@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/apply/generate-settings.js

@@ -20,21 +20,14 @@
 //     UNIT: Claude Code's settings.json `timeout` is documented in SECONDS,
 //     not milliseconds like the manifest's `budget_ms`; see
 //     `hookTimeoutSeconds` below for the conversion and its history.
-//   - `path_match` and `bash_match` are NOT projected. Claude Code's
-//     settings.json `matcher` filters only on the tool name, so there is
-//     no native settings.json field for "additional filter when this hook
-//     fires". Per the canonical example in ARCHITECTURE.md Appendix A
-//     (e.g. `require-preflight-evidence` with `bash_match: "^git ..."`),
-//     these filters are enforced inside the referenced hook script, not by
-//     harness's wiring. The manifest fields are documentation: they tell
-//     `harness validate`/`doctor` what the script claims to filter on, so
-//     the script's behaviour can be cross-checked, but `harness apply`
-//     does not synthesise wrapper shell to enforce them. Wrapping was
-//     considered and rejected: it (a) doubles the surface for hook bugs,
-//     (b) hard-codes shell semantics into the manifest projection, and
-//     (c) the canonical hook scripts already enforce these filters.
-//   - `blocking` is harness-internal: it tells `validate`/`doctor` how to
-//     classify a hook for soft/hard-failure reporting. Claude Code's
+//   - Hook-level filters beyond the tool-name `match` do not exist in the
+//     manifest: `hooks[].path_match` and `hooks[].bash_match` were never
+//     projected (Claude Code's settings.json `matcher` filters only on the
+//     tool name) and are removed keys that the manifest load strips with a
+//     warning (src/schema/removed-keys.ts). A hook script filters on whatever
+//     it needs to by itself.
+//   - `blocking` is harness-internal: declared intent that `doctor`,
+//     `list` and `describe` display; nothing enforces it. Claude Code's
 //     settings.json has no documented equivalent (verified against the
 //     ecosystem as of 2026-04 — revisit if a runtime field appears), so
 //     it does NOT survive the projection.
@@ -46,16 +39,12 @@
 //   - Within an event, groups sorted by (matcher, command).
 //   - Within a group, the inner hooks[] preserves matcher-grouping order
 //     and is sorted by command for the same reason.
-import * as path from "node:path";
 import { expandHome } from "../../io/expand-home.js";
-import { signingKeyPathFor } from "../../runtime/approval-signing.js";
 export const DEFAULT_BUDGET_MS = 30_000;
 /** The manifest `tools.mcp[]` entry name that grounding enforcement keys off. */
 export const GROUNDING_MCP_SERVER_NAME = "grounding-mcp";
 /** The env var grounding-mcp's ledger-bridge reads for the evidence-ledger DB path. */
 export const EVIDENCE_LEDGER_DB_ENV = "EVIDENCE_LEDGER_DB";
-/** The env var grounding-mcp (>= 0.8.0) reads for the harness's own approval-marker signing-key path. */
-export const SOLUTION_VERDICT_SIGNING_KEY_ENV = "SOLUTION_VERDICT_SIGNING_KEY";
 export function generateSettings(manifest) {
     return generateSettingsWithWarnings(manifest).root;
 }
@@ -93,27 +82,11 @@ export function generateSettingsWithWarnings(manifest, extras = {}) {
     // GenerateSettingsResult.mcpServers.
     const desiredMcp = buildDesiredMcpServers(manifest, {
         homeDir: extras.homeDir,
-        generatedDir: extras.generatedDir,
     });
     warnings.push(...desiredMcp.warnings);
     const mcp = desiredMcp.mcp;
-    const permissions = compactPermissions(extras.packPermissions);
-    if (permissions)
-        out.permissions = permissions;
     return { root: out, warnings, mcpServers: mcp };
 }
-function compactPermissions(p) {
-    if (!p)
-        return null;
-    const out = {};
-    if (p.allow && p.allow.length > 0)
-        out.allow = [...p.allow].sort();
-    if (p.ask && p.ask.length > 0)
-        out.ask = [...p.ask].sort();
-    if (p.deny && p.deny.length > 0)
-        out.deny = [...p.deny].sort();
-    return Object.keys(out).length > 0 ? out : null;
-}
 // Translate manifest `tools.mcp[]` into Claude Code's `mcpServers` map.
 // - `enabled: false` entries are dropped (matches ARCHITECTURE §3 and the
 //   asset-locking surface in harness-lock.ts: disabled MCPs are removed
@@ -188,9 +161,9 @@ export function buildMcpServers(entries, warnings) {
  * - The projected value is `~`-expanded to an absolute path, so the
  *   literal-tilde child-process footgun (agent-tasks/42d224a6, the very
  *   warning above in buildMcpServers) cannot re-enter via this path.
- * - `retention_days`, `policies_source`, and `session.*` stay RESERVED:
- *   nothing consumes them yet (evidence-ledger has no retention pruning),
- *   and projecting an env no server reads would be decorative again. See
+ * - `session.*` stays RESERVED: nothing consumes it yet, and projecting
+ *   an env no server reads would be decorative again (`retention_days` and
+ *   `policies_source` were removed from the schema, task a4d8adc5). See
  *   the status comments in src/schema/grounding.ts.
  */
 function projectGroundingEnv(manifest, mcp, homeDir) {
@@ -215,97 +188,27 @@ function projectGroundingEnv(manifest, mcp, homeDir) {
 export function groundingLedgerEnvValue(manifest, homeDir) {
     return expandHome(manifest.grounding.evidence_ledger.path, homeDir);
 }
-/**
- * Wire the harness's own approval-signing key path into the grounding-mcp
- * server entry (task 03a917fd/H1, agent-grounding 9b6c4beb comment 2,
- * Option 2), exactly mirroring `projectGroundingEnv` above.
- *
- * `<generatedDir>/.approval-signing.key` (see `signingKeyPathFor`,
- * src/runtime/approval-signing.ts) becomes the `SOLUTION_VERDICT_SIGNING_KEY`
- * env on the `tools.mcp[grounding-mcp]` entry — the variable grounding-mcp
- * (>= 0.8.0) reads primarily and THROWS on a non-absolute value, so this
- * projects only the fully-resolved, already-absolute key PATH, never the
- * key bytes themselves.
- *
- * Rules (mirrors `projectGroundingEnv`):
- * - Projection only fires when a grounding-mcp entry exists; without one
- *   there is no consumer.
- * - An operator-declared `env.SOLUTION_VERDICT_SIGNING_KEY` on the entry
- *   wins — an explicit override is never clobbered (same truthiness check:
- *   an empty-string "override" is treated as absent).
- * - No `generatedDir` passed in -> no projection, no crash. There is
- *   nothing correct to derive without it (see `GenerateSettingsExtras`).
- * - `generatedDir` is normalized at this projection boundary before it
- *   reaches `signingKeyPathFor` (review round H1, Finding 1): `expandHome`
- *   (same idiom `projectGroundingEnv` above and `groundingLedgerEnvValue`
- *   use) then `path.resolve`, so a relative `generatedDir` or one carrying
- *   a literal `~` still projects an absolute path — the same
- *   never-a-tilde, always-absolute contract `groundingLedgerEnvValue`
- *   already gives `EVIDENCE_LEDGER_DB`. This harness never THROWS on a
- *   relative/tilde `generatedDir` the way grounding-mcp's own consumer
- *   throws on a non-absolute env value; it normalizes instead. The
- *   normalization lives in `signingKeyEnvValue` so every producer of this
- *   env value shares it (review round H1-R2: the adopt mirror in
- *   adopt/derive.ts computes the SAME value through the SAME function;
- *   a producer that hand-rolls `signingKeyPathFor` on a raw `generatedDir`
- *   reintroduces phantom adopt drift). The key FILE's on-disk location for
- *   a non-absolute `generatedDir` is a separate, tracked follow-up.
- */
-function projectSigningKeyEnv(mcp, generatedDir, homeDir) {
-    const server = mcp[GROUNDING_MCP_SERVER_NAME];
-    if (!server)
-        return;
-    if (!generatedDir)
-        return;
-    const env = server.env ?? {};
-    if (!env[SOLUTION_VERDICT_SIGNING_KEY_ENV]) {
-        env[SOLUTION_VERDICT_SIGNING_KEY_ENV] = signingKeyEnvValue(generatedDir, homeDir);
-        server.env = env;
-    }
-}
-/**
- * The single source of the projected `SOLUTION_VERDICT_SIGNING_KEY` VALUE
- * (mirrors how `EVIDENCE_LEDGER_DB` shares its value): `expandHome` +
- * `path.resolve` on `generatedDir`, then `signingKeyPathFor`. Both the
- * apply-side projection above and the adopt-side mirror
- * (adopt/derive.ts) MUST call this, never `signingKeyPathFor` on a raw
- * `generatedDir` — otherwise apply and adopt disagree for relative or
- * literal-tilde `generatedDir` values and adopt reports phantom drift.
- */
-export function signingKeyEnvValue(generatedDir, homeDir) {
-    return signingKeyPathFor(path.resolve(expandHome(generatedDir, homeDir)));
-}
 /**
  * Single choke point for the manifest -> Claude-Code-shaped MCP
  * server-spec projection (review round H1, Finding 2 — STRUCTURAL fix).
  * Encapsulates the fixed sequence `buildMcpServers` -> `projectGroundingEnv`
- * -> `projectSigningKeyEnv` so every producer of this shape — `harness
- * apply`'s settings.json generation (this module), the init wizard's
- * `claude mcp` CLI wiring (`src/cli/init/interactive.ts`), the doctor
- * registration-health check (`src/cli/doctor/claude-mcp.ts`), and the
- * opencode config generator (`generate-opencode-config.ts`) — calls this
- * ONE function instead of hand-rolling the same three-call sequence.
- *
- * Before this helper existed, that sequence had to be wired into each
- * call site by hand: three of the four remembered to call
- * `projectSigningKeyEnv` when it was added (task 03a917fd/H1b), and
- * doctor's registration check did not, so its "not registered, run this
- * `claude mcp add-json ...`" hint silently omitted
- * `SOLUTION_VERDICT_SIGNING_KEY` (review round H1, Finding 2). Routing
- * every producer through this function means the NEXT projected env only
- * needs to be added here once, and cannot again reach only some of the
- * call sites.
+ * so every producer of this shape, `harness apply`'s settings.json
+ * generation (this module), the init wizard's `claude mcp` CLI wiring
+ * (`src/cli/init/interactive.ts`), the doctor registration-health check
+ * (`src/cli/doctor/claude-mcp.ts`), and the opencode config generator
+ * (`generate-opencode-config.ts`), calls this ONE function instead of
+ * hand-rolling the same sequence. A NEW projected env only needs to be
+ * added here once, and cannot reach only some of the call sites.
  */
 export function buildDesiredMcpServers(manifest, opts = {}) {
     const warnings = [];
     const mcp = buildMcpServers(manifest.tools.mcp, warnings);
     projectGroundingEnv(manifest, mcp, opts.homeDir);
-    projectSigningKeyEnv(mcp, opts.generatedDir, opts.homeDir);
     return { mcp, warnings };
 }
 // Translate manifest `memory.router` into a synthetic UserPromptSubmit
-// hook so per-prompt context augmentation actually fires alongside the
-// understanding-gate hook. Returns null when memory.router is absent or
+// hook so per-prompt context augmentation actually fires on prompt
+// submit. Returns null when memory.router is absent or
 // `enabled: false`, in which case no entry lands in settings.json.
 //
 // Command joining: the schema accepts `command: string[]` (min 1). For
@@ -319,10 +222,9 @@ export function buildDesiredMcpServers(manifest, opts = {}) {
 // avoid spaces in installed binary paths.
 //
 // Timeout: `memory.router` has no manifest-level budget_ms field, so we
-// pick 5000ms to match the existing `understanding-gate-claude-hook`
-// timeout. A per-prompt augmentation that visibly delays prompt-submit
-// would be hostile UX; 5s is generous for the router's typical
-// memory-file scan.
+// pick 5000ms for prompt-submit latency: a per-prompt augmentation that
+// visibly delays prompt-submit would be hostile UX, and 5s is generous
+// for the router's typical memory-file scan.
 export function buildMemoryRouterHook(manifest) {
     const router = manifest.memory.router;
     if (!router)
@@ -372,12 +274,10 @@ function buildGroups(hooks) {
     const groups = [];
     for (const key of matcherKeys) {
         const groupHooks = byMatcher.get(key) ?? [];
-        // Multiple harness hooks frequently share the same command (the
-        // generic `harness policy intercept` engine is the obvious case:
-        // every PreToolUse policy in the full template wires to it). Claude
+        // Multiple harness hooks can share the same command. Claude
         // Code spawns each entry in `hooks[]` independently for the same
         // tool event, so emitting duplicates causes redundant Node bootstraps
-        // and ledger queries per tool call. Dedupe by (command, timeout)
+        // per tool call. Dedupe by (command, timeout)
         // inside each matcher group so only one spawn happens per
         // logically-identical hook, regardless of how many manifest entries
         // map to it.
@@ -410,15 +310,10 @@ function buildGroups(hooks) {
  * helper is the single source of truth both projections now share so they
  * cannot diverge again.
  *
- * `Math.ceil` never rounds a budget down to 0s. The floor (2s for `harness
- * policy intercept`, 1s otherwise) matches Codex's existing floor rationale
- * (generate-codex-config.ts): the policy-intercept engine's own ledger
- * round-trip regularly needs slightly longer than a bare 1s floor would
- * allow.
+ * `Math.ceil` never rounds a budget down to 0s: every hook gets a 1s floor.
  */
 export function hookTimeoutSeconds(h) {
-    const minimumSeconds = h.command.trim() === "harness policy intercept" ? 2 : 1;
-    return Math.max(minimumSeconds, Math.ceil(h.budget_ms / 1000));
+    return Math.max(1, Math.ceil(h.budget_ms / 1000));
 }
 function toSettingsCommand(h) {
     return { type: "command", command: h.command, timeout: hookTimeoutSeconds(h) };

package/dist/cli/apply/generate-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-settings.js","sourceRoot":"","sources":["../../../src/cli/apply/generate-settings.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,uFAAuF;AACvF,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,kCAAkC;AAClC,6EAA6E;AAC7E,0EAA0E;AAC1E,mDAAmD;AACnD,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,4DAA4D;AAC5D,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,0EAA0E;AAC1E,gBAAgB;AAChB,uEAAuE;AACvE,0DAA0D;AAC1D,4DAA4D;AAC5D,yEAAyE;AACzE,oDAAoD;AAEpD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,yGAAyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAuF/E,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAkB,EAClB,SAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,gEAAgE;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,8DAA8D;IAC9D,+CAA+C;IAC/C,qCAAqC;IACrC,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAE3B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAE/C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAkC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,0BAA0B;AAC1B,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sBAAsB;AACtB,+DAA+D;AAC/D,uEAAuE;AACvE,4DAA4D;AAC5D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,QAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,0DAA0D;QAC1D,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,4DAA4D;YAC5D,iEAAiE;YACjE,qDAAqD;YACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,CAAC,IAAI,QAAQ,GAAG,YAAY,KAAK,uLAAuL,CACvO,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,mBAAmB,CAC1B,QAAkB,EAClB,GAAsC,EACtC,OAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,sBAAsB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,OAAgB;IAEhB,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,oBAAoB,CAC3B,GAAsC,EACtC,YAAqB,EACrB,OAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,gCAAgC,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,OAAgB;IACvE,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAkB,EAClB,OAAsC,EAAE;IAExC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1D,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,0CAA0C;AAC1C,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,+DAA+D;AAC/D,oBAAoB;AACpB,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,OAAuC;IAEvC,OAAO,GAAG,OAAO,SAAS,OAAO,IAAI,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,iEAAiE;QACjE,0DAA0D;QAC1D,oEAAoE;QACpE,aAAa;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3D,EAAE,CAAC;YACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GACT,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAO;IACxC,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAO;IAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"generate-settings.js","sourceRoot":"","sources":["../../../src/cli/apply/generate-settings.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,uFAAuF;AACvF,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,kCAAkC;AAClC,6EAA6E;AAC7E,0EAA0E;AAC1E,mDAAmD;AACnD,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,4DAA4D;AAC5D,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,6BAA6B;AAC7B,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,0EAA0E;AAC1E,gBAAgB;AAChB,uEAAuE;AACvE,0DAA0D;AAC1D,4DAA4D;AAC5D,yEAAyE;AACzE,oDAAoD;AAIpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AA4D3D,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAkB,EAClB,SAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,gEAAgE;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,8DAA8D;IAC9D,+CAA+C;IAC/C,qCAAqC;IACrC,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAE3B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,0BAA0B;AAC1B,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sBAAsB;AACtB,+DAA+D;AAC/D,uEAAuE;AACvE,4DAA4D;AAC5D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,QAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,0DAA0D;QAC1D,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,4DAA4D;YAC5D,iEAAiE;YACjE,qDAAqD;YACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC,CAAC,IAAI,QAAQ,GAAG,YAAY,KAAK,uLAAuL,CACvO,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,mBAAmB,CAC1B,QAAkB,EAClB,GAAsC,EACtC,OAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,sBAAsB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,OAAgB;IAEhB,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAkB,EAClB,OAAsC,EAAE;IAExC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1D,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,uEAAuE;AACvE,mEAAmE;AACnE,uDAAuD;AACvD,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,0CAA0C;AAC1C,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,6CAA6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,OAAuC;IAEvC,OAAO,GAAG,OAAO,SAAS,OAAO,IAAI,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,4DAA4D;QAC5D,iEAAiE;QACjE,sEAAsE;QACtE,8CAA8C;QAC9C,0DAA0D;QAC1D,oEAAoE;QACpE,aAAa;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3D,EAAE,CAAC;YACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GACT,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAO;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAO;IAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/cli/apply/index.d.ts

@@ -3,4 +3,4 @@ export { CodexInstallRefusalError } from "./install-codex-config.js";
 export { formatNextSteps, type NextStepsContext } from "./next-steps.js";
 export { generateCodexConfig, type CodexConfigResult } from "./generate-codex-config.js";
 export { generateOpencodeConfig, OPENCODE_GENERATED_HEADER_LINE, type OpencodeConfigResult, type OpencodeLocalMcpServer, type OpencodeDisabledMcpServer, type OpencodeMcpEntry, } from "./generate-opencode-config.js";
-export { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, CODEX_MANAGED_SOURCE_PREFIX, defaultCodexConfigPath, planCodexConfigInstall, validateCodexManagedConfig, writeCodexConfigInstall, type CodexConfigInstallPlan, type CodexConfigInstallResult, } from "./install-codex-config.js";
+export { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, defaultCodexConfigPath, planCodexConfigInstall, writeCodexConfigInstall, type CodexConfigInstallPlan, type CodexConfigInstallResult, } from "./install-codex-config.js";

package/dist/cli/apply/index.js

@@ -3,5 +3,5 @@ export { CodexInstallRefusalError } from "./install-codex-config.js";
 export { formatNextSteps } from "./next-steps.js";
 export { generateCodexConfig } from "./generate-codex-config.js";
 export { generateOpencodeConfig, OPENCODE_GENERATED_HEADER_LINE, } from "./generate-opencode-config.js";
-export { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, CODEX_MANAGED_SOURCE_PREFIX, defaultCodexConfigPath, planCodexConfigInstall, validateCodexManagedConfig, writeCodexConfigInstall, } from "./install-codex-config.js";
+export { CODEX_MANAGED_BEGIN, CODEX_MANAGED_END, defaultCodexConfigPath, planCodexConfigInstall, writeCodexConfigInstall, } from "./install-codex-config.js";
 //# sourceMappingURL=index.js.map

package/dist/cli/apply/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/apply/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAOlB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAyB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAA0B,MAAM,4BAA4B,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAK/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/apply/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAOlB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAyB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAA0B,MAAM,4BAA4B,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAK/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC"}

package/dist/cli/apply/install-codex-config.d.ts

@@ -2,6 +2,19 @@ import { HarnessExitError } from "../exit-codes.js";
 export declare const CODEX_MANAGED_SOURCE_PREFIX = "# Harness Codex hook wiring.";
 export declare const CODEX_MANAGED_BEGIN = "# BEGIN harness-managed codex hooks";
 export declare const CODEX_MANAGED_END = "# END harness-managed codex hooks";
+/**
+ * The comment line the installer writes directly under the BEGIN fence,
+ * followed by the block's generation: the sha256 of the generated content
+ * the block holds (`codexBlockGeneration`). `harness gate disable --runtime
+ * codex` records it in its snapshot, and a snapshot whose recorded generation
+ * differs from the block's is one a later install re-rendered the block over:
+ * it is retired as superseded and never applied, wherever it sits and whatever
+ * backup files exist. A comment adds, removes and reorders no hook entry, so
+ * Codex keeps every hook at the position its trust state was recorded for.
+ * The same content renders the same line, so an install of an unchanged
+ * manifest stays a no-op.
+ */
+export declare const CODEX_BLOCK_GENERATION_PREFIX = "# harness block generation: ";
 /**
  * Thrown instead of a plain `Error` when the install refuses rather than
  * guesses (a duplicate/moved BEGIN marker, or a foreign table wedged
@@ -32,6 +45,12 @@ export interface CodexConfigInstallPlan {
      * directory is typically a dotfiles git work tree.
      */
     linkPath?: string;
+    /**
+     * The requested config path, set only when the call named one
+     * (`--codex-config`). A command a message prints repeats the flag only
+     * then, so a pasted command acts on the config the call acted on.
+     */
+    namedConfigPath?: string;
     generatedPath: string;
     currentContent: string;
     nextContent: string;
@@ -85,6 +104,14 @@ export interface CodexConfigInstallPlan {
 export interface CodexConfigInstallResult extends CodexConfigInstallPlan {
     backupPath?: string;
     written: boolean;
+    /** Live `harness gate disable --runtime codex` snapshots of this config the
+     * write retired as `*.superseded.json`: the block they were taken from no
+     * longer exists. */
+    supersededSnapshots?: string[];
+    /** A snapshot that could not be retired or read (the install itself
+     * succeeded): what to do by hand. The callers print them through their own
+     * io. */
+    snapshotWarnings?: string[];
 }
 export interface CodexConfigInstallOptions {
     configPath?: string;
@@ -240,7 +267,132 @@ export declare function validateCodexManagedConfig(content: string): void;
  * install would (both go through `planCodexConfigInstall`).
  */
 export declare function assertConfigSemanticInvariant(currentContent: string, nextContent: string, configPath: string): void;
+/**
+ * Resolves a symlinked config path to the regular file it points at (task
+ * 1637fbc8). `atomicWriteFile` renames a temp file over its destination,
+ * which would replace a symlink with a regular file and leave the link's
+ * target (typically a dotfiles repo) silently stale; writing to the
+ * resolved target instead keeps the link intact. A non-symlink path
+ * (including a missing one) is returned unchanged. A dangling link, an
+ * unresolvable chain (a loop, a permission error) or a link to anything
+ * other than a regular file is refused before anything is written. The
+ * chain is walked as the kernel walks it (`walkLinkChain`): a `..` after a
+ * directory link climbs out of the directory that link leads to, so the file
+ * written is the one a read through the path gives. The path itself is taken
+ * as given; a caller passes a spelling with `..` through `kernelEntry` first.
+ */
+export declare function resolveConfigSymlink(requestedPath: string): string;
 export declare function planCodexConfigInstall(opts: CodexConfigInstallOptions): CodexConfigInstallPlan;
-export declare function writeCodexConfigInstall(plan: CodexConfigInstallPlan, opts?: {
+/** The time of the newest install that rewrote the config at `filePath`, in
+ * epoch milliseconds, read from the `<filePath>.harness-backup-<timestamp>`
+ * files `writeCodexConfigInstall` leaves beside it (one per write of an
+ * existing config), or null when there is none. `harness gate enable
+ * --runtime codex` uses it to tell a snapshot taken before a re-install
+ * (whose units that install re-rendered) from one taken after it. Reads the
+ * directory only. */
+export declare function latestCodexInstallBackupMs(filePath: string): number | null;
+/** Like {@link latestCodexInstallBackupMs}, and also the path of the newest
+ * backup file, so a message can name the install that dated a snapshot. A
+ * backup whose name spells the file in another letter case or normalization
+ * form (an install that ran through `Config.toml` for `config.toml` on a
+ * filesystem that folds those) counts when both spellings are one entry
+ * (`namesSameEntry`); on a filesystem that keeps them apart, another file's
+ * backups never do. */
+export declare function latestCodexInstallBackup(filePath: string): {
+    ms: number;
+    path: string;
+} | null;
+/** The config holds operator secrets (API tokens under `[mcp_servers.*]`,
+ * Codex hook trust hashes); the install must never widen its permissions.
+ * Preserves the existing file's own mode for both the rewritten config and
+ * its backup, and falls back to `0o600` (owner read/write only) when
+ * creating a config that did not exist before this install, rather than
+ * `atomicWriteFile`'s own `0o644` default. */
+export declare function existingFileMode(filePath: string): number;
+/**
+ * Writes the install. A live gate snapshot of the config holds the hook
+ * lines of the block this write replaces, so enabling it later would put an
+ * outdated line back: every such snapshot (beside every hop of the requested
+ * path's link chain and beside the target) is renamed to `*.superseded.json` right after the
+ * write, whatever backup files exist. A rename that fails never fails the
+ * install, which is already on disk: it is a warning (`snapshotWarnings`,
+ * printed by the caller) naming the snapshot and the move-aside step. A
+ * snapshot this cannot find (beside a link outside that chain) records the
+ * block's generation marker, which this write changes when the content
+ * changes, so `gate enable` and `gate disable` retire it on sight. The
+ * backup-file dating in the gate stays as a further line of defence for a
+ * snapshot without a marker (taken before the marker existed).
+ */
+export declare function writeCodexConfigInstall(planned: CodexConfigInstallPlan, opts?: {
     now?: Date;
 }): CodexConfigInstallResult;
+/** One harness-owned hook unit inside the fenced managed block: the block
+ * `generate-codex-config.ts`'s `emitHook` writes (a `# harness hook:` comment
+ * line, the `[[hooks.<Event>]]` header, an optional `matcher =` line and the
+ * `hooks = [...]` line). `harness gate disable` neutralises a unit in place
+ * by replacing its `hooks = [...]` value with `hooks = []`; such a unit is
+ * `disabled`. */
+export interface CodexManagedHookUnit {
+    /** The id in the comment line, e.g. `policy-pack:branch-protection:pre-tool-use`. */
+    id: string;
+    event: string;
+    matcher: string | null;
+    commands: string[];
+    /** True when the unit's `hooks` array is empty (neutralised by the gate). */
+    disabled: boolean;
+    /** Offset of the unit's comment line. */
+    start: number;
+    /** Offsets `[hooksStart, hooksEnd)` of the `hooks = [...]` line, without
+     * its indentation, trailing blanks or line terminator, so a replacement
+     * leaves LF and CRLF files byte-for-byte alike outside that span. */
+    hooksStart: number;
+    hooksEnd: number;
+}
+export interface CodexManagedHookBlock {
+    units: CodexManagedHookUnit[];
+    /**
+     * The block's generation (`CODEX_BLOCK_GENERATION_PREFIX`): the hash on the
+     * line right under the BEGIN fence, or null when that line is not exactly
+     * that shape (a block an older install wrote, or a line removed or edited by
+     * hand). A null generation dates nothing, so the gate falls back to its
+     * other rules and never refuses an enable for the line alone.
+     */
+    generation: string | null;
+}
+/**
+ * The harness-owned hook units of the fenced managed block in `text`, with
+ * exact offsets, for `harness gate` (the operator's switch for a blocking
+ * hook). It reuses the installer's own range scan (`findManagedRange`), so
+ * the refusals that scan raises (a duplicate BEGIN marker, a foreign table
+ * wedged inside the block) apply here unchanged, and adds the stricter
+ * reading an edit needs: the block must be fenced by BEGIN and a closing END
+ * marker line, every non-blank line inside it must be a comment or part of a
+ * unit of the exact shape the generator writes, and no harness hook comment
+ * may sit outside the block (`assertNoOrphanHarnessHookTable`). Anything else
+ * refuses instead of guessing which bytes are harness-owned. Returns null
+ * when the file holds no managed block. The block's generation marker is read
+ * too, never required: a block without it reads as `generation: null`.
+ * Reads only; the file is never touched.
+ */
+export declare function readCodexManagedHookUnits(text: string, configPath: string): CodexManagedHookBlock | null;
+/** What a gate edit of the managed block is allowed to change. A `disable`
+ * neutralises units (a unit's `hooks` array becomes empty); an `enable` puts
+ * the original `hooks` arrays back. `counts` is how many entries of each hook
+ * event the edit changes. */
+export interface CodexHookEditExpectation {
+    direction: "neutralise" | "restore";
+    counts: Record<string, number>;
+}
+/**
+ * The safety net for a gate edit of the managed block. First the installer's
+ * own semantic invariant (both documents parse, and everything outside the
+ * hook event arrays is deep-equal), then the part that invariant leaves out
+ * on purpose, compared entry by entry: per hook event the arrays have the
+ * same length, every entry is deep-equal to its counterpart except exactly
+ * `expected.counts[event]` entries, and each of those differs only in its
+ * `hooks` array (emptied by a neutralise, filled again by a restore). So a
+ * gate edit can neither drop, add or reorder an entry nor move a key from one
+ * entry to another, and Codex keeps every other hook at the position its
+ * trust state was recorded for.
+ */
+export declare function assertCodexHookEditInvariant(before: string, after: string, configPath: string, expected: CodexHookEditExpectation): void;