, the
-//     launcher-supplied report's path) is packed into the signed
-//     `approvedBy` string rather than a new signed field, for the same
-//     no-migration reason the auto-marker's source lives there too. On
-//     a delegation, unlike on an approval marker, `reportContentHash`
-//     does NOT mean "the persisted report the operator approved", it
-//     means, when present at all, the sha256 of the launcher-supplied
-//     report FILE the parent wrote at spawn time (a file that need
-//     never become a persisted report byte-for-byte). A reader that
-//     consumes `reportContentHash` has to branch on the artifact kind
-//     (`.approvals/` vs. `.delegations/`, or the markerId prefix)
-//     before deciding what the hash refers to; treating the two
-//     uniformly would misread one of them. `harness delegate` is
-//     therefore a SECOND CLI writer into the signing scheme, beside the
-//     `harness approve` verbs: same key, same HMAC primitive, a
-//     different markerId namespace and a different meaning for one of
-//     the four signed fields.
-//   - Given the agent and operator share one OS user account on this
-//     machine, this is deliberately pragmatic defense-in-depth, not a hard
-//     authorization boundary. It is documented here in full rather than
-//     oversold.
-//
-// KEY STORAGE: `<generatedDir>/.approval-signing.key` — a raw 32-byte
-// secret, mode 0600, generated lazily on first use (by `harness approve
-// understanding` / `harness approve branch-protection`, or by `harness
-// init` — see src/cli/init/index.ts; NEVER by the PreToolUse hook's auto
-// path, which prechecks that the key exists and blocks when it does not). Colocated with `harness.generated/`
-// (not a separate home-dir path) so:
-//   - it inherits the SAME test-isolation guarantee every marker/report
-//     path already has (every call site here already threads an explicit,
-//     test-injectable `generatedDir` — no new parameter, no new way to
-//     leak into a real `~/.harness/` during a test run);
-//   - it is gitignored by the SAME existing convention as the rest of
-//     `harness.generated/` (docs/ARCHITECTURE.md: "harness.generated/ ...
-//     is .gitignore'd", unlike `harness.yaml` itself, which operators
-//     often check into a dotfiles repo) — a home-dir-anchored path could
-//     land inside a version-controlled directory when the operator
-//     resolves `harness.yaml` via `--config` into a repo tree; this can't;
-//   - `harness apply` never wipes it (apply only ever writes its own known
-//     files under `harness.generated/`; unknown siblings survive
-//     byte-for-byte — the same guarantee `.approvals/` and
-//     `.pending-approval` already rely on).
-//   `harness uninstall` DOES remove it (it rm -rf's the whole
-//   `generatedDir`) — a deliberate, rare, operator-initiated teardown, so
-//   losing the key (and therefore invalidating every marker it signed) is
-//   an acceptable side effect, not a silent regression.
-//
-// ROTATION: delete `<generatedDir>/.approval-signing.key` (or call
-// `rotateSigningKey`). The next `writeApprovalMarker` /
-// `writeBranchProtectionMarker` / any signature check lazily regenerates
-// it. Every marker signed under the OLD key immediately fails verification
-// (forged:true) and the gate demands re-approval — this is the intended,
-// documented blast radius of a rotation, not a bug.
-//
-// BACK-COMPAT: strict, no migration window. A marker written before this
-// feature shipped (or hand-written without the key) carries no `signature`
-// field and is REJECTED (see `verifyMarkerSignature`), exactly like a
-// forgery. Operator impact: upgrading harness on a machine with a live,
-// previously-approved session invalidates that approval; the operator runs
-// `harness approve understanding` (and/or `harness approve
-// branch-protection`) once more. Chosen over a grace-period migration
-// because a migration window is, by construction, a window where the
-// exact vulnerability this task closes (an unsigned marker satisfies the
-// gate) still holds.
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-/** Versioned algorithm tag, so a future re-key scheme can reject mismatches explicitly rather than guess. */
-export const SIGNING_ALG = "hmac-sha256-v1";
-/** Basename of the signing-key file, a sibling of `.approvals/` under `generatedDir`. */
-export const SIGNING_KEY_BASENAME = ".approval-signing.key";
-const KEY_BYTES = 32;
-/** Filesystem path of the signing key for a given `generatedDir`. */
-export function signingKeyPathFor(generatedDir) {
-    return path.join(generatedDir, SIGNING_KEY_BASENAME);
-}
-/**
- * Read the signing key, generating one (0600, `crypto.randomBytes(32)`) on
- * first use. Race-safe-ish: a concurrent create loses the `wx` (exclusive
- * create) race and falls back to reading whatever the winner wrote, rather
- * than throwing or clobbering it. A key file shorter than `KEY_BYTES`
- * (truncated / corrupted) is treated as absent and regenerated, since a
- * short key would only weaken every future signature.
- */
-export function getOrCreateSigningKey(generatedDir) {
-    const filePath = signingKeyPathFor(generatedDir);
-    fs.mkdirSync(generatedDir, { recursive: true });
-    let fileExisted = false;
-    try {
-        const existing = fs.readFileSync(filePath);
-        fileExisted = true;
-        if (existing.length >= KEY_BYTES) {
-            return { key: existing, filePath, created: false };
-        }
-        // Falls through: truncated/corrupt key file, regenerate below. `flag:
-        // "w"` (not "wx") is used below precisely BECAUSE the file already
-        // exists here — an exclusive create would collide with it and, on
-        // EEXIST, re-read the SAME truncated bytes back, silently failing to
-        // ever repair a corrupt key.
-    }
-    catch (err) {
-        if (err.code !== "ENOENT")
-            throw err;
-    }
-    const fresh = crypto.randomBytes(KEY_BYTES);
-    if (fileExisted) {
-        // Known-corrupt/truncated file: overwrite unconditionally. No
-        // meaningful create-race to defend against — the file is already
-        // known bad, so unconditionally replacing it can only improve on
-        // the previous (unusable) contents.
-        fs.writeFileSync(filePath, fresh, { mode: 0o600 });
-        try {
-            fs.chmodSync(filePath, 0o600);
-        }
-        catch {
-            /* best-effort */
-        }
-        return { key: fresh, filePath, created: true };
-    }
-    try {
-        fs.writeFileSync(filePath, fresh, { mode: 0o600, flag: "wx" });
-        return { key: fresh, filePath, created: true };
-    }
-    catch (err) {
-        if (err.code === "EEXIST") {
-            // Lost the create race to a concurrent caller; use what they wrote.
-            return { key: fs.readFileSync(filePath), filePath, created: false };
-        }
-        throw err;
-    }
-}
-/**
- * Force a fresh key, overwriting any existing one. Every marker signed
- * under the old key stops verifying immediately (see module doc). Not
- * currently wired to a CLI verb (documented as "delete the file" for v1);
- * exported so a future `harness approve rotate-key`-style verb, or a test,
- * can call it directly without re-deriving the path convention.
- */
-export function rotateSigningKey(generatedDir) {
-    const filePath = signingKeyPathFor(generatedDir);
-    fs.mkdirSync(generatedDir, { recursive: true });
-    const fresh = crypto.randomBytes(KEY_BYTES);
-    fs.writeFileSync(filePath, fresh, { mode: 0o600 });
-    try {
-        fs.chmodSync(filePath, 0o600);
-    }
-    catch {
-        /* best-effort on platforms where chmod is a no-op (e.g. some Windows fs) */
-    }
-    return { key: fresh, filePath, created: true };
-}
-/**
- * Non-creating existence probe for the signing key: `true` only when
- * `<generatedDir>/.approval-signing.key` is a regular file carrying at
- * least `KEY_BYTES` bytes. Never creates, repairs, or rotates anything.
- *
- * Why this exists as a separate export instead of "just call
- * `getOrCreateSigningKey` and see" (ADR
- * docs/decisions/2026-08-27-ug-auto-mode-approval.md, threat model (b)
- * item 5): key CREATION is an operator-side act (`harness init` /
- * `harness approve`). The PreToolUse hook's auto-approval path
- * (agent-tasks/74b4b17d) must refuse to mint a marker on a machine that
- * has no key, but the shared write path it uses (`writeApprovalMarker`
- * -> `signMarker` -> `getOrCreateSigningKey`) treats a missing key as a
- * case to REPAIR: it generates one on ENOENT and signs with it. So the
- * auto path calls this first and blocks when it returns `false`.
- *
- * A truncated / short key file counts as absent here for the same
- * reason: `getOrCreateSigningKey` would overwrite it with a fresh key,
- * which is the same operator-side act this probe exists to keep the
- * hook out of.
- */
-export function signingKeyExists(generatedDir) {
-    try {
-        const stat = fs.statSync(signingKeyPathFor(generatedDir));
-        return stat.isFile() && stat.size >= KEY_BYTES;
-    }
-    catch {
-        return false;
-    }
-}
-/** sha256 hex digest of a string, used to bind a marker to a persisted report's content. */
-export function sha256Hex(content) {
-    return crypto.createHash("sha256").update(content, "utf8").digest("hex");
-}
-function canonicalPayload(markerId, approvedAt, approvedBy, reportContentHash, claimTaskId) {
-    // Fixed key order + JSON string-escaping makes this injective: there is
-    // no (markerId, approvedAt, approvedBy, reportContentHash) tuple that
-    // collides with a different tuple's encoding, unlike naive delimiter
-    // concatenation (e.g. "a"+"bc" vs "ab"+"c").
-    //
-    // `claimTaskId` (task 5018c0c4) is the optional fifth field: the
-    // active-claim task id a session approval marker was granted for, or
-    // `null` for "no claim held". A marker that carries no binding (every
-    // task, delegation, in-flight and verdict marker, and a session marker
-    // written by an older release) signs and verifies over exactly the
-    // same bytes as before (the first branch below): no `SIGNING_ALG`
-    // bump, no migration. A present binding
-    // (string or `null`) is inside the signed bytes, so it cannot be added,
-    // dropped or changed without failing verification.
-    if (claimTaskId === undefined) {
-        return JSON.stringify({ markerId, approvedAt, approvedBy, reportContentHash });
-    }
-    return JSON.stringify({ markerId, approvedAt, approvedBy, reportContentHash, claimTaskId });
-}
-/**
- * Sign a marker's fields for `markerId` (the marker's lookup key — a raw
- * sessionId for the understanding-gate session marker, `task-<id>` for a
- * task-scoped marker, `branch-protection-<sessionId>` for the
- * branch-protection twin). Binding `markerId` into the signed payload is
- * what stops a validly-signed marker from being copied/renamed onto a
- * DIFFERENT id and still verifying — verification always recomputes the
- * HMAC using the id the caller is checking, not one read back out of the
- * marker body.
- */
-export function signMarker(generatedDir, markerId, marker) {
-    const { key } = getOrCreateSigningKey(generatedDir);
-    const reportContentHash = marker.reportContentHash ?? null;
-    const signature = crypto
-        .createHmac("sha256", key)
-        .update(canonicalPayload(markerId, marker.approvedAt, marker.approvedBy, reportContentHash, marker.claimTaskId))
-        .digest("hex");
-    return {
-        approvedAt: marker.approvedAt,
-        approvedBy: marker.approvedBy,
-        reportContentHash,
-        ...(marker.claimTaskId !== undefined ? { claimTaskId: marker.claimTaskId } : {}),
-        alg: SIGNING_ALG,
-        signature,
-    };
-}
-/**
- * Verify a parsed marker JSON body against `markerId`. Never throws: any
- * failure to obtain the signing key (permission error, disk issue) is
- * treated as a verification failure, not an exception — the gate-side
- * caller must fail closed (not approved) rather than crash the hook
- * process, which the surrounding PreToolUse blocker would otherwise turn
- * into an uncontrolled failure mode. That specific failure mode is tagged
- * `kind: "key-unavailable"` so the caller can tell "we couldn't even check"
- * apart from "we checked and it's invalid".
- */
-export function verifyMarkerSignature(generatedDir, markerId, payload) {
-    const approvedAt = payload["approvedAt"];
-    const approvedBy = payload["approvedBy"];
-    const signature = payload["signature"];
-    const alg = payload["alg"];
-    if (typeof approvedAt !== "string" || approvedAt.length === 0) {
-        return { ok: false, reason: "missing approvedAt" };
-    }
-    if (typeof approvedBy !== "string" || approvedBy.length === 0) {
-        return { ok: false, reason: "missing approvedBy" };
-    }
-    if (typeof signature !== "string" || signature.length === 0) {
-        return {
-            ok: false,
-            reason: "missing signature (legacy pre-signing marker, or forged file)",
-        };
-    }
-    if (alg !== SIGNING_ALG) {
-        return { ok: false, reason: `unrecognized or missing alg (got ${JSON.stringify(alg)})` };
-    }
-    const reportContentHash = typeof payload["reportContentHash"] === "string"
-        ? payload["reportContentHash"]
-        : null;
-    // Optional claim binding (task 5018c0c4): absent means "no binding"
-    // (verified over the pre-binding bytes); present must be a non-empty
-    // string or `null`, anything else is a malformed marker.
-    let claimTaskId;
-    if (Object.prototype.hasOwnProperty.call(payload, "claimTaskId")) {
-        const raw = payload["claimTaskId"];
-        if (raw === null || (typeof raw === "string" && raw.length > 0)) {
-            claimTaskId = raw;
-        }
-        else {
-            return { ok: false, reason: "malformed claimTaskId (expected a non-empty string or null)" };
-        }
-    }
-    let key;
-    try {
-        ({ key } = getOrCreateSigningKey(generatedDir));
-    }
-    catch (err) {
-        return {
-            ok: false,
-            reason: `signing key unavailable (${err instanceof Error ? err.message : String(err)})`,
-            kind: "key-unavailable",
-        };
-    }
-    const expected = crypto
-        .createHmac("sha256", key)
-        .update(canonicalPayload(markerId, approvedAt, approvedBy, reportContentHash, claimTaskId))
-        .digest();
-    // No try/catch around Buffer.from(signature, "hex"): unlike JSON.parse,
-    // Buffer.from with a "hex" encoding never throws on malformed input — it
-    // silently stops decoding at the first invalid pair and returns whatever
-    // it managed to decode so far (review LOW 3). The length-mismatch check
-    // below is what actually rejects a truncated/malformed decode; relying on
-    // an exception here would have been dead code.
-    const actual = Buffer.from(signature, "hex");
-    if (actual.length !== expected.length || !crypto.timingSafeEqual(actual, expected)) {
-        return { ok: false, reason: "signature verification failed (tampered or forged)" };
-    }
-    return { ok: true };
-}
-//# sourceMappingURL=approval-signing.js.map

package/dist/runtime/approval-signing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-signing.js","sourceRoot":"","sources":["../../src/runtime/approval-signing.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,iDAAiD;AACjD,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,qDAAqD;AACrD,wEAAwE;AACxE,iEAAiE;AACjE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,0EAA0E;AAC1E,4DAA4D;AAC5D,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,kDAAkD;AAClD,iEAAiE;AACjE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,kEAAkE;AAClE,gEAAgE;AAChE,iEAAiE;AACjE,wEAAwE;AACxE,gEAAgE;AAChE,sEAAsE;AACtE,8BAA8B;AAC9B,qEAAqE;AACrE,2EAA2E;AAC3E,wEAAwE;AACxE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,8GAA8G;AAC9G,qCAAqC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,yDAAyD;AACzD,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,2DAA2D;AAC3D,4CAA4C;AAC5C,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,qBAAqB;AAErB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AACvD,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,6BAA6B;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,oCAAoC;QACpC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,oEAAoE;YACpE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,iBAAgC,EAChC,WAA2B;IAE3B,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,6CAA6C;IAC7C,EAAE;IACF,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,wCAAwC;IACxC,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9F,CAAC;AAiBD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAAgB,EAChB,MAKC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;SAC/G,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,EAAE,WAAW;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAoBD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,iBAAiB,GACrB,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,OAAO,CAAC,mBAAmB,CAAY;QAC1C,CAAC,CAAC,IAAI,CAAC;IACX,oEAAoE;IACpE,qEAAqE;IACrE,yDAAyD;IACzD,IAAI,WAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YACvF,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;SAC1F,MAAM,EAAE,CAAC;IACZ,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/runtime/bash-match-facts.d.ts

@@ -1,60 +0,0 @@
-import type { Policy } from "../schema/index.js";
-/** How a classified head token relates to the engine's own coverage. */
-export type HeadTokenClass = "git" | "non-git-set" | "documented-uncovered";
-export interface HeadTokenFact {
-    readonly token: string;
-    readonly class: HeadTokenClass;
-}
-/** Exposed for callers that need the full "genuinely not covered today" list (see `bash-match-registry.ts`). */
-export declare const DOCUMENTED_UNCOVERED_HEAD_TOKENS: ReadonlySet<string>;
-export interface PolicyBashMatchFact {
-    readonly policyName: string;
-    readonly pattern: string;
-    readonly headTokens: readonly HeadTokenFact[];
-    readonly verbs: readonly string[];
-}
-export interface BashMatchFacts {
-    /** Every FULL_TEMPLATE policy name that declares a `bash_match` trigger, verified live. */
-    readonly policyNames: readonly string[];
-    /** Per-policy detail, in the same order as `policyNames`. */
-    readonly policies: readonly PolicyBashMatchFact[];
-    /** Every distinct head token gated by ANY `bash_match` policy, flattened. */
-    readonly gatedHeadTokens: ReadonlySet<string>;
-    /** The classification of a gated head token, or `undefined` if `token` is not gated by any shipped policy at all. */
-    classify(token: string): HeadTokenClass | undefined;
-}
-/** Minimal shape this module needs from a policy — decoupled from the full zod-inferred `Policy` so fixtures can be built without constructing an entire manifest. */
-export interface BashMatchPolicyLike {
-    readonly name: string;
-    readonly trigger: {
-        readonly bash_match?: string | undefined;
-    };
-}
-/**
- * Compute verified-fresh `BashMatchFacts` from a LIVE list of parsed
- * policies. Call with `parseManifest(parseYaml(FULL_TEMPLATE)).policies`
- * to get the shipped ground truth (never hand-copy the patterns).
- *
- * Throws descriptively — the caller should let this propagate as a
- * failing test, not swallow it — when:
- *   1. The exact SET of policy names carrying a `bash_match` trigger in
- *      the live `policies` differs from the curated map's key set
- *      (a policy was added, removed, or renamed).
- *   2. A curated head token or verb is no longer present as a standalone
- *      word (`\bTOKEN\b`) in its policy's live pattern (renamed/removed
- *      within an otherwise still-existing policy).
- */
-export declare function extractBashMatchFacts(policies: readonly (BashMatchPolicyLike | Policy)[]): BashMatchFacts;
-/**
- * "Is `token` gated by ANY shipped `bash_match` policy?", the one-call
- * question both incidents got wrong. Real caller (task 209e6dc4 redesign):
- * `bash-match-registry.ts`'s `checkRegisteredSets`, via its
- * `isLegitimatelyCoverable` helper, a source-based probe over the live
- * gated-head-token vocabulary (and `PLAUSIBLE_NON_GATED_HEAD_TOKENS`),
- * never a per-declared-`member` walk; the registration surface no longer
- * has a `members` field to walk. Takes only the `gatedHeadTokens` slice of
- * `BashMatchFacts` (not the full shape) so a caller holding the same
- * narrowed `Pick` `checkRegisteredSets` accepts can call this directly
- * without widening its own parameter type.
- */
-export declare function isHeadTokenGated(facts: Pick<BashMatchFacts, "gatedHeadTokens">, token: string): boolean;

package/dist/runtime/bash-match-facts.js

@@ -1,196 +0,0 @@
-// Live facts about FULL_TEMPLATE's shipped `bash_match` policies (task
-// `074acf5d`, run `2026-07-28-manifest-facts-drift-guard`).
-//
-// WHY THIS MODULE EXISTS: two consecutive runs shipped/attempted a defect
-// of the exact same CLASS, one day and one file apart.
-//   - Run `432db3d3` (merged 2026-07-27), HIGH: `NON_GIT_HEAD_TOKENS`
-//     (`command-normalize.ts`) covered 4 of the 8 head tokens a shipped
-//     `bash_match` policy actually gates. Closed by
-//     `tests/runtime/bash-match-head-token-drift.test.ts`, but scoped to
-//     that one set in that one file.
-//   - Run `dbc6d303` (halted 2026-07-28), CRITICAL: a NEW module's
-//     `INERT_CONSUMER_HEADS` contained `harness` — itself the gated head
-//     token of `deny-kill-switch-bypass`. The prior day's guard
-//     structurally could not see it: it only ever compared ONE named set
-//     (`NON_GIT_HEAD_TOKENS`) against the manifest, never a set someone
-//     adds tomorrow.
-// This module answers, ONE call, read live (never hand-copied): "which
-// policies declare a `bash_match`, which head token(s) each anchors on,
-// which verbs, and is token X gated by ANY of them?" — the question both
-// incidents got wrong. `src/runtime/bash-match-registry.ts` builds the
-// generalised, EVERY-registered-set guard on top of the facts this module
-// produces.
-//
-// DESIGN: literal head-token extraction straight out of an arbitrary
-// regex string is fragile (alternations, nested groups, nothing
-// guarantees a token is even a bare word) — the same reasoning the
-// migrated guard's own header carried. A CURATED classification map is
-// used instead, but it is never trusted blind: `extractBashMatchFacts`
-// verifies it against the LIVE policies passed in (call it with
-// `parseManifest(parseYaml(FULL_TEMPLATE)).policies` to get the shipped
-// ground truth) and THROWS descriptively the moment the curated map and
-// the live manifest disagree — a policy added/removed/renamed, or a
-// classified token no longer present in its policy's live pattern. A
-// caller that gets a `BashMatchFacts` back without an exception is
-// holding verified-fresh facts, not a stale copy.
-//
-// LAYERING: this module takes policies as a plain parameter and does not
-// import `FULL_TEMPLATE` itself (that lives in `src/cli/init/templates.ts`,
-// the `cli` layer — `.dependency-cruiser.cjs`'s `runtime-no-upward-imports`
-// rule forbids `runtime/` importing `cli/`). The live wiring (parsing
-// FULL_TEMPLATE and calling this module) happens in test code, which the
-// boundary check does not scan.
-//
-// WHY src/runtime/, NOT tests/ (F8, fix round): this module and
-// `bash-match-registry.ts` are a single shared source of truth that TWO
-// independent test files (`bash-match-head-token-drift.test.ts`,
-// `bash-match-registry.test.ts`) import symmetrically — a module peer
-// test files both depend on belongs beside the engine code it inspects,
-// not inside the test tree that merely happens to hold its only callers
-// today.
-/**
- * The curated ground truth, verified fresh against FULL_TEMPLATE's live
- * policies by `extractBashMatchFacts` every time it runs — see the module
- * header. Keyed by policy name.
- *
- * "documented-uncovered" tokens (fix round 2, finding F1 on the migrated
- * guard — see `command-normalize.ts`'s "SHIPPED BUT NOT COVERED"
- * paragraph for why each is genuinely out of reach today, not merely
- * unimplemented): `env`, `unset`, `tee`, `cp`.
- */
-const CURATED_BASH_MATCH_FACTS = {
-    "review-before-merge-bash": {
-        headTokens: [{ token: "gh", class: "non-git-set" }],
-        verbs: ["merge"],
-    },
-    "dogfood-before-release": {
-        headTokens: [
-            { token: "npm", class: "non-git-set" },
-            { token: "git", class: "git" },
-        ],
-        verbs: ["publish", "tag"],
-    },
-    "preflight-before-investigation": {
-        headTokens: [{ token: "git", class: "git" }],
-        verbs: ["status", "log", "diff", "branch"],
-    },
-    "review-subagent-before-pr-create-bash": {
-        headTokens: [{ token: "gh", class: "non-git-set" }],
-        verbs: ["create"],
-    },
-    "preflight-before-push": {
-        headTokens: [{ token: "git", class: "git" }],
-        verbs: ["push"],
-    },
-    "deny-kill-switch-bypass": {
-        headTokens: [{ token: "harness", class: "non-git-set" }],
-        verbs: ["pause", "resume", "gate", "disable", "enable"],
-    },
-    "deny-session-env-strip": {
-        headTokens: [
-            { token: "env", class: "documented-uncovered" },
-            { token: "unset", class: "documented-uncovered" },
-        ],
-        // Headless trigger alternatives (the bare `<SESSION_VAR>=` form) and
-        // multiple independent alternations make a flat verb list misleading
-        // rather than merely incomplete — left empty rather than overclaim.
-        verbs: [],
-    },
-    "deny-pause-sentinel-forgery": {
-        headTokens: [
-            { token: "tee", class: "documented-uncovered" },
-            { token: "cp", class: "documented-uncovered" },
-        ],
-        // No separate "verb" beyond the head tokens themselves here.
-        verbs: [],
-    },
-};
-/**
- * `documented-uncovered` head tokens are collected from the curated map
- * itself (single source of truth) rather than hand-copied a second time.
- */
-function documentedUncoveredTokens() {
-    const out = new Set();
-    for (const fact of Object.values(CURATED_BASH_MATCH_FACTS)) {
-        for (const h of fact.headTokens) {
-            if (h.class === "documented-uncovered")
-                out.add(h.token);
-        }
-    }
-    return out;
-}
-/** Exposed for callers that need the full "genuinely not covered today" list (see `bash-match-registry.ts`). */
-export const DOCUMENTED_UNCOVERED_HEAD_TOKENS = documentedUncoveredTokens();
-/**
- * Compute verified-fresh `BashMatchFacts` from a LIVE list of parsed
- * policies. Call with `parseManifest(parseYaml(FULL_TEMPLATE)).policies`
- * to get the shipped ground truth (never hand-copy the patterns).
- *
- * Throws descriptively — the caller should let this propagate as a
- * failing test, not swallow it — when:
- *   1. The exact SET of policy names carrying a `bash_match` trigger in
- *      the live `policies` differs from the curated map's key set
- *      (a policy was added, removed, or renamed).
- *   2. A curated head token or verb is no longer present as a standalone
- *      word (`\bTOKEN\b`) in its policy's live pattern (renamed/removed
- *      within an otherwise still-existing policy).
- */
-export function extractBashMatchFacts(policies) {
-    const live = policies.filter((p) => p.trigger.bash_match !== undefined);
-    const actualNames = [...live.map((p) => p.name)].sort();
-    const curatedNames = Object.keys(CURATED_BASH_MATCH_FACTS).sort();
-    if (JSON.stringify(actualNames) !== JSON.stringify(curatedNames)) {
-        throw new Error(`bash_match facts drift: the live policies declaring a bash_match trigger (${JSON.stringify(actualNames)}) no longer match CURATED_BASH_MATCH_FACTS's classified set (${JSON.stringify(curatedNames)}) in src/runtime/bash-match-facts.ts. A policy was added, removed, or renamed — update the curated map consciously.`);
-    }
-    const byName = new Map(live.map((p) => [p.name, p]));
-    const gatedHeadTokens = new Set();
-    const classification = new Map();
-    const policyFacts = [];
-    for (const policyName of curatedNames) {
-        const curated = CURATED_BASH_MATCH_FACTS[policyName];
-        const policy = byName.get(policyName);
-        const pattern = policy.trigger.bash_match;
-        for (const { token, class: cls } of curated.headTokens) {
-            assertStandaloneWord(pattern, token, policyName);
-            gatedHeadTokens.add(token);
-            classification.set(token, cls);
-        }
-        for (const verb of curated.verbs) {
-            assertStandaloneWord(pattern, verb, policyName);
-        }
-        policyFacts.push({
-            policyName,
-            pattern,
-            headTokens: curated.headTokens,
-            verbs: curated.verbs,
-        });
-    }
-    return {
-        policyNames: actualNames,
-        policies: policyFacts,
-        gatedHeadTokens,
-        classify: (token) => classification.get(token),
-    };
-}
-function assertStandaloneWord(pattern, word, policyName) {
-    const standaloneWordRe = new RegExp(`\\b${word}\\b`);
-    if (!standaloneWordRe.test(pattern)) {
-        throw new Error(`bash_match facts drift: policy "${policyName}"'s live bash_match pattern no longer contains the classified word "${word}" as a standalone word (pattern: ${pattern}). It was renamed or removed — update CURATED_BASH_MATCH_FACTS in src/runtime/bash-match-facts.ts.`);
-    }
-}
-/**
- * "Is `token` gated by ANY shipped `bash_match` policy?", the one-call
- * question both incidents got wrong. Real caller (task 209e6dc4 redesign):
- * `bash-match-registry.ts`'s `checkRegisteredSets`, via its
- * `isLegitimatelyCoverable` helper, a source-based probe over the live
- * gated-head-token vocabulary (and `PLAUSIBLE_NON_GATED_HEAD_TOKENS`),
- * never a per-declared-`member` walk; the registration surface no longer
- * has a `members` field to walk. Takes only the `gatedHeadTokens` slice of
- * `BashMatchFacts` (not the full shape) so a caller holding the same
- * narrowed `Pick` `checkRegisteredSets` accepts can call this directly
- * without widening its own parameter type.
- */
-export function isHeadTokenGated(facts, token) {
-    return facts.gatedHeadTokens.has(token);
-}
-//# sourceMappingURL=bash-match-facts.js.map