@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/io/read-regular-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-regular-file.js","sourceRoot":"","sources":["../../src/io/read-regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAwB9B;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B,CAAC,QAAgB;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpF,CAAC"}
+{"version":3,"file":"read-regular-file.js","sourceRoot":"","sources":["../../src/io/read-regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAe9B;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAuB,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;AAC/D,MAAM,UAAU,GAAW,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;AACxD,4EAA4E;AAC5E,MAAM,QAAQ,GAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,EAAU,EAAE,QAAgB;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,CAAC;YAAE,MAAM;QACrB,KAAK,IAAI,GAAG,CAAC;QACb,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,cAAc,GAAG,KAAK;IAEtB,IAAI,cAAc,EAAE,CAAC;QACnB,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,iDAAiD;QACjD,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAA2B,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IAC9C,IAAI,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CACd,QAAQ,EACR,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,QAAQ,CACnF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,OAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACb,IAAI,CAAyC;IACtD,YAAY,QAAgB,EAAE,IAA4C;QACxE,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1F,KAAK,CAAC,GAAG,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,aAAa,GAA2D;IAC5E,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,8BAA8B;IACvC,aAAa,EAAE,gDAAgD;IAC/D,UAAU,EAAE,2CAA2C;CACxD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,OAA2B,EAAE;IACxF,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC5C,MAAM,IAAI,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/io/restart-hints.js

@@ -5,7 +5,8 @@
 // restart the session to pick up new hooks, etc. This module computes which
 // hints to print based on which manifest sections actually changed.
 //
-// Per ARCHITECTURE.md / ROADMAP Phase 3 acceptance:
+// Restart-hint selection, keyed on the manifest section that changed;
+// `harness apply --dry-run` prints these without writing (ARCHITECTURE.md overview):
 //   - mcp[]                changed → MCP-restart hint
 //   - memory.router.command changed → session-restart hint
 //   - hooks structure       changed → settings.json reload hint
@@ -37,9 +38,6 @@ function stripDescription(x) {
 function hooksMaterial(hooks) {
     return hooks.map(stripDescription);
 }
-function policiesMaterial(policies) {
-    return policies.map(stripDescription);
-}
 export function emitRestartHints(prev, next) {
     const hints = [];
     if (!deepEqual(prev.tools.mcp, next.tools.mcp)) {
@@ -50,8 +48,7 @@ export function emitRestartHints(prev, next) {
     if (!deepEqual(prevRouterCmd, nextRouterCmd)) {
         hints.push(RESTART_HINT_MEMORY_ROUTER);
     }
-    if (!deepEqual(hooksMaterial(prev.hooks), hooksMaterial(next.hooks)) ||
-        !deepEqual(policiesMaterial(prev.policies), policiesMaterial(next.policies))) {
+    if (!deepEqual(hooksMaterial(prev.hooks), hooksMaterial(next.hooks))) {
         hints.push(RESTART_HINT_HOOKS);
     }
     return hints;

package/dist/io/restart-hints.js.map

@@ -1 +1 @@
-{"version":3,"file":"restart-hints.js","sourceRoot":"","sources":["../../src/io/restart-hints.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,oEAAoE;AACpE,EAAE;AACF,oDAAoD;AACpD,sDAAsD;AACtD,2DAA2D;AAC3D,gEAAgE;AAChE,yEAAyE;AAIzE,MAAM,CAAC,MAAM,gBAAgB,GAC3B,8CAA8C,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GACrC,8DAA8D,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wDAAwD,CAAC;AAE3D,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,6DAA6D;AAC7D,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAsC,CAAI;IACjE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAc;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;IAED,IACE,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAC5E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"restart-hints.js","sourceRoot":"","sources":["../../src/io/restart-hints.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,qFAAqF;AACrF,sDAAsD;AACtD,2DAA2D;AAC3D,gEAAgE;AAChE,yEAAyE;AAIzE,MAAM,CAAC,MAAM,gBAAgB,GAC3B,8CAA8C,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GACrC,8DAA8D,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wDAAwD,CAAC;AAE3D,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,6DAA6D;AAC7D,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAsC,CAAI;IACjE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAc;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/io/version-compare.d.ts

@@ -73,9 +73,7 @@ export declare function parseProbedVersion(stdout: string): {
  * from its original two consumers to all `min_version` floor checks in
  * this codebase). Consumers as of task db44ab46: `checkHookVersion` and
  * `checkCli`'s `tools.cli[]` check plus `checkMcpVersions`'s
- * `tools.mcp[]` check (all in src/cli/doctor/index.ts),
- * `checkSessionStartPreflightSetupVersion`
- * (src/cli/doctor/session-start-preflight-setup-version.ts), validate's
+ * `tools.mcp[]` check (all in src/cli/doctor/index.ts), validate's
  * `tools.cli[]` check (src/cli/validate/checks.ts), `memory.router`'s
  * version probe (src/probes/memory.ts), and the pack-level floor
  * (src/policy-packs/version-check.ts).

package/dist/io/version-compare.js

@@ -91,9 +91,7 @@ export function parseProbedVersion(stdout) {
  * from its original two consumers to all `min_version` floor checks in
  * this codebase). Consumers as of task db44ab46: `checkHookVersion` and
  * `checkCli`'s `tools.cli[]` check plus `checkMcpVersions`'s
- * `tools.mcp[]` check (all in src/cli/doctor/index.ts),
- * `checkSessionStartPreflightSetupVersion`
- * (src/cli/doctor/session-start-preflight-setup-version.ts), validate's
+ * `tools.mcp[]` check (all in src/cli/doctor/index.ts), validate's
  * `tools.cli[]` check (src/cli/validate/checks.ts), `memory.router`'s
  * version probe (src/probes/memory.ts), and the pack-level floor
  * (src/policy-packs/version-check.ts).

package/dist/io/version-compare.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-compare.js","sourceRoot":"","sources":["../../src/io/version-compare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAClC,0KAA0K,CAAC;AAE7K,MAAM,UAAU,sBAAsB,CAAC,CAAS,EAAE,CAAS;IACzD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc;IAEd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS,EAAE,aAAsB,EAAE,CAAS;IAC9E,MAAM,GAAG,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"version-compare.js","sourceRoot":"","sources":["../../src/io/version-compare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAClC,0KAA0K,CAAC;AAE7K,MAAM,UAAU,sBAAsB,CAAC,CAAS,EAAE,CAAS;IACzD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc;IAEd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS,EAAE,aAAsB,EAAE,CAAS;IAC9E,MAAM,GAAG,GAAG,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/io/write-regular-file.d.ts

@@ -0,0 +1,30 @@
+/** Thrown when the node at a write target is not a regular file. `code` is `E_NOT_REGULAR`. */
+export declare class NotRegularWriteTargetError extends Error {
+    readonly code = "E_NOT_REGULAR";
+    constructor(filePath: string);
+}
+export interface RegularFileWriteOptions {
+    /** Mode for a file this call creates (default 0o644, subject to the umask). */
+    mode?: number;
+    /**
+     * What to do when nothing is at the path. `"create"` (default) creates it;
+     * `"exclusive"` creates it and fails with `EEXIST` on ANYTHING already
+     * there (`O_EXCL`: never follows a symlink, never blocks on a FIFO), the
+     * shape for a name this call just generated.
+     */
+    create?: "create" | "exclusive";
+    /**
+     * Refuse a symlink at the final path component (`O_NOFOLLOW`, `ELOOP`).
+     * Default `false`: a link is followed, as a plain `fs.writeFileSync` does,
+     * and the type of the opened descriptor still decides.
+     */
+    noFollow?: boolean;
+}
+/**
+ * Replace the content of `filePath` (the `fs.writeFileSync` shape: create or
+ * truncate), opened non-blocking and typed on the descriptor. The file is
+ * truncated only AFTER the descriptor proved to be a regular file. Throws the
+ * open error (`ENXIO` for a FIFO with no reader, `ELOOP`, `EEXIST`, ...) or a
+ * {@link NotRegularWriteTargetError}.
+ */
+export declare function writeRegularFileNonBlocking(filePath: string, data: string | Uint8Array, opts?: RegularFileWriteOptions): void;

package/dist/io/write-regular-file.js

@@ -0,0 +1,85 @@
+import * as fs from "node:fs";
+/**
+ * The write-side counterpart of `read-regular-file.ts`. A by-path
+ * `fs.writeFileSync` / `fs.appendFileSync` opens the path blocking: a FIFO
+ * with no reader at the path holds the call until a reader shows up, and on
+ * a hook path that means the hook runs past its budget, which the runtime
+ * treats as an allow. Every write on a hook path goes through here instead:
+ * the path is opened ONCE, non-blocking, and the type of the OPENED
+ * descriptor (`fstat`, never a separate stat of the path) must be a regular
+ * file before a byte is written, so a node swapped in after any earlier look
+ * is refused instead of blocking.
+ *
+ * `O_NONBLOCK` makes the open of a FIFO that has no reader fail with `ENXIO`
+ * at once (a FIFO that does have a reader opens, and the `fstat` check then
+ * refuses it); `O_NOCTTY` keeps a tty node from becoming the controlling
+ * terminal. Both are POSIX flags and fall back to 0 where `fs.constants`
+ * leaves them out (Windows has no FIFO node on the filesystem to swap in).
+ */
+const O_NONBLOCK = fs.constants.O_NONBLOCK ?? 0;
+const O_NOCTTY = fs.constants.O_NOCTTY ?? 0;
+const O_NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+/** Thrown when the node at a write target is not a regular file. `code` is `E_NOT_REGULAR`. */
+export class NotRegularWriteTargetError extends Error {
+    code = "E_NOT_REGULAR";
+    constructor(filePath) {
+        super(`E_NOT_REGULAR: ${filePath} is not a regular file (write refused without a write)`);
+        this.name = "NotRegularWriteTargetError";
+    }
+}
+function writeFlags(extra, opts) {
+    return (fs.constants.O_WRONLY |
+        fs.constants.O_CREAT |
+        (opts.create === "exclusive" ? fs.constants.O_EXCL : 0) |
+        (opts.noFollow === true ? O_NOFOLLOW : 0) |
+        O_NONBLOCK |
+        O_NOCTTY |
+        extra);
+}
+function openRegularForWrite(filePath, flags, mode) {
+    const fd = fs.openSync(filePath, flags, mode ?? 0o644);
+    try {
+        if (!fs.fstatSync(fd).isFile())
+            throw new NotRegularWriteTargetError(filePath);
+    }
+    catch (err) {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            // Already gone; nothing left to release.
+        }
+        throw err;
+    }
+    return fd;
+}
+function writeAll(fd, data) {
+    const bytes = typeof data === "string" ? Buffer.from(data, "utf8") : data;
+    let offset = 0;
+    while (offset < bytes.length) {
+        offset += fs.writeSync(fd, bytes, offset, bytes.length - offset);
+    }
+}
+/**
+ * Replace the content of `filePath` (the `fs.writeFileSync` shape: create or
+ * truncate), opened non-blocking and typed on the descriptor. The file is
+ * truncated only AFTER the descriptor proved to be a regular file. Throws the
+ * open error (`ENXIO` for a FIFO with no reader, `ELOOP`, `EEXIST`, ...) or a
+ * {@link NotRegularWriteTargetError}.
+ */
+export function writeRegularFileNonBlocking(filePath, data, opts = {}) {
+    const fd = openRegularForWrite(filePath, writeFlags(0, opts), opts.mode);
+    try {
+        fs.ftruncateSync(fd, 0);
+        writeAll(fd, data);
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            // Already gone; nothing left to release.
+        }
+    }
+}
+//# sourceMappingURL=write-regular-file.js.map

package/dist/io/write-regular-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-regular-file.js","sourceRoot":"","sources":["../../src/io/write-regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,GAAW,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;AACxD,MAAM,QAAQ,GAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC;AACpD,MAAM,UAAU,GAAW,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;AAExD,+FAA+F;AAC/F,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,eAAe,CAAC;IAChC,YAAY,QAAgB;QAC1B,KAAK,CAAC,kBAAkB,QAAQ,wDAAwD,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAoBD,SAAS,UAAU,CAAC,KAAa,EAAE,IAA6B;IAC9D,OAAO,CACL,EAAE,CAAC,SAAS,CAAC,QAAQ;QACrB,EAAE,CAAC,SAAS,CAAC,OAAO;QACpB,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,UAAU;QACV,QAAQ;QACR,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,KAAa,EAAE,IAAwB;IACpF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,IAAyB;IACrD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,IAAyB,EACzB,OAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/overrides/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./merge.js";
 export * from "./machines.js";
+export * from "./merge-layers.js";

package/dist/overrides/index.js

@@ -1,3 +1,4 @@
 export * from "./merge.js";
 export * from "./machines.js";
+export * from "./merge-layers.js";
 //# sourceMappingURL=index.js.map

package/dist/overrides/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/overrides/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/overrides/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC"}

package/dist/overrides/merge-layers.d.ts

@@ -0,0 +1,43 @@
+import { type ManifestPostureWarning } from "../schema/removed-keys.js";
+/**
+ * Merge the base manifest and its override layers (in load order), stripping
+ * every removed manifest path and every removed per-hook field
+ * (`src/schema/removed-keys.ts`) from the base and from each layer BEFORE it
+ * is merged.
+ *
+ * The merge walks name-keyed lists and throws `OverrideMergeError` on a shape
+ * it cannot reconcile (a list that mixes named and unnamed entries, a named
+ * list over a plain one). A removed key such as `policies:` or `workflows:`
+ * is a list of that kind, and so is a removed per-hook field whose value is
+ * a list that collides across sources (`hooks[].bash_match` as a list of
+ * named objects in the base and a plain list in a layer, or the other way
+ * round). Both are stripped from the merged manifest only AFTER the merge,
+ * so a stale layer whose `policies:` list has the wrong shape, or whose
+ * `bash_match` list collides with the base's, would fail the load before the
+ * strip ran. Every hook loads the manifest, so that failure would lock the
+ * machine out. Stripping the base and each layer first
+ * (`stripRemovedManifestPaths` and `stripRemovedHookFields`, from
+ * `src/schema/removed-keys.ts`) leaves the merge nothing of those keys to
+ * walk, and the post-merge strip finds nothing left to warn a second time.
+ *
+ * The warnings are the ones the strip of each source produced; a layer's
+ * warnings name the layer, so an operator can tell which file to edit. The
+ * base's warnings are unlabelled, as they are for a manifest without layers.
+ *
+ * A layer whose parsed value is `null` is skipped with one warning naming it
+ * (an empty or comment-only file parses to no document, and an explicit
+ * `null` or `~`, or a bare `---`, is a document whose value is null):
+ * merging the `null` would tombstone the root, erasing the whole manifest, and every hook
+ * (the branch-protection hook first) fails closed on a failed load, so such a
+ * layer would lock the machine out of every edit. A layer whose root is a
+ * scalar or a list is a different mistake, not an absent layer, and fails the
+ * load with an error naming the file: silently ignoring it would let an
+ * override the operator believes applied stay silently unapplied.
+ */
+export declare function mergeLayersStrippingRemovedPaths(baseRaw: unknown, layers: ReadonlyArray<{
+    raw: unknown;
+    label: string;
+}>): {
+    merged: unknown;
+    warnings: ManifestPostureWarning[];
+};

package/dist/overrides/merge-layers.js

@@ -0,0 +1,76 @@
+import { stripRemovedHookFields, stripRemovedManifestPaths, isPlainObject } from "../schema/removed-keys.js";
+import { applyLayers, OverrideLayerShapeError } from "./merge.js";
+/**
+ * Merge the base manifest and its override layers (in load order), stripping
+ * every removed manifest path and every removed per-hook field
+ * (`src/schema/removed-keys.ts`) from the base and from each layer BEFORE it
+ * is merged.
+ *
+ * The merge walks name-keyed lists and throws `OverrideMergeError` on a shape
+ * it cannot reconcile (a list that mixes named and unnamed entries, a named
+ * list over a plain one). A removed key such as `policies:` or `workflows:`
+ * is a list of that kind, and so is a removed per-hook field whose value is
+ * a list that collides across sources (`hooks[].bash_match` as a list of
+ * named objects in the base and a plain list in a layer, or the other way
+ * round). Both are stripped from the merged manifest only AFTER the merge,
+ * so a stale layer whose `policies:` list has the wrong shape, or whose
+ * `bash_match` list collides with the base's, would fail the load before the
+ * strip ran. Every hook loads the manifest, so that failure would lock the
+ * machine out. Stripping the base and each layer first
+ * (`stripRemovedManifestPaths` and `stripRemovedHookFields`, from
+ * `src/schema/removed-keys.ts`) leaves the merge nothing of those keys to
+ * walk, and the post-merge strip finds nothing left to warn a second time.
+ *
+ * The warnings are the ones the strip of each source produced; a layer's
+ * warnings name the layer, so an operator can tell which file to edit. The
+ * base's warnings are unlabelled, as they are for a manifest without layers.
+ *
+ * A layer whose parsed value is `null` is skipped with one warning naming it
+ * (an empty or comment-only file parses to no document, and an explicit
+ * `null` or `~`, or a bare `---`, is a document whose value is null):
+ * merging the `null` would tombstone the root, erasing the whole manifest, and every hook
+ * (the branch-protection hook first) fails closed on a failed load, so such a
+ * layer would lock the machine out of every edit. A layer whose root is a
+ * scalar or a list is a different mistake, not an absent layer, and fails the
+ * load with an error naming the file: silently ignoring it would let an
+ * override the operator believes applied stay silently unapplied.
+ */
+export function mergeLayersStrippingRemovedPaths(baseRaw, layers) {
+    const basePathStripped = stripRemovedManifestPaths(baseRaw);
+    const base = stripRemovedHookFields(basePathStripped.raw);
+    const warnings = [...basePathStripped.warnings, ...base.warnings];
+    let current = base.raw;
+    for (const layer of layers) {
+        if (layer.raw === undefined)
+            continue;
+        if (layer.raw === null) {
+            warnings.push({
+                path: "<root>",
+                message: "this override layer has no value to merge (an empty or comment-only file has no YAML document in it; " +
+                    "`null`, `~`, and a bare `---` are documents whose value is null); it is skipped and the manifest loads " +
+                    `as if it were absent; found in the ${layer.label}`,
+            });
+            continue;
+        }
+        if (!isPlainObject(layer.raw)) {
+            throw new OverrideLayerShapeError(`an override layer must be a mapping of manifest keys to their overrides, but the ${layer.label} is ${rootShape(layer.raw)}`);
+        }
+        const strippedPaths = stripRemovedManifestPaths(layer.raw);
+        const stripped = stripRemovedHookFields(strippedPaths.raw);
+        for (const w of [...strippedPaths.warnings, ...stripped.warnings]) {
+            warnings.push({ path: w.path, message: `${w.message}; found in the ${layer.label}` });
+        }
+        current = applyLayers(current, stripped.raw);
+    }
+    return { merged: current, warnings };
+}
+/** How a non-mapping layer root reads in the error: what it is, not its content. */
+function rootShape(value) {
+    if (Array.isArray(value))
+        return "a list";
+    const t = typeof value;
+    if (t === "object")
+        return "a YAML value that is not a mapping";
+    return `a ${t}`;
+}
+//# sourceMappingURL=merge-layers.js.map

package/dist/overrides/merge-layers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-layers.js","sourceRoot":"","sources":["../../src/overrides/merge-layers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,aAAa,EAA+B,MAAM,2BAA2B,CAAC;AAC1I,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAgB,EAChB,MAAsD;IAEtD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAA6B,CAAC,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5F,IAAI,OAAO,GAAY,IAAI,CAAC,GAAG,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,uGAAuG;oBACvG,yGAAyG;oBACzG,sCAAsC,KAAK,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAC/B,oFAAoF,KAAK,CAAC,KAAK,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAC7H,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,kBAAkB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,oCAAoC,CAAC;IAChE,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC"}

package/dist/overrides/merge.d.ts

@@ -1,6 +1,22 @@
+/**
+ * The merge engine's domain error: a shape it cannot reconcile. `path`
+ * locates the failure inside the merged document and the message carries
+ * it as a prefix; the empty path reads as `<root>`.
+ */
 export declare class OverrideMergeError extends Error {
     readonly path: string[];
     constructor(message: string, path: string[]);
 }
+/**
+ * An override layer whose ROOT is not a mapping (a scalar, a list): there
+ * is no path inside the document to point at, and the failure names the
+ * whole layer file, so `message` is the whole message verbatim, without
+ * the `override merge failed at` prefix. The CLI maps only this class to
+ * EX_NOINPUT; every other OverrideMergeError (a shape conflict at a path)
+ * propagates as an unexpected failure, as before.
+ */
+export declare class OverrideLayerShapeError extends OverrideMergeError {
+    constructor(message: string);
+}
 export declare function mergeManifest(base: unknown, override: unknown): unknown;
 export declare function applyLayers(base: unknown, ...layers: Array<unknown | undefined>): unknown;

package/dist/overrides/merge.js

@@ -1,3 +1,9 @@
+import { isPlainObject } from "../schema/removed-keys.js";
+/**
+ * The merge engine's domain error: a shape it cannot reconcile. `path`
+ * locates the failure inside the merged document and the message carries
+ * it as a prefix; the empty path reads as `<root>`.
+ */
 export class OverrideMergeError extends Error {
     path;
     constructor(message, path) {
@@ -6,18 +12,25 @@ export class OverrideMergeError extends Error {
         this.name = "OverrideMergeError";
     }
 }
+/**
+ * An override layer whose ROOT is not a mapping (a scalar, a list): there
+ * is no path inside the document to point at, and the failure names the
+ * whole layer file, so `message` is the whole message verbatim, without
+ * the `override merge failed at` prefix. The CLI maps only this class to
+ * EX_NOINPUT; every other OverrideMergeError (a shape conflict at a path)
+ * propagates as an unexpected failure, as before.
+ */
+export class OverrideLayerShapeError extends OverrideMergeError {
+    constructor(message) {
+        super(message, []);
+        this.message = message;
+        this.name = "OverrideLayerShapeError";
+    }
+}
 function formatPath(path) {
     return path.length === 0 ? "<root>" : path.join(".");
 }
 const TOMBSTONE = Symbol("override-tombstone");
-function isPlainObject(v) {
-    if (v === null || typeof v !== "object")
-        return false;
-    if (Array.isArray(v))
-        return false;
-    const proto = Object.getPrototypeOf(v);
-    return proto === Object.prototype || proto === null;
-}
 function isNameKeyedEntry(v) {
     return isPlainObject(v) && typeof v.name === "string" && v.name.length > 0;
 }

package/dist/overrides/merge.js.map

@@ -1 +1 @@
-{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/overrides/merge.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACE;IAA7C,YAAY,OAAe,EAAkB,IAAc;QACzD,KAAK,CAAC,4BAA4B,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QADvB,SAAI,GAAJ,IAAI,CAAU;QAEzD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,SAAS,GAAkB,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAG9D,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,SAAiB,EACjB,IAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,KAAK,EAAE,CAAC;;YAC/B,KAAK,EAAE,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,kHAAkH,EAC9H,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,IAAe,EACf,QAAmB,EACnB,IAAc;IAEd,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAE/D,IAAI,SAAS,KAAK,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QACtF,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,aAAa,mBAAmB,SAAS,0DAA0D,EAC5H,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,aAAa,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,SAAS,IAAI,IAAyD,EAAE,CAAC;YAClF,MAAM,QAAQ,GAAI,QAA8D,CAAC,IAAI,CACnF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CACjC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;gBAAE,SAAS;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,QAA6D,EAAE,CAAC;QAC1F,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,IAAI,aAAa,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAc;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,QAAiB,EAAE,IAAc;IAClE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,QAAiB;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,GAAG,MAAkC;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/overrides/merge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACE;IAA7C,YAAY,OAAe,EAAkB,IAAc;QACzD,KAAK,CAAC,4BAA4B,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QADvB,SAAI,GAAJ,IAAI,CAAU;QAEzD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,SAAS,GAAkB,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAG9D,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,SAAiB,EACjB,IAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,KAAK,EAAE,CAAC;;YAC/B,KAAK,EAAE,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,kHAAkH,EAC9H,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,IAAe,EACf,QAAmB,EACnB,IAAc;IAEd,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAE/D,IAAI,SAAS,KAAK,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QACtF,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,aAAa,mBAAmB,SAAS,0DAA0D,EAC5H,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,aAAa,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,SAAS,IAAI,IAAyD,EAAE,CAAC;YAClF,MAAM,QAAQ,GAAI,QAA8D,CAAC,IAAI,CACnF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CACjC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;gBAAE,SAAS;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,QAA6D,EAAE,CAAC;QAC1F,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,IAAI,aAAa,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAc;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,QAAiB,EAAE,IAAc;IAClE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,QAAiB;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,GAAG,MAAkC;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/policy-packs/builtin/branch-protection-runtime.d.ts

@@ -1,71 +1,5 @@
 import type { PolicyPack } from "../../schema/index.js";
-import { type ApprovalMarker, type CheckApprovalMarkerOptions, type MarkerCheck } from "./understanding-before-execution-runtime.js";
 export declare const PACK_NAME = "branch-protection";
-/**
- * Ledger tag written by the producer when the current branch is NOT in
- * the operator's protected list. The blocker substring-matches this
- * prefix; the trailing `:<branch>` is informational and keeps the
- * ledger row self-describing for auditors.
- */
-export declare const NON_PROTECTED_TAG_PREFIX = "branch:non-protected";
-/**
- * Operator escape-hatch tag, kept as a best-effort AUDIT echo only.
- *
- * SECURITY (audit finding #39): this tag is NO LONGER a trusted override
- * signal. The agent has direct `mcp__grounding-mcp__ledger_add` access,
- * so it could self-write `branch-protection-ack:<anything>` and bless its
- * own protected-branch edit — exactly the self-approval backdoor the
- * understanding gate closed in agent-tasks/88ca4bb3 by moving the
- * canonical approval to a filesystem marker. The blocker now consults the
- * operator-only marker file (see `checkBranchProtectionMarker` below); the
- * `harness approve branch-protection` verb still records this ledger tag
- * so `harness audit` / forensics keep a trail, but its presence alone
- * never satisfies the gate. The trailing `:<reason>` stays free-form.
- */
-export declare const ACK_TAG_PREFIX = "branch-protection-ack";
-/**
- * Marker-name namespace for an operator-written branch-protection
- * override. The marker lives in the shared `.approvals/` directory under
- * `harness.generated/` (the same directory the understanding gate uses),
- * prefixed so it can never be confused with an understanding-gate session
- * marker (`.approvals/<sessionId>`) or a task marker (`.approvals/task-<id>`):
- * Claude Code / Codex session ids are UUIDs and never start with this
- * literal, so the three namespaces stay disjoint.
- *
- * Why a marker and not the `branch-protection-ack` ledger tag: only a
- * process the operator launched (their `!`-shell or any un-hooked
- * terminal) can write under `harness.generated/` — Edit / Write / Bash
- * are all gated, and the configured MCP servers expose no filesystem
- * write. So the marker is the canonical override signal; the ledger row
- * is a best-effort audit echo only.
- */
-export declare const BRANCH_PROTECTION_MARKER_PREFIX = "branch-protection-";
-/** Marker filename (inside `.approvals/`) for a session's branch-protection override. */
-export declare function branchProtectionMarkerName(sessionId: string): string;
-/**
- * Operator-side: write the canonical branch-protection override marker for
- * `sessionId`. Atomic (delegates to `writeApprovalMarker`). Caller is
- * `harness approve branch-protection`, run from the operator's un-hooked
- * shell; if the agent could reach this path the gate's value would
- * collapse, so it lives behind the approve CLI.
- */
-export declare function writeBranchProtectionMarker(generatedDir: string, sessionId: string, marker: ApprovalMarker): string;
-/**
- * Gate-side: is the operator's branch-protection override marker present
- * for `sessionId`? Inherits `checkApprovalMarker`'s contract
- * (signature-verified, symlink rejection, optional freshness via
- * `maxAgeMs` — harness/f9485cc7 replaced the earlier existence-is-enough
- * behaviour with HMAC signature verification); only the namespaced
- * filename differs.
- */
-export declare function checkBranchProtectionMarker(generatedDir: string, sessionId: string, opts?: CheckApprovalMarkerOptions): MarkerCheck;
-/**
- * Freshness window for the producer tag. Five minutes lets a single
- * branch-check satisfy a whole edit batch without re-running for every
- * Write; longer than that and a branch switch in the middle of a
- * session would silently keep the gate open against the new HEAD.
- */
-export declare const PRODUCER_FRESHNESS_MS: number;
 /** Branches gated by default when no `config.protected_branches` is set. */
 export declare const DEFAULT_PROTECTED_BRANCHES: readonly string[];
 /**
@@ -83,8 +17,9 @@ export declare function resolveProtectedBranches(pack: PolicyPack): {
     warning: string | null;
 };
 /**
- * True when `branch` is in the protected list. Empty branch (detached
- * HEAD) is treated as protected, because we can't audit-by-name what
- * the agent is about to commit to.
+ * True when `branch` (the name git reports, without `refs/heads/`) matches an
+ * entry of the protected list, compared case-insensitively: `Master` and
+ * `MAIN` are the same branch as far as this gate is concerned, since a
+ * case-insensitive filesystem or a remote can fold them together.
  */
 export declare function isProtectedBranch(branch: string, protectedList: readonly string[]): boolean;