@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/runtime/intercept.js

@@ -1,1384 +0,0 @@
-// Phase 4 #5 — runtime hook interceptor + policy_decision audit log.
-//
-// Pure orchestration: takes a parsed event + a ledger client + the manifest,
-// runs every matching policy through the Phase 4 #1/#2/#3 pipeline, returns
-// the decisions and the Claude Code deny-JSON (or null when all allow).
-// Side effects (stdin, stdout, ledger I/O) live in the thin CLI entrypoint
-// that wraps this.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { evaluateExtract, evaluateRequires, firstInputMatchMismatch, parseDurationSeconds, substituteTemplate, } from "../policies/index.js";
-import { renderProducers } from "../policies/producers.js";
-import { buildActionEnvelope } from "./action-envelope.js";
-import { renderAgentFacing } from "./agent-facing.js";
-import { normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, segmentViewOf, } from "./command-normalize.js";
-import { resolveEnvironment, } from "./environment-resolver.js";
-import { resolveDeletionTarget, } from "./deletion-target-resolve.js";
-import { DEFAULT_SAFE_DELETION_ROOTS } from "../schema/risk.js";
-import { resolveGitContext } from "./git-context.js";
-import { POLICY_DECISION_TYPE } from "../io/ledger-record.js";
-import { classifyRisk } from "./risk-classifier.js";
-import { resolveSessionId } from "./session-id.js";
-import { expandToolNameAliases, extractShellCommand, } from "./tool-name-aliases.js";
-import { evaluateWhen, UNCLASSIFIED_FALLBACK_SEVERITY } from "./when-eval.js";
-/**
- * The sentence PREPENDED to a `ux:`-declared policy's `cannot:` text when
- * the deny was caused by the unclassified fallback rather than a real
- * classification (task 2929c5b7).
- *
- * Everything variable in it is interpolated: the RESOLVED environment
- * name and the policy's OWN declared threshold. Hard-coding "production"
- * and "critical" made both halves wrong for an unscoped
- * `severity_at_least: high` policy on a feature branch, which reported a
- * production context that had not been resolved and a critical-severity
- * comparison that never ran. The fallback rung itself comes from
- * `when-eval.ts`'s exported constant, not a second literal here.
- *
- * A policy whose `when:` block declares no `severity_at_least` can still
- * set the flag (via `risk.category_in` / `action.reversible`, which keep
- * the blanket "unknown is not safe" fallback), so the threshold-free
- * wording is a real case, not a defensive branch.
- */
-function unclassifiedFallbackPrefix(environmentName, threshold) {
-    const env = environmentName ?? "unknown";
-    const article = /^[aeiou]/i.test(env) ? "an" : "a";
-    const lead = `This is an unclassified action in ${article} ${env} context: no risk classifier pattern recognized it, so`;
-    return threshold === undefined
-        ? `${lead} the fail-closed unclassified rule satisfied this policy's when: clause, rather than a genuine risk classification.`
-        : `${lead} the fail-closed severity fallback (treated as ${UNCLASSIFIED_FALLBACK_SEVERITY}) satisfied this policy's severity_at_least: ${threshold}, rather than a genuine ${threshold}-severity match.`;
-}
-/**
- * Build the Action Envelope for an event and run it through the Risk
- * Classifier (#3) and Context Resolver (#4). Pure: every host fact
- * arrives via `riskContext`; when it is absent the envelope is built
- * from the event alone (unclassified risk, `unknown` environment).
- */
-function enrichEnvelope(manifest, event, riskContext, now) {
-    const rc = riskContext;
-    const envelope = buildActionEnvelope(event, {
-        cwd: rc?.cwd ?? (typeof event.cwd === "string" ? event.cwd : ""),
-        git: rc?.git ?? { repo: "", branch: "", sha: "" },
-        user: rc?.user ?? "",
-        host: rc?.host ?? "",
-        now: now ?? new Date(),
-    });
-    const risk = classifyRisk(envelope, manifest.risk.classifiers);
-    const environment = resolveEnvironment(envelope, manifest.environments.resolvers, {
-        env: rc?.env ?? {},
-        kubeContext: rc?.kubeContext ?? "",
-        kubeNamespace: rc?.kubeNamespace ?? "",
-    });
-    // Static deletion-target resolution (task d03af8f6) needs only the raw
-    // command — unlike the environment resolver above, it deliberately
-    // does not consult `riskContext` (cwd, env, kube): a relative target is
-    // UNRESOLVABLE by design, not resolved against ambient cwd. See
-    // `deletion-target-resolve.ts`'s module doc for the full rationale.
-    const deletionShellCommand = extractShellCommand({ raw_input: envelope.raw_input });
-    const deletionTarget = deletionShellCommand === null
-        ? null
-        : resolveDeletionTarget(deletionShellCommand, 
-        // Defensive fallback (not just the schema `.default()`): a
-        // hand-built `Manifest` test fixture that constructs `risk:`
-        // directly, bypassing `RiskSchema.parse`, may omit this field
-        // entirely — never trust it present.
-        manifest.risk.safe_deletion_roots ?? DEFAULT_SAFE_DELETION_ROOTS);
-    return { risk, environment, deletionTarget };
-}
-/**
- * Does a policy's `trigger:` match this event? This is the WHICH-tool-
- * calls filter; the WHETHER-it-applies filter is `policy.when:`,
- * evaluated separately (`evaluateWhen`). A policy fires only when both
- * hold. Exported so `harness explain-policy` can report the trigger
- * verdict on its own.
- *
- * `precomputedNormalizedCommand` is an optional caller-supplied
- * `NormalizedCommand` for the event's command: `intercept()` below
- * resolves ONE `NormalizedCommand` per event (via
- * `options.normalizedCommand`, itself computed once by
- * `runInterceptCli`) and threads it into every `policyMatchesEvent`
- * call in its `matching` loop, so a raw-miss event normalises the
- * command exactly ONCE across the whole manifest instead of once per
- * policy. Omitted by standalone callers (`harness explain-policy`, most
- * tests), which fall back to computing it lazily right here — correct
- * either way, since `normalizeCommand` is a pure function of the
- * command string alone.
- *
- * `ampNormalizedCommandThunk` (task aabbad63) is the SAME
- * resolved-by-the-wrapper pattern for the ampersand-aware SECOND
- * normalisation pass, but threaded as a memoised THUNK rather than a
- * precomputed value — see `InterceptOptions.ampNormalizedCommandThunk`
- * for why laziness matters here specifically. Omitted callers fall back
- * to calling `normalizeCommandAmpAware` directly, same shape as the
- * `precomputedNormalizedCommand` fallback above.
- *
- * `quoteNormalizedCommandThunk` (task cf3dff51) is the SAME thunk pattern
- * again, for the quote-aware THIRD normalisation pass — see
- * `InterceptOptions.quoteNormalizedCommandThunk`. Omitted callers fall
- * back to calling `normalizeCommandQuoteAware` directly, same shape as
- * the two fallbacks above.
- */
-export function policyMatchesEvent(policy, event, precomputedNormalizedCommand, ampNormalizedCommandThunk, quoteNormalizedCommandThunk) {
-    if (policy.trigger.event !== event.hook_event_name)
-        return false;
-    if (policy.trigger.match !== undefined) {
-        if (typeof event.tool_name !== "string")
-            return false;
-        const toolNames = expandToolNameAliases(event.tool_name);
-        if (!toolNames.some((toolName) => toolName.includes(policy.trigger.match))) {
-            return false;
-        }
-    }
-    // `input_match` (task 2699b476): literal equality against the tool
-    // call's own arguments, ANDed onto the tool-name match above. This is
-    // what separates `task_finish { autoMerge: true }` (a merge, gated)
-    // from a plain `task_finish` (not a merge, not gated) without needing
-    // two different tool names. Evaluated from the SAME `toolArgs` context
-    // `trigger.extract` reads (`buildEventContext`) for a SINGLE-envelope
-    // event, and additionally against BOTH `tool_input` and `raw_input`
-    // when a payload carries both as non-null objects (review round 1,
-    // task 2699b476 round 2, see `inputMatchMismatchesEvent` below).
-    // Mirrored in `policyMatchesTool` (`src/cli/dry-run.ts`) for the
-    // single-envelope case only, since dry-run's `--input` is always one
-    // object; `harness policy dry-run` cannot reproduce the mixed-envelope
-    // arm. Both `input_match` parity and the mixed-envelope-is-intercept-only
-    // caveat are recorded in docs/okf/debug-verb-selection.md's
-    // trigger-matching parity paragraph.
-    if (policy.trigger.input_match !== undefined) {
-        if (inputMatchMismatchesEvent(policy.trigger.input_match, event)) {
-            return false;
-        }
-    }
-    if (policy.trigger.bash_match !== undefined) {
-        const command = extractShellCommand(event);
-        if (command === null)
-            return false;
-        let re;
-        try {
-            re = new RegExp(policy.trigger.bash_match);
-        }
-        catch {
-            return false;
-        }
-        // Raw-OR-normalised-OR-amp-normalised-OR-quote-normalised (D-003, run
-        // 2026-07-27-gate-target-repo-resolution; third arm added task
-        // aabbad63; fourth arm added task cf3dff51): test the RAW command
-        // first — cheap, and byte-identical to the pre-fix behaviour — then,
-        // only if that fails, the primary NORMALISED command (wrapper
-        // prefixes peeled, git global options dropped, whitespace collapsed,
-        // BOUNDARY_RE segmentation) — then, only if THAT also fails, the
-        // ampersand-aware second pass (AMP_BOUNDARY_RE segmentation, closing
-        // the bare-`&` family BOUNDARY_RE cannot see: `A=x&env -C /tmp git
-        // status`, `echo hi & nice git status`) — then, only if THAT also
-        // fails, the quote-aware third pass (BOUNDARY_RE's own alphabet, but
-        // quote-tracking, closing a shell-boundary character sitting INSIDE a
-        // quoted assignment value: `VAR='a; b' git push origin master`).
-        // Strictly additive at every step: a command that matched today keeps
-        // matching via the raw test alone; the primary normalised form can
-        // only ADD a match (env/nice/command wrappers, extra git global
-        // options, doubled whitespace); the amp-aware form can only add a
-        // FURTHER match on top of those two; the quote-aware form can only
-        // add a FOURTH match on top of all three, never remove one any of the
-        // others already found. Replacing the matcher input instead of OR-ing
-        // it in risks silently REMOVING an existing match if some pass ever
-        // mangles a shape — the fail-open direction for a gate — so this
-        // stays additive rather than a substitution at every arm.
-        if (!re.test(command)) {
-            const { normalized } = precomputedNormalizedCommand ?? normalizeCommand(command);
-            if (!re.test(normalized)) {
-                const amp = ampNormalizedCommandThunk
-                    ? ampNormalizedCommandThunk()
-                    : normalizeCommandAmpAware(command);
-                if (!re.test(amp.normalized)) {
-                    const quoted = quoteNormalizedCommandThunk
-                        ? quoteNormalizedCommandThunk()
-                        : normalizeCommandQuoteAware(command);
-                    if (!re.test(quoted.normalized))
-                        return false;
-                }
-            }
-        }
-    }
-    return true;
-}
-function buildEventContext(event) {
-    return contextWithToolArgs(event, event.tool_input ?? event.raw_input ?? event.input);
-}
-function contextWithToolArgs(event, toolArgs) {
-    return {
-        toolArgs,
-        event,
-        session: { id: event.session_id ?? "" },
-        git: {},
-    };
-}
-function isNonNullObject(value) {
-    return typeof value === "object" && value !== null;
-}
-/**
- * Whether `input_match` fails to arm the gate for this event (review
- * round 1, task 2699b476 round 2, MEDIUM security finding).
- *
- * The default `toolArgs` context (`buildEventContext`) resolves ONE
- * field with `tool_input ?? raw_input ?? input`, so a payload that
- * carries a benign value in the PREFERRED field and the actual merge
- * request in the OTHER field never gets read:
- * `{tool_input:{taskId:"t"}, raw_input:{taskId:"t",autoMerge:true}}`
- * resolves `toolArgs` to `tool_input` alone, `autoMerge` reads as
- * absent, and the narrowed `task_finish` gate stays unarmed for a call
- * that DOES request an auto-merge.
- *
- * Mirrors the two-field handling `resolveCodexExemptionCommand`
- * (`hook-codex-pre-tool-use.ts`) already established for this exact
- * shape, but in the opposite fail-closed direction: that function
- * REFUSES an exemption when the two fields disagree (an exemption is an
- * allow, so disagreement must not grant it); here a `requires:` gate is
- * a block, so disagreement must not WITHHOLD it. When both `tool_input`
- * and `raw_input` are present as non-null objects, `input_match` is
- * evaluated against BOTH; if either one matches, the predicate holds
- * (the gate is armed) regardless of what the other field says. Only
- * when NEITHER field matches does the gate stay unarmed.
- */
-function inputMatchMismatchesEvent(inputMatch, event) {
-    const toolInput = event.tool_input;
-    const rawInput = event.raw_input;
-    if (isNonNullObject(toolInput) && isNonNullObject(rawInput)) {
-        const toolInputMismatch = firstInputMatchMismatch(inputMatch, contextWithToolArgs(event, toolInput));
-        const rawInputMismatch = firstInputMatchMismatch(inputMatch, contextWithToolArgs(event, rawInput));
-        return toolInputMismatch !== null && rawInputMismatch !== null;
-    }
-    return firstInputMatchMismatch(inputMatch, buildEventContext(event)) !== null;
-}
-/** Map a failed-`requires` policy to its decision outcome by enforcement. */
-function outcomeForFailedRequires(enforcement) {
-    switch (enforcement) {
-        case "block":
-            return "deny";
-        case "warn":
-            return "warn";
-        case "require_approval":
-            return "require_approval";
-    }
-}
-/**
- * Does a decision abort the tool call? Phase 7 #6 makes the Risk Gate
- * authoritative at the `PreToolUse` boundary:
- *   - `deny` aborts (a `block`-enforcement policy whose requires failed,
- *     the Phase 4 mechanism, unchanged).
- *   - `require_approval` aborts until the approval evidence exists. In
- *     Phase 7 #5 this outcome was returned but did not block; #6 makes
- *     it block. The approval tag is satisfiable through the policy's
- *     `requires:` (an operator runs `harness approve risk`); once the
- *     tag is on record the requires evaluation passes and the outcome
- *     is `allow` instead.
- *   - `deny-degraded` aborts (task f1aea826): it is only ever produced
- *     for `block` / `require_approval` policies under the default
- *     `preserve_enforcement` posture (see `degradedOutcome`), so its
- *     presence alone means "an incident-preventing gate could not read
- *     its evidence" — fail closed.
- *   - `allow` / `warn` / `warn-degraded` never abort.
- *
- * Exported for the CLI wrapper's pending-approval staging
- * (`src/cli/policy/intercept.ts`), which must agree with the runtime on
- * WHICH decision is the first blocking one — a hand-rolled copy there
- * drifted when `deny-degraded` was added (review 2026-08-08, low
- * finding). Keep this the single definition.
- */
-export function isBlockingDecision(d) {
-    if (d.outcome === "deny")
-        return d.enforcement === "block";
-    if (d.outcome === "deny-degraded")
-        return true;
-    return d.outcome === "require_approval";
-}
-/**
- * Outcome for a policy whose `requires` could NOT be evaluated at all —
- * degraded/thrown ledger query, unresolved template variables, invalid
- * `within`, thrown `evaluateRequires`, or the defensive
- * schema-invariant branch. The fail posture is derived from the
- * policy's own `enforcement:` (task f1aea826):
- *
- *   warn                        → `warn-degraded` (availability first,
- *                                 unchanged: advisory friction never
- *                                 bricks the session)
- *   block / require_approval    → `deny-degraded` (fail closed: a gate
- *                                 against an irreversible incident must
- *                                 not open because its evidence source
- *                                 is unreadable)
- *
- * The manifest-level opt-out `risk.degraded_fail_posture: fail_open`
- * restores the pre-0.45 availability-first mapping (`warn-degraded`
- * for every tier). The hand-built-manifest case (`options.manifest.risk`
- * absent, only possible past `harness validate`) defaults to the
- * fail-closed posture, matching the schema default.
- */
-function degradedOutcome(policy, manifest) {
-    if (policy.enforcement === "warn")
-        return "warn-degraded";
-    const posture = manifest.risk?.degraded_fail_posture ?? "preserve_enforcement";
-    return posture === "fail_open" ? "warn-degraded" : "deny-degraded";
-}
-/**
- * Control characters (C0 range plus DEL), built via fromCharCode so the
- * source file itself stays free of raw control bytes. Matches what the
- * envelope sanitiser collapses to a single space.
- */
-const ENVELOPE_CONTROL_CHARS = new RegExp(`[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}]+`, "g");
-/**
- * Characters that are not printable text but can hide, reorder or smuggle
- * what a reader sees, or start a new "line" in model-visible text. Matched
- * as a rule rather than a hand list: every code point with General_Category
- * Cf (format: bidi marks and controls, U+200B, U+FEFF, U+2060-U+2064,
- * U+206A-U+206F, U+FFF9-U+FFFB, U+180E, U+00AD, the tag characters
- * U+E0001 and U+E0020-U+E007F, ...) or Default_Ignorable_Code_Point (adds
- * the variation selectors U+FE00-U+FE0F and U+E0100-U+E01EF, U+034F,
- * U+3164 and the rest of U+E0000-U+E0FFF), plus the C1 controls
- * (U+0080-U+009F, including NEL) and the line and paragraph separators
- * (U+2028, U+2029). The zero width joiner U+200D is kept, because it joins
- * emoji sequences that are printable text. The backslash is escaped too, so
- * a name that literally spells an escape cannot be mistaken for one. Each
- * match is replaced by a visible `\u{XXXX}` escape (four or five hex
- * digits) rather than dropped, so a reader still sees that the name carried
- * it. Written as escapes so this source file holds none of them raw.
- */
-const ENVELOPE_ESCAPED_CHARS = /(?!\u200D)[\u0080-\u009F\u2028\u2029\\\p{Cf}\p{Default_Ignorable_Code_Point}]/u;
-const ENVELOPE_MAX_LENGTH = 200;
-/**
- * Bound and clean a transport-level reason before it is interpolated
- * into the agent-facing deny-degraded envelope. The string can embed
- * output captured from the grounding-mcp SUBPROCESS (`exitDiagnostic`
- * in `src/policies/ledger-client.ts` appends the child's last stderr
- * line), i.e. untrusted content that previously only reached stderr
- * and the audit ledger, never model-visible text. The full, untouched
- * string still goes to the audit row and the verbose diagnostic; only
- * the envelope interpolation and the default-verbosity operator hint
- * are bounded.
- *
- * Exported for the CLI wrapper's deny-degraded operator hint (review
- * 2026-08-08, round 3; default-verbosity only, suppressed under
- * verbose), which interpolates the same untrusted reason into its
- * one-line stderr surface.
- */
-export function sanitizeEnvelopeReason(reason) {
-    const collapsed = reason.replace(ENVELOPE_CONTROL_CHARS, " ");
-    // Build whole tokens (a code point, or one escape) so the length bound can
-    // never cut an escape sequence or a surrogate pair in half.
-    const tokens = [];
-    for (const ch of collapsed) {
-        tokens.push(ENVELOPE_ESCAPED_CHARS.test(ch)
-            ? `\\u{${ch.codePointAt(0).toString(16).padStart(4, "0")}}`
-            : ch);
-    }
-    let total = 0;
-    for (const t of tokens)
-        total += t.length;
-    if (total <= ENVELOPE_MAX_LENGTH)
-        return tokens.join("");
-    let out = "";
-    for (const t of tokens) {
-        if (out.length + t.length > ENVELOPE_MAX_LENGTH)
-            break;
-        out += t;
-    }
-    return `${out}...`;
-}
-/**
- * Agent-facing sentence appended to a block whose blocking decision came from
- * a foreign attributed context. Names the repository and directory the
- * command targets (both come from the agent's own command and the work tree
- * it resolves to, so both pass through `sanitizeEnvelopeReason`) and says the
- * missing evidence belongs to that repository, not to the working directory.
- * Names no command: which step produces the evidence is the policy's own,
- * and it has to be produced for the target repository.
- */
-function foreignTargetSentence(target, structured) {
-    const sentence = `This command targets repository \`${sanitizeEnvelopeReason(target.repo)}\` ` +
-        `(directory \`${sanitizeEnvelopeReason(target.dir)}\`). ` +
-        `The required evidence is missing for that repository, not for the working directory, ` +
-        `so it has to be produced for that repository itself.`;
-    return structured ? `\n\n${sentence}` : ` ${sentence}`;
-}
-const EMPTY_REPO_MESSAGE = "no git repository was found for this command: the working directory (or the directory the command targets) is not inside a git repository, so the repository-scoped evidence this policy checks cannot be looked up. " +
-    "Change into the target repository first (`cd <repo>`) or name it explicitly (`git -C <repo> ...`), then retry the command.";
-/**
- * Names the repository whose HEAD is detached, so a detached working
- * directory that is denied next to a `git -C <other repo>` target is
- * recognisable as the working directory's own repository. The name is the
- * resolved `${REPO}` value: the work-tree basename, a `HARNESS_REPO`
- * override, or the value of a policy extract named `REPO` (which can
- * carry tool input), so it is cleaned and bounded like any other untrusted
- * text before it reaches the agent envelope: C0 controls and DEL
- * collapsed to a space, invisible and format characters escaped as
- * `\u{XXXX}`, at most 200 characters (`sanitizeEnvelopeReason`).
- */
-function emptyBranchMessage(repo) {
-    const name = sanitizeEnvelopeReason(repo);
-    return (`no branch is checked out in repository \`${name}\`: HEAD is detached, so the branch-scoped evidence this policy checks cannot be looked up. ` +
-        "Check out a named branch there (`git switch <branch>`, or `git switch -c <branch>` for a new one), create the evidence for that branch, then retry the command.");
-}
-function isBlankIdentifier(value) {
-    return value === undefined || value.trim().length === 0;
-}
-/**
- * Does `ledgerTagTemplate` reference `${REPO}` / `${BRANCH}` while the
- * value resolved for this context is empty? An empty identifier must
- * never be rendered into a ledger tag: `preflight:` is a substring of
- * EVERY preflight fact, so a blank tag lets any unrelated fact satisfy
- * the gate (and `preflight-before-push` would render "You cannot push
- * branch  yet."). The caller decides per enforcement with
- * `message` instead of querying the ledger.
- *
- * `REPO` wins over `BRANCH`, and a branch-only template evaluated where
- * REPO is empty too (no repository at all) gets the no-repository text,
- * since "HEAD is detached" would be false there. The messages name a
- * state the agent can establish (`cd` / `git -C` / `git switch`), never
- * a tag to produce, so there is no producer trap, and never an opt-out
- * (a block that names its own disable path is not a gate).
- *
- * Exported so `harness dry-run` shows the same hint instead of a blank
- * tag (`src/cli/dry-run.ts`).
- */
-export function emptyIdentifierGuard(ledgerTagTemplate, values) {
-    const refsRepo = ledgerTagTemplate.includes("${REPO}");
-    const refsBranch = ledgerTagTemplate.includes("${BRANCH}");
-    if (refsRepo && isBlankIdentifier(values.REPO)) {
-        return { identifier: "REPO", message: EMPTY_REPO_MESSAGE };
-    }
-    if (refsBranch && isBlankIdentifier(values.BRANCH)) {
-        return isBlankIdentifier(values.REPO)
-            ? { identifier: "REPO", message: EMPTY_REPO_MESSAGE }
-            : { identifier: "BRANCH", message: emptyBranchMessage(values.REPO ?? "") };
-    }
-    return null;
-}
-/**
- * Placeholder `ledgerTag` recorded on an `operator_only` decision (and on
- * the defensive schema-invariant-violated branch below). Both outcomes
- * are decided WITHOUT ever substituting or querying a real tag, so this
- * is a readable marker for `harness audit` / `explain --trace` / the
- * stderr diagnostic, not a value anything matches against.
- */
-const NO_LEDGER_TAG = "(operator-only: no ledger tag — never evaluated)";
-async function evaluateOnePolicy(policy, options) {
-    const evaluatedAt = (options.now ?? new Date()).toISOString();
-    const ctx = buildEventContext(options.event);
-    const extract = evaluateExtract(policy.trigger.extract ?? {}, ctx, options.builtins);
-    // Unconditional operator-only deny (schema `operator_only: true`, task
-    // 2cc73f55). The schema's superRefine guarantees this form carries NO
-    // `requires:` and `enforcement: block`, so short-circuit here, BEFORE
-    // the requires pipeline: no ledger query, no template substitution, no
-    // `evaluateRequires` call. That is the load-bearing property — there is
-    // no in-session evidence (ledger tag, marker file, flag) this branch
-    // ever reads, so none can flip the outcome to allow. `extract` above is
-    // still computed (cheap, pure) only because a `ux:`/`producers:` block
-    // on this policy may reference `${VAR}`s from `trigger.extract`; it
-    // plays no role in the outcome below.
-    if (policy.operator_only === true) {
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: "deny",
-            reason: "operator-only: this policy declares no requires: and cannot be satisfied by any in-session evidence",
-            extractValues: extract.values,
-            ledgerTag: NO_LEDGER_TAG,
-            evaluatedAt,
-        };
-    }
-    const requires = policy.requires;
-    if (requires === undefined) {
-        // Unreachable under a schema-validated manifest: PolicySchema's
-        // superRefine requires either `requires:` or `operator_only: true`.
-        // Defensive branch only, for a manifest that bypassed
-        // `harness validate` (hand-built Policy object, stale cached parse).
-        //
-        // Deliberately NOT a plain `deny`: this is the SAME "could not
-        // decide" family as the other degraded returns in this function
-        // (unresolved template variables, a degraded ledger query, an
-        // invalid `within`, a throwing `evaluateRequires`) — the contract
-        // for all of them is "the evaluator could not form a real verdict",
-        // routed through `degradedOutcome` so the policy's own enforcement
-        // decides the fail posture (task f1aea826): `warn` stays the
-        // non-blocking `warn-degraded`, `block`/`require_approval` fail
-        // closed as `deny-degraded`. Failing this branch as plain `deny`
-        // would treat an internal schema-invariant violation as if it were
-        // a deliberate `operator_only: true` policy authored by the
-        // operator, which it is not — `deny-degraded` keeps the two
-        // observably distinct in every audit row and envelope.
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: degradedOutcome(policy, options.manifest),
-            reason: "policy declares neither requires: nor operator_only: true (schema invariant violated)",
-            extractValues: extract.values,
-            ledgerTag: NO_LEDGER_TAG,
-            evaluatedAt,
-        };
-    }
-    // Empty-identifier guard: decided BEFORE any tag is rendered or the
-    // ledger is queried, per the policy's own enforcement (block -> deny,
-    // require_approval -> require_approval, warn -> warn). Deliberately NOT
-    // routed through `degradedOutcome` / the unresolved-variable branch
-    // below: that path ends in the `deny-degraded` envelope, which blames
-    // an unreadable ledger and tells the agent to ask the operator to
-    // check grounding-mcp, false and misleading for an empty identifier.
-    const emptyGuard = emptyIdentifierGuard(requires.ledger_tag, extract.values);
-    if (emptyGuard !== null) {
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: outcomeForFailedRequires(policy.enforcement),
-            reason: emptyGuard.message,
-            extractValues: extract.values,
-            ledgerTag: `(empty ${emptyGuard.identifier}: no ledger tag rendered, no ledger query)`,
-            emptyIdentifier: emptyGuard.identifier,
-            evaluatedAt,
-        };
-    }
-    const missingExtracts = extract.traceData
-        .filter((t) => t.source === "missing")
-        .map((t) => t.var);
-    const sub = substituteTemplate(requires.ledger_tag, extract.values);
-    const ledgerTag = sub.result;
-    const unresolved = [...missingExtracts, ...sub.missing];
-    if (unresolved.length > 0) {
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: degradedOutcome(policy, options.manifest),
-            reason: `template variables unresolved: ${unresolved.join(", ")}`,
-            extractValues: extract.values,
-            ledgerTag,
-            evaluatedAt,
-        };
-    }
-    const sessionId = resolveSessionId(options.event.session_id);
-    let queryResult;
-    try {
-        queryResult = await options.ledger.query(ledgerTag, sessionId, options.ledgerTimeoutMs);
-    }
-    catch (err) {
-        queryResult = {
-            kind: "degraded",
-            reason: `ledger query threw: ${err.message}`,
-        };
-    }
-    if (queryResult.kind === "degraded") {
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: degradedOutcome(policy, options.manifest),
-            reason: queryResult.reason,
-            extractValues: extract.values,
-            ledgerTag,
-            evaluatedAt,
-        };
-    }
-    // Pre-validate `within` against the runtime parser so a manifest that
-    // bypassed `harness validate` doesn't throw uncaught.
-    if (requires.within !== undefined) {
-        try {
-            parseDurationSeconds(requires.within);
-        }
-        catch {
-            return {
-                policyName: policy.name,
-                enforcement: policy.enforcement,
-                outcome: degradedOutcome(policy, options.manifest),
-                reason: `invalid within: ${requires.within}`,
-                extractValues: extract.values,
-                ledgerTag,
-                evaluatedAt,
-            };
-        }
-    }
-    const evalOpts = {
-        ...(options.now && { now: options.now }),
-        ...(options.currentHeadSha !== undefined &&
-            options.currentHeadSha.length > 0 && {
-            currentHeadSha: options.currentHeadSha,
-        }),
-    };
-    const filtered = filterEntriesByTag(queryResult.entries, ledgerTag);
-    let evaluation;
-    try {
-        evaluation = evaluateRequires({ ...requires, ledger_tag: ledgerTag }, filtered, evalOpts);
-    }
-    catch (err) {
-        return {
-            policyName: policy.name,
-            enforcement: policy.enforcement,
-            outcome: degradedOutcome(policy, options.manifest),
-            reason: `requires eval threw: ${err.message}`,
-            extractValues: extract.values,
-            ledgerTag,
-            evaluatedAt,
-        };
-    }
-    // Four-way decision (Phase 7 #5). A satisfied `requires` always
-    // `allow`s; a failed one is mapped by the policy's enforcement —
-    // `block` → `deny`, `warn` → `warn`, `require_approval` →
-    // `require_approval`. The evaluator only RETURNS `require_approval`
-    // here; Phase 7 #6 makes it block.
-    const outcome = evaluation.allowed
-        ? "allow"
-        : outcomeForFailedRequires(policy.enforcement);
-    return {
-        policyName: policy.name,
-        enforcement: policy.enforcement,
-        outcome,
-        reason: evaluation.reason,
-        extractValues: extract.values,
-        ledgerTag,
-        requiresEval: {
-            matchedCount: evaluation.matchedCount,
-            reason: evaluation.reason,
-        },
-        recordHint: evaluation.recordHint,
-        evaluatedAt,
-    };
-}
-function filterEntriesByTag(entries, tag) {
-    // The ledger client returns the entire session's entries; filter to those
-    // whose content/source matches the substituted tag. evaluateRequires also
-    // does a substring match, but pre-filtering here keeps the trace quieter
-    // and avoids the requires evaluator iterating unrelated session entries.
-    //
-    // Phase 5 #4 — also drop `policy_decision` rows so a past audit
-    // payload doesn't incidentally match the same tag the decision was
-    // about (the substring-pollution bug from PR #39's dogfood). The
-    // requires evaluator's entryMatches has the same guard, but
-    // pre-filtering keeps matchedCount honest in the trace data.
-    return entries.filter((e) => e.type !== POLICY_DECISION_TYPE &&
-        // Legacy backstop for pre-Phase-5-#4 rows: they were stored as
-        // type='fact' but carry the `policy_decision:` content prefix.
-        // Drop them at the same gate so a user upgrading harness without
-        // flushing their dev ledger doesn't keep paying the pollution
-        // tax. New rows are caught by the type check above.
-        !e.content.startsWith(`${POLICY_DECISION_TYPE}:`) &&
-        (e.content.includes(tag) ||
-            (e.source !== undefined && e.source.includes(tag))));
-}
-/**
- * Which of a policy's own trigger-satisfying segments name a target — the
- * attribution sibling of `policyMatchesEvent` (task `98ad072f`, T-003).
- * Re-tests the policy's OWN `bash_match` regex against each segment's
- * `text` in isolation: every shipped `bash_match` alternation includes a
- * `^` branch, so testing it against one segment's canonicalised text
- * alone (no leading boundary character — see `CommandSegment.text`'s own
- * doc comment) is well-defined. Returns every segment that matches on its
- * own — usually one, occasionally several (D-004: a decoy read and a cwd
- * read chained in one command can each independently satisfy the SAME
- * trigger).
- *
- * Never changes WHETHER a policy matches — `policyMatchesEvent` already
- * decided that from the WHOLE command (raw-or-normalised-or-amp-
- * normalised), unchanged by this function. This only narrows down WHICH
- * segment(s), if any, are individually responsible for the match, so
- * `intercept()` below knows which segment's target — if any — to resolve
- * the `${REPO}`/`${BRANCH}`/`currentHeadSha` builtins from instead of the
- * event's own cwd. `[]` when the policy has no `bash_match` trigger (an
- * MCP-tool-name-triggered policy — no segment concept applies), when its
- * regex is malformed (mirrors `policyMatchesEvent`'s own defensive
- * `try/catch`), or when the whole-command match came ONLY from the
- * ampersand-aware third arm: `segments` here is always built from the
- * PRIMARY (`BOUNDARY_RE`) segmentation, which — by construction — cannot
- * itself contain the bare-`&` split the amp arm relies on, so an amp-
- * only match finds no individually-matching segment and this returns
- * `[]` (D-003: cwd builtins, identical to shipped).
- */
-export function attributeTriggerSegments(policy, segments) {
-    if (policy.trigger.bash_match === undefined)
-        return [];
-    let re;
-    try {
-        re = new RegExp(policy.trigger.bash_match);
-    }
-    catch {
-        return [];
-    }
-    return segments.filter((seg) => re.test(seg.text));
-}
-/**
- * Does a policy's `requires:` reference the per-repo `${REPO}`/`${BRANCH}`
- * builtins, or ask for `at_head`? Only these policies pay the per-policy
- * attribution cost below — every other matching policy keeps the plain,
- * per-event cwd builtins `options.builtins` already carries, byte-
- * identical to before this task. D-005: `at_head` is included even when
- * `ledger_tag` itself doesn't reference `${REPO}`/`${BRANCH}`, because
- * `at_head` compares against `currentHeadSha`, which this task resolves
- * from the SAME per-policy context — splitting the two would check
- * `at_head` against the cwd's HEAD while `${REPO}` (if present elsewhere)
- * named a different repo, the worse inconsistency D-005 rejects.
- */
-export function usesPerRepoBuiltins(policy) {
-    const requires = policy.requires;
-    if (requires === undefined)
-        return false;
-    return (requires.at_head === true ||
-        requires.ledger_tag.includes("${REPO}") ||
-        requires.ledger_tag.includes("${BRANCH}"));
-}
-/**
- * Bound on the number of DISTINCT attributed contexts one policy is
- * evaluated against for one event (D-013, fix round, run
- * 2026-08-02-per-repo-gate-scoping-redesign). Each distinct context costs
- * one ledger query and one audit write in `intercept()`'s evaluation loop
- * below; on a manifest with several per-repo-builtins policies (the
- * shipped `FULL_TEMPLATE` has four), an event naming K distinct targets
- * amplifies to 4K queries/writes, unbounded by `MAX_NORMALIZE_LENGTH` —
- * measured 200/200 at K=200 by reviewer 2, on a hook budget whose timeout
- * is ALLOW (same class as the 07-27 quadratic hot-path fail-open: a slow
- * enough event silently passes). `resolveAttributedContexts` returns a
- * `"bounded"` result instead of a `contexts` array once a policy's DISTINCT
- * targets would exceed this constant; `intercept()` denies that policy
- * directly (naming the ambiguity) without querying the ledger for any of
- * them, rather than silently evaluating all of them.
- */
-export const MAX_ATTRIBUTED_CONTEXTS = 4;
-/**
- * Realpath a path for identity comparison, never throwing (D-012, fix
- * round, run 2026-08-02-per-repo-gate-scoping-redesign). Falls back to the
- * LEXICAL path unchanged when the target does not exist or is otherwise
- * unreadable (`fs.realpathSync.native` throws `ENOENT` for a path this
- * module was never guaranteed to have on disk, and this function must
- * never throw — same fail-safe posture as `resolveGitContext` itself,
- * which returns empty strings rather than throwing on a bad path).
- * `.native` (not the plain JS `fs.realpathSync`) resolves via the OS
- * syscall directly — cheaper, and avoids Node's own pure-JS symlink-loop
- * bookkeeping for a value this function only uses for an identity
- * comparison, never for a filesystem walk of its own.
- */
-function realpathOrSelf(p) {
-    try {
-        return fs.realpathSync.native(p);
-    }
-    catch {
-        return p;
-    }
-}
-/**
- * Resolve the distinct `${REPO}`/`${BRANCH}`/`currentHeadSha` contexts a
- * `usesPerRepoBuiltins` policy must be evaluated against (task `98ad072f`,
- * T-003, `01-plan.md` Proposed Approach items 2-4). The engine trusts a
- * trigger-satisfying segment's `effectiveTarget` UNIFORMLY as the
- * directory that segment's own invocation genuinely runs in (bash
- * semantics) — orchestrator decision D-010, 2026-08-02: an earlier
- * revision of this function additionally distrusted an inherited target
- * whenever a DIFFERENT invocation intervened between the `cd` and the
- * satisfying segment — REJECTED: that coupling has no basis in bash's own
- * semantics, is dodgeable by inserting any harmless read between the `cd`
- * and the gated verb, and carried its own unverified `cd`-recognition
- * gap. The `cd <B> && git log && git push` shape this was meant to guard
- * is not a regression at all under this design — `git push` genuinely
- * runs inside B — see `tests/runtime/intercept-cli.test.ts`'s "leading-cd
- * is now a deliverable" block.
- *
- * D-021 (UNIVERSAL-ADDITIVE, operator decision, fix round, run
- * 2026-08-02-per-repo-gate-scoping-redesign): attribution is uniformly
- * ADDITIVE, never REPLACE. Every satisfying segment with an attributable
- * target — `seg.effectiveTarget !== null`, whether it came from the
- * segment's OWN explicit repo-relocating flag (`-C`/`env -C`/`--git-dir`;
- * `--work-tree` is excluded from ever producing a target at all, D-017)
- * or was INHERITED from a preceding `cd` — demands the cwd context AND
- * that target's own context, side by side; `seg.ownTarget` is not
- * consulted for this decision. Any unsatisfied context blocks the whole
- * event (the existing per-context evaluation machinery below is
- * unchanged). `seg.effectiveTarget === null` (fully unattributable —
- * D-003) still adds ONLY the cwd context — there is no foreign target to
- * be additive WITH.
- *
- * Demanding cwd unconditionally makes the engine structurally immune to
- * misattribution of the foreign target: no gap in `command-normalize.ts`'s
- * static, string-only model of shell control flow (subshells, pipes,
- * `cd -`, a later `cd`, an unmodeled git flag composition) can ever make a
- * gate WEAKER than the shipped, cwd-only engine, because cwd's own demand
- * is never dropped — only added to. This replaces an earlier REPLACE-for-
- * own-target design (D-011) that trusted a statically extracted own
- * target as proof of "this one invocation operates there"; four
- * independent review passes each measured a live bypass of that
- * invariant against the shipped binary (a forged `.git/HEAD` directory
- * reached through, respectively, a non-persisting `cd`, `--work-tree`,
- * more than one repo-relocating flag, and a tilde-valued flag not counted
- * by the multi-flag guard) — see `03-decisions.md` D-011/D-017/D-018/
- * D-019/D-020/D-021 for the full history. The static-analysis-proves-it
- * invariant those bypasses each disproved is not carried forward here.
- * Cost accepted by the operator: a legitimate `git -C B` from cwd A now
- * demands BOTH A's and B's context, where the pre-D-021 engine demanded
- * only B's.
- *
- * One exception to "never dropped": when the working directory is outside
- * every git repository (a blank `${REPO}` for the policy, as the guard
- * sees it), its cwd context is not demanded next to a segment whose own
- * target resolved to a real repository (see the loop body). That
- * exception relies on two static models: the target attribution, whose
- * known misattribution (a `GIT_DIR=` prefix or a third repository reached
- * through another construct) exists for every cwd, and the check that the
- * cwd is outside every repository, which errs toward inside: it holds only
- * when neither the cwd nor any ancestor has an entry named `HEAD` or
- * `.git` (`mayBeInsideRepository`). A detached cwd and every other
- * non-blank cwd context are still never dropped.
- *
- * D-012: a target reached through a symlink resolves to its REAL
- * (realpath'd) repository identity, not the symlink's own lexical
- * basename — `resolveGitContext` derives `repo` from the basename of
- * wherever it's pointed, and never itself realpaths, so an agent could
- * otherwise pick the demanded repo identity by naming a symlink.
- *
- * D-013: distinct contexts are bounded at `MAX_ATTRIBUTED_CONTEXTS`; see
- * that constant's own comment.
- *
- * D-015: the cwd context is deduped by its OWN `[REPO, BRANCH, sha]`
- * signature (not the literal string `"cwd"`), so a foreign path that
- * resolves to the SAME repository identity as cwd (e.g. a subdirectory of
- * the cwd repo reached via an explicit `-C`) collapses into the cwd
- * context instead of producing a spurious duplicate decision/audit write.
- * `repoOverridden` / `branchOverridden` (from `InterceptOptions`, both
- * default `false`) keep an operator's `HARNESS_REPO`/`HARNESS_BRANCH`
- * override intact in an attributed foreign context instead of letting the
- * target repo's own identity silently overwrite it — independently per
- * field. `satisfying` is a `Set` (not `Array.includes` per segment) for
- * O(1) membership tests instead of O(n) per segment.
- *
- * A policy with no attributable foreign target (no `bash_match`, no
- * individually-matching segment, only an amp-arm-only match, an
- * unattributable composition, a target resolving to the SAME repository
- * identity as cwd, or a target outside any git repo — D-003) is evaluated
- * EXACTLY as it is today, with the EXACT SAME `options.builtins` object
- * reference (no clone) when nothing attributed, keeping that the
- * byte-identical common case.
- *
- * `resolveGitContextMemo` is a per-`intercept()`-call cache keyed by the
- * REALPATH'D absolute path (never module-level state — no cross-event
- * caching), so several policies (or several satisfying segments) naming
- * the same foreign path within one event pay the `fs` cost once, not
- * once per policy per segment. `mayBeInsideRepositoryMemo` is the same
- * kind of per-call cache for the cwd's own outside-every-repository
- * check, keyed by the cwd's real path, so that walk runs once per event.
- */
-export function resolveAttributedContexts(policy, segments, cwdBuiltins, cwdCurrentHeadSha, resolveGitContextMemo, mayBeInsideRepositoryMemo, repoOverridden, branchOverridden, extractContext) {
-    const cwdContext = { builtins: cwdBuiltins, currentHeadSha: cwdCurrentHeadSha };
-    const satisfying = new Set(attributeTriggerSegments(policy, segments));
-    if (satisfying.size === 0)
-        return { kind: "contexts", contexts: [cwdContext] };
-    const cwdSignature = [cwdBuiltins.REPO, cwdBuiltins.BRANCH, cwdCurrentHeadSha ?? ""].join("|");
-    const seenSignatures = new Set();
-    const contexts = [];
-    const addCwdOnce = () => {
-        if (seenSignatures.has(cwdSignature))
-            return;
-        seenSignatures.add(cwdSignature);
-        contexts.push(cwdContext);
-    };
-    const cwdReal = realpathOrSelf(cwdBuiltins.CWD);
-    // Decided from the same values `evaluateOnePolicy` guards on: the
-    // policy's own `trigger.extract` evaluated against the cwd builtins, so
-    // an extract named `REPO` / `BRANCH` that shadows a builtin is honoured
-    // here exactly as it is there.
-    const cwdGuard = emptyIdentifierGuard(policy.requires?.ledger_tag ?? "", evaluateExtract(policy.trigger.extract ?? {}, extractContext, cwdBuiltins).values);
-    // "Outside every repository" is checked on the cwd's real path: the
-    // builtins resolve the path as given, while git runs in the physical
-    // directory, so a symlink into a repository is not outside it. An empty
-    // CWD names no directory at all and never qualifies. The check is the
-    // conservative `mayBeInsideRepository`, not the static
-    // `resolveGitContext` the builtins come from: that resolver misses
-    // repositories git still finds (see the helper's doc comment), and here
-    // a miss would drop a demand. It runs only for a blank `${REPO}`, at
-    // most once per event (`mayBeInsideRepositoryMemo`).
-    const cwdOutsideEveryRepository = cwdGuard?.identifier === "REPO" &&
-        cwdBuiltins.CWD.length > 0 &&
-        !mayBeInsideRepositoryMemoised(cwdReal, mayBeInsideRepositoryMemo);
-    for (const seg of segments) {
-        if (!satisfying.has(seg))
-            continue;
-        if (seg.effectiveTarget === null) {
-            // D-003: fully unattributable — cwd only, no foreign target to be
-            // additive with.
-            addCwdOnce();
-            continue;
-        }
-        // D-021 (UNIVERSAL-ADDITIVE, operator decision after the four-pass
-        // halt — see this function's own doc comment): the cwd context is
-        // demanded UNCONDITIONALLY here, regardless of whether the target came
-        // from the segment's own explicit flag or was inherited from a
-        // preceding `cd`. `seg.ownTarget` is no longer read for this decision.
-        // The one exception is `cwdOutsideEveryRepository` below: it is
-        // decided after the target resolved, so the cwd context is added from
-        // the branches of this loop body instead of up front, in the same
-        // order as before.
-        const resolvedLexical = path.resolve(cwdBuiltins.CWD, seg.effectiveTarget);
-        const resolved = realpathOrSelf(resolvedLexical);
-        if (resolved === cwdReal) {
-            addCwdOnce();
-            continue;
-        }
-        let gitCtx = resolveGitContextMemo.get(resolved);
-        if (gitCtx === undefined) {
-            gitCtx = resolveGitContext(resolved);
-            resolveGitContextMemo.set(resolved, gitCtx);
-        }
-        if (gitCtx.repo.length === 0) {
-            // D-003: outside any repo → cwd fallback, not a distinct context.
-            addCwdOnce();
-            continue;
-        }
-        const signature = [gitCtx.repo, gitCtx.branch, gitCtx.sha].join("|");
-        // Empty-identifier exception to the universal-additive rule, limited
-        // to a working directory outside every git repository. That cwd
-        // context has a blank `${REPO}` (the value the guard sees, after the
-        // policy's own extract) and can never be satisfied: the
-        // empty-identifier guard denies it without a ledger query. Demanding
-        // it next to a target that resolved to a real repository would deny
-        // the very remedy the guard's message names (`git -C <repo> ...`, or
-        // `cd <repo> && ...` in one command). The skip applies only when the
-        // cwd is outside every repository and this segment's own target
-        // resolved to a real repository; the target's own context is still
-        // demanded in full. It relies on two static models: the target
-        // attribution, whose known misattribution (a `GIT_DIR=` prefix or a
-        // third repository reached through another construct) exists for every
-        // cwd, and the cwd resolution, which is conservative: the skip applies
-        // only when neither the cwd's real path nor any ancestor up to the
-        // filesystem root holds an entry named `HEAD` or `.git` (any type) and
-        // no lookup failed other than with ENOENT (`mayBeInsideRepository`).
-        // What remains outside both models: a third repository the command
-        // really runs in (a `GIT_DIR=` prefix, or a `cd` into another
-        // repository before the misattributed segment), state the command
-        // itself creates while it runs (a `.git` it links or writes before the
-        // git verb), and an ambient `GIT_DIR` / `GIT_COMMON_DIR` in the
-        // environment git runs with. A
-        // detached cwd (non-blank `${REPO}`, blank `${BRANCH}`) and
-        // every non-blank cwd context keep the rule above unchanged: the
-        // detached remedy (`git switch` in that repository) is establishable,
-        // and dropping that context would let a misattributed push from the
-        // detached HEAD pass on the target's evidence. A segment without a
-        // resolved target (a bare `git status`) keeps its cwd context and
-        // still denies with the hint.
-        if (!cwdOutsideEveryRepository)
-            addCwdOnce();
-        if (signature === cwdSignature) {
-            // D-015: a foreign target that resolves to cwd's own REAL identity
-            // (e.g. a subdirectory of the cwd repo reached via `-C`, a
-            // different literal path than `cwdBuiltins.CWD` itself but the SAME
-            // `.git`) collapses into the cwd context regardless of segment
-            // order — not just when a bare cwd-reading segment happened to add
-            // it first.
-            addCwdOnce();
-            continue;
-        }
-        if (seenSignatures.has(signature))
-            continue;
-        if (contexts.length >= MAX_ATTRIBUTED_CONTEXTS) {
-            // D-013: fail CLOSED — do not evaluate any of them, name the
-            // ambiguity instead. `contexts.length + 1` names "at least this
-            // many distinct targets", the count observed before bailing, not
-            // necessarily the final total (the loop stops here).
-            return { kind: "bounded", distinctCount: contexts.length + 1 };
-        }
-        seenSignatures.add(signature);
-        contexts.push({
-            builtins: {
-                ...cwdBuiltins,
-                REPO: repoOverridden ? cwdBuiltins.REPO : gitCtx.repo,
-                BRANCH: branchOverridden ? cwdBuiltins.BRANCH : gitCtx.branch,
-            },
-            currentHeadSha: gitCtx.sha.length > 0 ? gitCtx.sha : undefined,
-            foreignTarget: { repo: gitCtx.repo, dir: resolved },
-        });
-    }
-    // Defensive fallback: every satisfying segment existed but somehow none
-    // was added above (should not happen — every branch above adds either
-    // the cwd context or a foreign one). Never leave a matched, per-repo-
-    // builtins policy with zero contexts to evaluate against.
-    return { kind: "contexts", contexts: contexts.length > 0 ? contexts : [cwdContext] };
-}
-/**
- * Could git find a repository from `dir`? Decided for the one place that
- * drops a demand on the answer (the cwd-outside-every-repository exception
- * in `resolveAttributedContexts`), so every doubt counts as inside. The
- * static `resolveGitContext` walk that resolves the `REPO` / `BRANCH`
- * builtins is left as it is for its other callers; it reports no
- * repository where git still finds one: a `.git` directory without `HEAD`
- * ends its walk (git skips it and walks on), its walk stops after 128
- * levels, and it never recognises a directory that is itself a git
- * directory (a bare repository, or one whose objects live elsewhere
- * through a `commondir` file).
- *
- * This walk does not list layouts. It uses the one structural fact every
- * git directory shares: git accepts a directory as a git directory only
- * when it holds an entry named `HEAD`, and it reaches a repository from a
- * working directory only through a `.git` entry (directory or `gitdir:`
- * file) or a git directory on the way up. So, from `dir` up to the
- * filesystem root with no depth bound:
- *
- * - an entry named `HEAD` or `.git`, of any type, valid or not, counts as
- *   inside (never followed, read or validated);
- * - an `lstat` error other than ENOENT counts as inside (the entry may
- *   exist).
- *
- * The cost is a conservative false inside: a directory that merely holds
- * an entry named `HEAD` (also `head` or `Head` on a case-insensitive
- * volume), or lies below one, keeps its cwd context and denies with the
- * no-repository hint (fail closed). An ambient `GIT_DIR` /
- * `GIT_COMMON_DIR` in git's environment is not visible here.
- */
-function mayBeInsideRepository(dir) {
-    let current = path.resolve(dir);
-    for (;;) {
-        if (entryMayExist(path.join(current, ".git")))
-            return true;
-        if (entryMayExist(path.join(current, "HEAD")))
-            return true;
-        const parent = path.dirname(current);
-        if (parent === current)
-            return false;
-        current = parent;
-    }
-}
-/**
- * `false` only when `lstat` proves the entry absent (ENOENT, reported as
- * `undefined` without building an exception); every other error counts as
- * present.
- */
-function entryMayExist(entryPath) {
-    try {
-        return fs.lstatSync(entryPath, { throwIfNoEntry: false }) !== undefined;
-    }
-    catch (error) {
-        return error.code !== "ENOENT";
-    }
-}
-/**
- * `mayBeInsideRepository(dir)`, computed at most once per `dir` within one
- * `intercept()` call. `memo` is that call's own map (never module-level
- * state), so no answer outlives the event it was computed for.
- */
-function mayBeInsideRepositoryMemoised(dir, memo) {
-    const known = memo.get(dir);
-    if (known !== undefined)
-        return known;
-    const inside = mayBeInsideRepository(dir);
-    memo.set(dir, inside);
-    return inside;
-}
-/**
- * Lazily resolve the event's per-segment view for attribution, computed
- * at most once per `intercept()` call (the caller, `intercept()` below,
- * memoises the RESULT in its own `segmentsForAttribution` local — this
- * function itself is called at most once per call already, but stays
- * side-effect-free so that remains true regardless of caller changes).
- * Prefers `options.commandSegmentsThunk` (D-015 fix round: the deferred,
- * compute-only-if-needed seam — see its own doc comment), then the eager
- * `options.commandSegments`, then falls back to computing it directly
- * from the event's own command for standalone callers/tests that inject
- * neither. `null` (truncated — see `segmentViewOf`) and "no Bash command
- * on this event" both collapse to `[]`, the same "nothing to attribute,
- * cwd builtins" shape as a policy with no `bash_match` at all.
- */
-function resolveCommandSegments(options) {
-    if (options.commandSegmentsThunk !== undefined)
-        return options.commandSegmentsThunk() ?? [];
-    if (options.commandSegments !== undefined)
-        return options.commandSegments ?? [];
-    const command = extractShellCommand(options.event);
-    if (command === null)
-        return [];
-    return segmentViewOf(command) ?? [];
-}
-/**
- * Synthesise the single decision `intercept()` records for a policy whose
- * distinct attributed contexts exceeded `MAX_ATTRIBUTED_CONTEXTS` (D-013).
- * Routes through `outcomeForFailedRequires` — the SAME enforcement-to-
- * outcome mapping every other "could not safely evaluate" branch in
- * `evaluateOnePolicy` uses — rather than a hardcoded outcome, so a
- * `block`-enforcement policy (the security-critical case: preflight/push/
- * merge gates) genuinely denies, while a `warn`-enforcement policy warns
- * instead of hard-blocking, consistent with how every other failed-
- * evaluation branch in this module already respects the policy's own
- * declared enforcement. No ledger query, no template substitution against
- * a resolved `ledger_tag` (there is no single context to substitute one
- * against) — `extractValues` is still computed from `trigger.extract`
- * against the CWD builtins (cheap, pure, matches the `operator_only`
- * short-circuit's own reasoning) so a `ux:`/`producers:` block on this
- * policy can still render.
- */
-function boundedContextsDecision(policy, event, distinctCount, cwdBuiltins, evaluatedAt) {
-    const extract = evaluateExtract(policy.trigger.extract ?? {}, buildEventContext(event), cwdBuiltins);
-    return {
-        policyName: policy.name,
-        enforcement: policy.enforcement,
-        outcome: outcomeForFailedRequires(policy.enforcement),
-        reason: `ambiguous: this command names at least ${distinctCount} distinct repository targets for this policy, ` +
-            `exceeding the ${MAX_ATTRIBUTED_CONTEXTS}-context bound — refusing to evaluate all of them`,
-        extractValues: extract.values,
-        ledgerTag: "(bounded: too many distinct attributed targets — no context queried)",
-        evaluatedAt,
-    };
-}
-export async function intercept(options) {
-    const { manifest, event } = options;
-    // The Risk Gate is active only when some policy declares a `when:`
-    // block. A manifest with none — every Phase 4 / 5 / 6 manifest — skips
-    // envelope enrichment entirely: no `buildActionEnvelope`, no
-    // classifier, no resolver, and decisions carry no `risk` / `environment`.
-    // That keeps such manifests byte-for-byte identical to pre-Phase-7-#5.
-    const riskGateActive = manifest.policies.some((p) => p.when !== undefined);
-    const enriched = riskGateActive
-        ? enrichEnvelope(manifest, event, options.riskContext, options.now)
-        : undefined;
-    // A policy fires only when its `trigger:` matches AND — when declared
-    // — every `when:` clause holds against the enriched envelope.
-    //
-    // For each matching when:-bearing policy we also record its
-    // `unclassifiedFallback` flag so the decision record and deny message
-    // can distinguish a genuine classification hit from a fail-closed
-    // unclassified command (M7: runtime audit + block message). Policies
-    // that have no `when:` block are not inserted into the map, so a
-    // later `whenFallbackMap.get(name) === true` test is unambiguous.
-    //
-    // Explicit loop rather than Array.filter() so the map is built as a
-    // first-class step: a filter predicate is expected to be pure, and a
-    // future refactor that parallelises the filter would silently break the
-    // audit flag if the mutation were still hiding inside the predicate.
-    const whenFallbackMap = new Map();
-    const matching = [];
-    for (const p of manifest.policies) {
-        if (!policyMatchesEvent(p, event, options.normalizedCommand, options.ampNormalizedCommandThunk, options.quoteNormalizedCommandThunk)) {
-            continue;
-        }
-        if (p.when === undefined) {
-            matching.push(p);
-            continue;
-        }
-        // `enriched` is defined here: a policy with `when:` set `riskGateActive`.
-        const whenEval = evaluateWhen(p.when, enriched);
-        if (whenEval.matched) {
-            whenFallbackMap.set(p.name, whenEval.unclassifiedFallback);
-            matching.push(p);
-        }
-    }
-    // Per-policy attribution (task `98ad072f`, T-003): `segmentsForAttribution`
-    // is resolved at most once, lazily, only if some matching policy actually
-    // uses `${REPO}`/`${BRANCH}`/`at_head` — a manifest with none of those
-    // (every Phase 4/5/6-only manifest) never computes it.
-    // `resolveGitContextMemo` is this call's own, non-module-level cache
-    // (task constraint: no eager/global filesystem work) — see
-    // `resolveAttributedContexts`'s own comment. `mayBeInsideRepositoryMemo`
-    // is the same kind of per-call cache for the cwd walk.
-    let segmentsForAttribution;
-    const resolveGitContextMemo = new Map();
-    const mayBeInsideRepositoryMemo = new Map();
-    const decisions = [];
-    for (const policy of matching) {
-        const attributed = usesPerRepoBuiltins(policy)
-            ? resolveAttributedContexts(policy, (segmentsForAttribution ??= resolveCommandSegments(options)), options.builtins, options.currentHeadSha, resolveGitContextMemo, mayBeInsideRepositoryMemo, options.repoOverridden === true, options.branchOverridden === true, buildEventContext(options.event))
-            : { kind: "contexts", contexts: [{ builtins: options.builtins, currentHeadSha: options.currentHeadSha }] };
-        if (attributed.kind === "bounded") {
-            // D-013: fail CLOSED without querying the ledger for any of the
-            // (too many) distinct targets — one synthetic decision, one audit
-            // write, then move on to the next policy. Ledger-query count for
-            // THIS policy stays at zero regardless of how many distinct targets
-            // the command actually names, instead of scaling with them.
-            const evaluatedAt = (options.now ?? new Date()).toISOString();
-            const decision = boundedContextsDecision(policy, event, attributed.distinctCount, options.builtins, evaluatedAt);
-            decisions.push(decision);
-            try {
-                await options.ledger.record(decision, resolveSessionId(event.session_id));
-            }
-            catch (err) {
-                (options.stderr ?? process.stderr).write(`harness runtime intercept: audit-write failed for ${decision.policyName}: ${err instanceof Error ? err.message : String(err)}\n`);
-            }
-            continue;
-        }
-        for (const context of attributed.contexts) {
-            // Same object reference as `options` on the (overwhelmingly common)
-            // single-cwd-context path — no clone, byte-identical to the
-            // pre-attribution call shape. Only a genuinely foreign context
-            // builds a shallow override.
-            const contextOptions = context.builtins === options.builtins &&
-                context.currentHeadSha === options.currentHeadSha
-                ? options
-                : { ...options, builtins: context.builtins, currentHeadSha: context.currentHeadSha };
-            const base = await evaluateOnePolicy(policy, contextOptions);
-            // Attach the per-event Risk Gate verdicts so `harness audit` /
-            // `explain --trace` can replay the classification + environment
-            // that the `when:` match was made against. Also carry the
-            // unclassifiedFallback flag (M7) when the when: evaluation set it
-            // to true; leave the field absent otherwise so decisions from
-            // manifests without a `when:` policy stay byte-identical.
-            const whenFallback = whenFallbackMap.get(policy.name);
-            const decision = {
-                ...(enriched
-                    ? {
-                        ...base,
-                        risk: enriched.risk,
-                        environment: enriched.environment,
-                        ...(whenFallback === true ? { whenUnclassifiedFallback: true } : {}),
-                    }
-                    : base),
-                ...(context.foreignTarget !== undefined ? { foreignTarget: context.foreignTarget } : {}),
-            };
-            decisions.push(decision);
-            try {
-                await options.ledger.record(decision, resolveSessionId(event.session_id));
-            }
-            catch (err) {
-                // Audit-write failure must not block; the decision is still applied.
-                // Surface the failure to stderr so a persistently-failing recorder
-                // does not silently leave `harness audit` / `explain --trace` blind.
-                // Goes to stderr to keep the stdout deny-JSON contract intact.
-                (options.stderr ?? process.stderr).write(`harness runtime intercept: audit-write failed for ${decision.policyName}: ${err instanceof Error ? err.message : String(err)}\n`);
-            }
-        }
-    }
-    // First blocking decision wins the envelope. `deny` and
-    // `require_approval` both abort (Phase 7 #6); the search order is the
-    // manifest's policy order, same as Phase 4.
-    const blocking = decisions.find(isBlockingDecision);
-    if (blocking) {
-        const sessionId = resolveSessionId(options.event.session_id);
-        // Append the "to satisfy" hint so Claude Code's deny message tells
-        // the operator (or the agent reading the same surface) what evidence
-        // would unblock the gate, instead of just naming the missing tag.
-        // The hint is content + window only; it does not prescribe a
-        // recording verb so the deny path stays neutral on producer (see
-        // agent-tasks/88ca4bb3 for why "use mcp__..." would be the wrong
-        // suggestion when the engine is the source of that suggestion).
-        //
-        // It DOES name the sessionId namespace the entry must be written
-        // under — this runtime session's id (the value shown), not the
-        // agent-tasks task UUID. Naming an identity is not a producer
-        // verb, so this stays compatible with the producer-neutrality above.
-        // The two namespaces are a known production footgun: an entry written
-        // under the agent-tasks task UUID never satisfies a harness runtime
-        // gate, which keys off the runtime session id (2026-05-17 incident,
-        // harness PRs #174/#175 — first attempt used the task UUID and was
-        // rejected, second used the session id and passed).
-        const hintSuffix = blocking.recordHint
-            ? ` To satisfy: ${blocking.recordHint}, under this runtime session's id \`${sessionId}\` (not the agent-tasks task UUID).`
-            : "";
-        // Opt-in producer block: when the policy declares `producers:` in
-        // the manifest, render the structured remediation list (bash / mcp
-        // / ask recipes) with ${VAR} placeholders substituted against the
-        // same extract.values the ledger_tag was resolved with. Schema
-        // validation guarantees at least one `mcp` producer per declared
-        // list, so an agent stuck in a Bash lockout always has an ungated
-        // recovery path. Policies without `producers:` get the legacy
-        // neutral deny envelope unchanged (agent-tasks/3804b785).
-        const blockingPolicy = matching.find((p) => p.name === blocking.policyName);
-        // When the policy declares `ux:`, the agent-facing surface
-        // becomes the plain-language `{cannot, required, run}` shape
-        // instead of the engine-vocabulary deny envelope. The internal
-        // decision (reason, recordHint, requiresEval, ledgerTag) is
-        // unchanged and still recorded to the audit ledger above. The
-        // producers block is suppressed when ux is declared because
-        // `run:` is the canonical remedy surface and rendering both would
-        // give the agent two different command suggestions.
-        let reasonText;
-        if (blocking.outcome === "deny-degraded") {
-            // Degraded-specific envelope (task f1aea826). Deliberately takes
-            // precedence over the policy's `ux:` surface: the operator-curated
-            // ux text describes the MISSING-evidence case ("run the producer,
-            // then retry"), which is actively misleading here — the evidence
-            // could not be READ, so producing the tag cannot unblock anything
-            // until the ledger is reachable again. The envelope names the real
-            // cause (the transport-level reason, sanitised — it embeds output
-            // from the grounding-mcp subprocess) and the posture, so nobody
-            // debugs a phantom missing tag.
-            //
-            // The `risk.degraded_fail_posture: fail_open` opt-out is
-            // deliberately NOT named here (review 2026-08-08, high finding):
-            // this text is fed back to the very agent that was just blocked,
-            // and nothing prevents that agent from editing the manifest — a
-            // deny that includes its own disable recipe is not a gate. The
-            // opt-out lives on operator surfaces only: the stderr diagnostic
-            // (`formatDecisionDiagnostic`), docs/risk-gate.md, and the OKF
-            // fail-posture matrix. Same reasoning as the producer-neutrality
-            // norm above and the operator-only framing of `harness pause`.
-            reasonText =
-                `${blocking.policyName}: required evidence could not be read ` +
-                    `(evidence ledger degraded: ${sanitizeEnvelopeReason(blocking.reason)}). ` +
-                    `This ${blocking.enforcement} policy fails closed while its evidence ` +
-                    `source is unreadable; producing the required tag will not unblock it ` +
-                    `until the ledger is reachable again. Ask your operator to check ` +
-                    `grounding-mcp (harness doctor), then retry. Session: ${sessionId}.`;
-        }
-        else if (blocking.emptyIdentifier !== undefined) {
-            // Empty ${REPO} / ${BRANCH}: the decision's own reason names the
-            // state the agent can establish (`cd` / `git -C` / `git switch`).
-            // Takes precedence over `ux:` (whose `cannot:` text would render
-            // the blank identifier, "You cannot push branch  yet.") and over
-            // `producers:` / the record hint (both would send the agent to
-            // produce a tag the gate will not read in this state). Names no
-            // opt-out, same reasoning as the degraded envelope above.
-            reasonText = `${blocking.policyName}: ${blocking.reason}`;
-        }
-        else if (blockingPolicy?.ux) {
-            // The ux surface is operator-curated plain language. Task
-            // 2929c5b7: a ux-declared policy's `cannot:` text used to be
-            // rendered unchanged even when the match was a fail-closed
-            // unclassified hit, not a genuine classification — so
-            // gate-prod-destructive's "You cannot run this critical
-            // destructive action against production." was shown verbatim for
-            // an unrecognized READ (e.g. `cat`/`sed -n`/`curl`) the moment the
-            // environment resolved to production, which is exactly the false
-            // positive this task exists to fix. When `whenUnclassifiedFallback`
-            // is set, a fallback-specific sentence is PREPENDED naming the real
-            // cause before the operator's own `cannot:` text, which is left
-            // byte-for-byte intact (added to, never replaced): the operator
-            // still chose that wording for the genuine-classification case,
-            // which keeps rendering unchanged. See docs/risk-gate.md,
-            // "Unclassified actions and the fail-close rule".
-            const uxText = renderAgentFacing(blockingPolicy.ux, {
-                ...blocking.extractValues,
-                SESSION_ID: sessionId,
-            });
-            reasonText = blocking.whenUnclassifiedFallback
-                ? `${unclassifiedFallbackPrefix(enriched?.environment.name, blockingPolicy.when?.["risk.severity_at_least"])} ${uxText}`
-                : uxText;
-        }
-        else {
-            const producersBlock = renderProducers(blockingPolicy?.producers, blocking.extractValues);
-            // M7: when the policy matched only because the action was
-            // unclassified (fail-closed), insert an operator-facing note so a
-            // deny caused by an unknown command is distinguishable from a deny
-            // caused by a genuine critical-severity classification. The note is
-            // placed after the base reason but BEFORE hintSuffix so the cause
-            // precedes the remedy ("why this fired" before "how to unblock").
-            // Neutral deny envelope only (not the ux path above).
-            const unclassifiedClause = blocking.whenUnclassifiedFallback
-                ? " (matched via the fail-closed unclassified rule, not a real risk classification)"
-                : "";
-            reasonText = `${blocking.policyName}: ${blocking.reason}.${unclassifiedClause}${hintSuffix}${producersBlock}`;
-        }
-        // A decision made for a foreign attributed context (a nested or
-        // vendored work tree named by the command) is explained by the
-        // repository it resolved to: the producer the message points at runs
-        // for the working directory, whose own evidence may already be on
-        // record. Appended only for a missing-evidence block; the degraded and
-        // empty-identifier envelopes above name their own cause and stay as
-        // they are. Deliberately policy-neutral and names no opt-out.
-        if (blocking.foreignTarget !== undefined &&
-            blocking.outcome !== "deny-degraded" &&
-            blocking.emptyIdentifier === undefined) {
-            reasonText += foreignTargetSentence(blocking.foreignTarget, blockingPolicy?.ux !== undefined);
-        }
-        const block = {
-            decision: "block",
-            reason: reasonText,
-        };
-        // permissionDecision is documented for PreToolUse only; emitting the
-        // envelope on other events would invent a shape Claude Code does not
-        // define, so we restrict it strictly. Other event kinds still block
-        // via the top-level `decision: "block"`.
-        if (options.event.hook_event_name === "PreToolUse") {
-            block.hookSpecificOutput = {
-                hookEventName: "PreToolUse",
-                permissionDecision: "deny",
-                // Duplicates `reason` intentionally: legacy consumers read the
-                // top-level field, modern PreToolUse consumers read this one.
-                permissionDecisionReason: reasonText,
-            };
-        }
-        return { decisions, blockJson: block };
-    }
-    return { decisions, blockJson: null };
-}
-//# sourceMappingURL=intercept.js.map