@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/doctor/auto-approve-mode.js

@@ -1,80 +0,0 @@
-// Doctor advisory (agent-tasks abfad738, follow-up of ADR
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1): warn when
-// an operator has opted into the hook-written signed auto-marker path
-// (`policy_packs[understanding-before-execution].config.auto_approve`)
-// without also pairing it with `mode: grill_me`.
-//
-// Why this matters: the auto-approval path's report precondition reuses
-// `validatePersistedReport` (`src/cli/approve/understanding.ts`), which
-// only enforces the report's `mode` field when it is `grill_me`.
-// Outside that mode, report validation is structural only (the report
-// exists and belongs to the session, not that its contents reflect any
-// real understanding exchange). Both the ADR (recommendation 4) and the
-// pack doc recommend pairing `auto_approve` with `grill_me` for exactly
-// this reason. Nothing surfaced the gap before this check: an operator
-// who opts a non-grill_me mode into `auto_approve` gets no signal that
-// the auto path's report gate has degraded to a near-no-op.
-//
-// Deliberately advisory, never an error: `auto_approve` outside
-// `grill_me` is a real, if weaker, gate (the permission-mode allowlist
-// and the signed marker still apply), not a misconfiguration.
-//
-// This check reads `resolveModeFromConfig(pack).mode`, the same
-// GENERATION-path resolver `checkUnderstandingModeEnvDivergence` and
-// `resolveBuiltinDefaultConfig` use, NOT `pack.config.mode` verbatim.
-// A missing `config.mode` resolves to `DEFAULT_MODE` (`grill_me`), and
-// that resolved value is what the generated Stop-hook command actually
-// passes as `UNDERSTANDING_GATE_MODE`, so a report written under an
-// unset `mode` genuinely carries `grill_me` and IS the strict check;
-// there is no gap to warn about. An unrecognised `config.mode` literal
-// also resolves to `grill_me` this same way, with its own warning
-// already surfaced elsewhere (`resolveModeFromConfig`'s `warning`
-// return, consumed by `harness validate` / other doctor checks); this
-// check does not duplicate that.
-//
-// A session-level `UNDERSTANDING_GATE_MODE` env override that diverges
-// from the resolved `config.mode` is a SEPARATE gap, already covered by
-// `checkUnderstandingModeEnvDivergence` (`understanding-mode-env.ts`)'s
-// own advisory line, this check only ever reads the manifest, never
-// `process.env`.
-import { resolveModeFromConfig } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { parseAutoApprove } from "../../policy-packs/builtin/understanding-before-execution/index.js";
-import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
-/**
- * Pure: manifest in, a warning out (or `undefined` when there is nothing
- * to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (a pack that never runs has no live auto-approve path to warn
- *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
- *     `ug-auto-approvals.ts` use);
- *   - `config.auto_approve` parses as a valid opt-in block (schema
- *     validation already rejects a malformed block at lint time, so a
- *     manifest that reaches doctor with an unparseable block has
- *     already failed loud elsewhere; this mirrors that same fail-closed
- *     "not opted in" reading rather than re-deriving a second opinion);
- *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
- *     is not `"grill_me"`. An absent or unrecognised `config.mode`
- *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
- *     this warning, see the module header for why that resolved value,
- *     not the literal config key, is what the auto path's report
- *     actually carries.
- */
-export function checkAutoApproveMode(manifest) {
-    const pack = findEnabledUnderstandingPack(manifest);
-    if (!pack)
-        return undefined;
-    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
-    if (autoApprove === null)
-        return undefined;
-    const { mode } = resolveModeFromConfig(pack);
-    if (mode === "grill_me")
-        return undefined;
-    return {
-        mode,
-        message: `auto_approve is configured with mode ${mode} (policy_packs[understanding-before-execution].config.mode); report validation is structural only outside grill_me`,
-        detail: [
-            "set config.mode: grill_me, or accept the weaker report gate; see docs/policy-packs/understanding-before-execution.md",
-        ],
-    };
-}
-//# sourceMappingURL=auto-approve-mode.js.map

package/dist/cli/doctor/auto-approve-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auto-approve-mode.js","sourceRoot":"","sources":["../../../src/cli/doctor/auto-approve-mode.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,iBAAiB;AAEjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oEAAoE,CAAC;AAEtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAmB3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAE1C,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,wCAAwC,IAAI,oHAAoH;QACzK,MAAM,EAAE;YACN,sHAAsH;SACvH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/bypass-without-auto-approve.d.ts

@@ -1,38 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-export interface BypassWithoutAutoApproveFinding {
-    /** The newest observed session that tripped this finding. */
-    sessionId: string;
-    /** That observation's `observedAt` (ISO). */
-    observedAt: string;
-    /** Rendered as the `⚠` line itself. */
-    message: string;
-    /**
-     * Indented detail lines rendered directly under {@link message},
-     * mirroring the other advisory checks' idiom. Ends with the exact
-     * `auto_approve` snippet (the same one `harness init` ships and
-     * `harness pack upgrade understanding-before-execution` inserts, see
-     * auto-approve-default.ts) and names the upgrade command.
-     */
-    detail: string[];
-}
-/**
- * Pure(-ish): manifest + `generatedDir` in, a finding out (or
- * `undefined` when there is nothing to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (mirrors every sibling advisory's gate: a pack that never runs
- *     has no auto-approve path to be missing);
- *   - at least one of the newest `recentSessions` hook-written
- *     observations records `permissionMode === "bypassPermissions"`;
- *   - `auto_approve` does NOT cover that combination today: either the
- *     block is absent/malformed (`parseAutoApprove` returns `null`), or
- *     `bypassPermissions` is not in `when`, or `claude-code` is not in
- *     `harnesses` (an operator who opted Codex in alone, dropping
- *     Claude Code, still has this exact gap on the Claude Code side).
- *
- * Reports the NEWEST qualifying observation only: this is a "you have
- * at least one gap" flag, not a per-session audit; `ugAutoApprovals`
- * already owns the full listing idiom for that.
- */
-export declare function checkBypassWithoutAutoApprove(manifest: Manifest, generatedDir: string, opts: {
-    recentSessions: number;
-}): BypassWithoutAutoApproveFinding | undefined;

package/dist/cli/doctor/bypass-without-auto-approve.js

@@ -1,95 +0,0 @@
-// Doctor finding for the Mac-mini incident shape (task 8f637efd,
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Amendment: install
-// default"): a session ran under `bypassPermissions` (observed on the
-// PreToolUse payload by the hook itself, see
-// permission-mode-observations.ts) but `auto_approve` is missing, or
-// present without covering `bypassPermissions` for `claude-code`. In
-// that shape every gated call in the session falls through to the manual
-// `harness approve understanding` prompt, which is exactly the gap the
-// operator hit: the pack expects an unattended session under
-// `bypassPermissions` to have opted in, and nothing said otherwise.
-//
-// This check reads ONLY the hook-written observation
-// (`.permission-mode-observations/`), never the ledger and never the
-// persisted report: both are agent-writable, and the evidence-ledger
-// trust boundary this pack already enforces for approval
-// (docs/okf/evidence-ledger-trust-boundary.md) applies to a doctor
-// finding just as much as to a gate decision: a fact the AGENT can write
-// must not be what tells the operator "you meant to opt in and didn't".
-//
-// Deliberately advisory (⚠), never an error: an operator who runs
-// `bypassPermissions` sessions on the manual approval path on purpose
-// (never wanting unattended auto-approval) is not misconfigured.
-//
-// THE OBSERVATION IS UNSIGNED (review round 3, F2). "Never the ledger,
-// never the persisted report" above is about the WRITE PATH (this
-// finding does not trust an agent-writable ledger row or report field),
-// not a claim that the observation itself is tamper-proof: unlike the
-// approval marker, `permission-mode-observations.ts`'s record carries no
-// signature, so it is evidence that `harness pack hook pre-tool-use` was
-// invoked with a given `session_id`/`permission_mode` on its stdin, not
-// proof that a particular session actually ran under that mode: an
-// already-approved session (or anything else able to invoke the hook
-// binary directly) can write, or forge, one. That is exactly why this
-// finding stays advisory-only and never feeds a gate or an approval: the
-// operator who reads it decides what it means. Signing the observation
-// was considered and rejected: a signature would only prove the hook
-// signed the record, not that the named session actually ran under that
-// mode, and it would open a second, unconditional signing surface for
-// the marker-signing key (not a path to mint an approval marker, which
-// stays namespaced by markerId). See
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md's "Amendment:
-// permission-mode observation stays unsigned" for the full reasoning and
-// the reopen criterion.
-import { CLAUDE_CODE_HARNESS, harnessAllowed, listPermissionModeObservations, parseAutoApprove, permissionModeAllowed, renderAutoApproveSnippet, sanitizeForDisplay, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
-/** The one payload literal this finding cares about (T1, see the ADR's signal table). */
-const BYPASS_MODE = "bypassPermissions";
-/**
- * Pure(-ish): manifest + `generatedDir` in, a finding out (or
- * `undefined` when there is nothing to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (mirrors every sibling advisory's gate: a pack that never runs
- *     has no auto-approve path to be missing);
- *   - at least one of the newest `recentSessions` hook-written
- *     observations records `permissionMode === "bypassPermissions"`;
- *   - `auto_approve` does NOT cover that combination today: either the
- *     block is absent/malformed (`parseAutoApprove` returns `null`), or
- *     `bypassPermissions` is not in `when`, or `claude-code` is not in
- *     `harnesses` (an operator who opted Codex in alone, dropping
- *     Claude Code, still has this exact gap on the Claude Code side).
- *
- * Reports the NEWEST qualifying observation only: this is a "you have
- * at least one gap" flag, not a per-session audit; `ugAutoApprovals`
- * already owns the full listing idiom for that.
- */
-export function checkBypassWithoutAutoApprove(manifest, generatedDir, opts) {
-    const pack = findEnabledUnderstandingPack(manifest);
-    if (!pack)
-        return undefined;
-    const observations = listPermissionModeObservations(generatedDir, {
-        windowSize: opts.recentSessions,
-    });
-    const bypassObserved = observations.entries.find((e) => e.permissionMode === BYPASS_MODE);
-    if (!bypassObserved)
-        return undefined;
-    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
-    const covered = permissionModeAllowed(autoApprove, BYPASS_MODE) &&
-        harnessAllowed(autoApprove, CLAUDE_CODE_HARNESS);
-    if (covered)
-        return undefined;
-    // Sanitise at the render boundary as well, not only in the reader
-    // (mirrors persisted-reports.ts): both fields are payload-controlled.
-    const sessionId = sanitizeForDisplay(bypassObserved.sessionId);
-    const observedAt = sanitizeForDisplay(bypassObserved.observedAt);
-    return {
-        sessionId,
-        observedAt,
-        message: `bypassPermissions observed for session ${sessionId} (${observedAt}) but auto_approve does not cover it (hook-written, unsigned self-report; confirm from your own launch settings before enabling auto_approve); every gated call in that session needed a manual approval`,
-        detail: [
-            "run `harness pack upgrade understanding-before-execution` to insert the block below, or add it by hand under policy_packs[understanding-before-execution].config:",
-            ...renderAutoApproveSnippet(0).split("\n"),
-        ],
-    };
-}
-//# sourceMappingURL=bypass-without-auto-approve.js.map

package/dist/cli/doctor/bypass-without-auto-approve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bypass-without-auto-approve.js","sourceRoot":"","sources":["../../../src/cli/doctor/bypass-without-auto-approve.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,0EAA0E;AAC1E,sEAAsE;AACtE,6CAA6C;AAC7C,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,qDAAqD;AACrD,qEAAqE;AACrE,qEAAqE;AACrE,yDAAyD;AACzD,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,qCAAqC;AACrC,mEAAmE;AACnE,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sEAAsE,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,yFAAyF;AACzF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAmBxC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAkB,EAClB,YAAoB,EACpB,IAAgC;IAEhC,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,YAAY,GAAG,8BAA8B,CAAC,YAAY,EAAE;QAChE,UAAU,EAAE,IAAI,CAAC,cAAc;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC/C,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAE9B,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACjE,OAAO;QACL,SAAS;QACT,UAAU;QACV,OAAO,EAAE,0CAA0C,SAAS,KAAK,UAAU,0MAA0M;QACrR,MAAM,EAAE;YACN,mKAAmK;YACnK,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/codex-config-drift.d.ts

@@ -1,28 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-export interface CodexConfigDriftSection {
-    /** ⚠ lines; each rolls into warningCount. */
-    warnings: string[];
-}
-/**
- * Whether the manifest's `understanding-before-execution` pack has opted
- * Codex into the `auto_approve` path (`auto_approve.harnesses` contains
- * `"codex"`). Pure and side-effect-free: reuses the same fail-closed
- * parser the Codex PreToolUse hook itself consults
- * (`attemptAutoApproval` in `../pack/auto-approve-path.ts`), so a
- * malformed `auto_approve` block resolves to "not opted in" here too,
- * never a guess.
- */
-export declare function isCodexOptedIntoAutoApprove(manifest: Manifest): boolean;
-export interface BuildCodexConfigDriftOptions {
-    /** `harness.generated/` for the manifest in use; kept for shape-parity with `BuildSettingsDriftOptions` (`driftCheckOpts` in index.ts is shared between both), unused by this check (see module header: no baseline exists to read here). */
-    generatedDir: string;
-    /** `harness.lock` path for the manifest in use; kept for the same shape-parity reason as `generatedDir`, unused by this check. */
-    lockPath: string;
-    /** Resolves the repo-scoped candidate file (`<cwd>/.codex/config.toml`). */
-    cwd: string;
-    /** Operator home; resolves the default `$CODEX_HOME` when the env var is unset. */
-    home: string;
-    /** Env for `CODEX_HOME` resolution. */
-    env: NodeJS.ProcessEnv;
-}
-export declare function buildCodexConfigDrift(opts: BuildCodexConfigDriftOptions): CodexConfigDriftSection;

package/dist/cli/doctor/codex-config-drift.js

@@ -1,240 +0,0 @@
-// Codex counterpart of settings-drift.ts (ADR
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md, threat model (c),
-// "Audit and doctor"), follow-up of slice 2 (agent-tasks f59ea0eb).
-//
-// `approval_policy = "never"` is the MEASURED signal: dogfood/ug-auto-
-// mode-signals/README.md section (l) (Codex TUI) shows `tui-config-never`
-// (`config.toml`: `approval_policy = "never"`) reports `bypassPermissions`
-// where the otherwise-comparable `tui-default` shape (no `approval_policy`
-// set) reports `default`, and section (k) (Codex exec) shows the same
-// key discriminating `exec-onrequest`/`exec-onfailure` (`bypassPermissions`
-// regardless, exec auto-approves almost everything headless) from nothing
-// special, i.e. exec's own vocabulary does not turn on this key either
-// way there. The `default_permissions` full-access check below is NOT a
-// measured signal in the same sense: section (k)'s exec rows show
-// `config-perm-fullaccess` (`default_permissions = ":danger-full-access"`)
-// and `config-perm-readonly` (`default_permissions = ":read-only"`) both
-// reporting `bypassPermissions`, i.e. this key does not discriminate
-// `permission_mode` at all under `codex exec`, and section (l)'s TUI
-// table has no `default_permissions`-via-`config.toml` row at all (the
-// one full-access TUI shape, `tui-perm-full-access`, was set through the
-// `/permissions` menu, not this config key, per
-// `payloads/codex-tui-perm-full-access.config.toml`). This check flags
-// `default_permissions` as a threat-model heuristic on a key the operator
-// can set (it is documented Codex config surface that plausibly feeds a
-// yet-unmeasured code path), not because measurement showed it moving
-// `permission_mode`.
-//
-// Either key pre-sets the trusted `when`-allowlist signal the Codex
-// auto-approval path (`src/cli/pack/auto-approve-path.ts`,
-// `CODEX_HARNESS`) consumes, the same way `permissions.defaultMode` does
-// for Claude Code (settings-drift.ts's module header, threat model (c)).
-//
-// Gated on the pack's `auto_approve.harnesses` actually listing `codex`
-// (`isCodexOptedIntoAutoApprove` below): a repo that never opted Codex
-// into the auto path has no live Codex `permission_mode` signal for this
-// key to pre-set, so warning there would be noise unconnected to any
-// live risk (mirrors the per-harness gate `attemptAutoApproval` itself
-// applies before the `when` allowlist, `auto-approve.ts`'s module
-// header).
-//
-// Unlike settings-drift.ts's `permissions.defaultMode` check, this is
-// NOT drift-gated (warn only when the live value differs from the
-// apply-time baseline): `approval_policy = "never"` is a real live risk
-// the moment it is present, whether or not it was already there at the
-// last `harness apply`, so this check always warns while present and
-// opted in. There is no apply-time three-way distinction to annotate
-// with either: harness never snapshots the operator's live, whole
-// `config.toml` (only `harness apply --runtime codex --install`'s own
-// generated hook block, merged in place by `install-codex-config.ts`,
-// ever lands in `.last-apply`'s `"codex/config.toml"` entry), and
-// `apply.ts` never records a `kind: "target"` lock entry for the
-// installed Codex config path the way it does for Claude Code's
-// `--target` write, so there is no baseline to compare the live value
-// against and no lock entry to tell a harness-touched file apart from
-// one it has never seen. Every warning below therefore carries the same
-// constant `NO_SNAPSHOT_SUFFIX`, reporting presence, not drift.
-//
-// Fail-open, like every other doctor check in this family: a missing or
-// unreadable candidate file resolves to "nothing to report" for that
-// file, and a candidate whose TOML this module's minimal scanner cannot
-// make sense of (an unterminated quoted string) adds ONE diagnostic
-// line, never a thrown error; the keys that did parse from the rest of
-// that same file are still evaluated and can still warn.
-//
-// No full TOML parser: none is a dependency of this package (checked
-// before writing this file), and `install-codex-config.ts` itself never
-// parses the operator's config.toml into an object either, it locates
-// harness's own managed block by string search. This module only needs
-// two ROOT-LEVEL (not inside any `[table]`) string-valued keys, so a
-// small line-oriented scanner is enough: it accepts a bare or quoted key
-// (`approval_policy = ...` and `"approval_policy" = ...`), skips over
-// multi-line basic/literal string bodies (`"""`/`'''`) so a body line
-// that happens to look like `key = "value"` inside one is never
-// mistaken for a root-level assignment, and does not attempt custom
-// `[profiles.*]` tables: a profile-scoped `approval_policy` under
-// `[profiles.<name>]` is out of scope and not detected today (see the
-// task's constraints).
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { PACK_NAME as UNDERSTANDING_PACK_NAME } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { CODEX_HARNESS, harnessAllowed, parseAutoApprove, } from "../../policy-packs/builtin/understanding-before-execution/auto-approve.js";
-import { tildeize } from "./settings-drift.js";
-/** Every warning line carries this: harness keeps no apply-time snapshot of a live Codex config.toml (see module header). */
-const NO_SNAPSHOT_SUFFIX = " (harness keeps no apply-time snapshot of this file; presence only)";
-/**
- * Whether the manifest's `understanding-before-execution` pack has opted
- * Codex into the `auto_approve` path (`auto_approve.harnesses` contains
- * `"codex"`). Pure and side-effect-free: reuses the same fail-closed
- * parser the Codex PreToolUse hook itself consults
- * (`attemptAutoApproval` in `../pack/auto-approve-path.ts`), so a
- * malformed `auto_approve` block resolves to "not opted in" here too,
- * never a guess.
- */
-export function isCodexOptedIntoAutoApprove(manifest) {
-    const pack = manifest.policy_packs.find((p) => p.name === UNDERSTANDING_PACK_NAME && p.enabled !== false);
-    if (!pack)
-        return false;
-    const cfg = parseAutoApprove(pack.config["auto_approve"], null);
-    return harnessAllowed(cfg, CODEX_HARNESS);
-}
-/**
- * Scan the ROOT-LEVEL (before the first `[table]` header) `key = "..."`
- * assignments in a Codex `config.toml` body. Returns the string-valued
- * keys found, plus `malformed: true` when a candidate assignment opens a
- * single-line quoted string that never closes on the same line (the one
- * shape this scanner treats as broken TOML rather than "not a string /
- * not a key we track"). A multi-line basic/literal string (`"""`/`'''`)
- * is a different, valid TOML shape: every line up to and including its
- * closing delimiter is skipped rather than scanned as assignments, and
- * skipping it never sets `malformed`. Non-string values (numbers,
- * booleans, arrays, inline tables) are silently skipped too, not flagged
- * malformed: this scanner has no opinion about them. The key itself may
- * be bare (`approval_policy`) or a quoted TOML key
- * (`"approval_policy"` / `'approval_policy'`); either form is accepted.
- */
-function scanRootLevelStringKeys(raw) {
-    const values = {};
-    let malformed = false;
-    let multilineDelim = null;
-    for (const rawLine of raw.split(/\r?\n/)) {
-        if (multilineDelim !== null) {
-            // Inside a multi-line basic/literal string body: this line is
-            // string content, never a root-level assignment, however much it
-            // may look like one. Only the closing delimiter ends the skip.
-            if (rawLine.includes(multilineDelim))
-                multilineDelim = null;
-            continue;
-        }
-        const line = rawLine.trim();
-        if (line.length === 0 || line.startsWith("#"))
-            continue;
-        // A `[table]` or `[[array-of-tables]]` header ends the root-level
-        // scope for every key from here on; this module only tracks
-        // root-level keys.
-        if (line.startsWith("["))
-            break;
-        const eq = line.indexOf("=");
-        if (eq === -1)
-            continue;
-        let key = line.slice(0, eq).trim();
-        if ((key.startsWith('"') && key.endsWith('"') && key.length >= 2) ||
-            (key.startsWith("'") && key.endsWith("'") && key.length >= 2)) {
-            key = key.slice(1, -1);
-        }
-        if (!/^[A-Za-z0-9_-]+$/.test(key))
-            continue;
-        const valuePart = line.slice(eq + 1).trim();
-        if (valuePart.startsWith('"""') || valuePart.startsWith("'''")) {
-            const delim = valuePart.slice(0, 3);
-            // A closing delimiter later on this same line makes it a
-            // single-line multi-line-string literal; this scanner does not
-            // track such values (out of scope, same as any other value shape
-            // it has no opinion about), it just must not treat the rest of
-            // the file as still inside the string.
-            if (valuePart.indexOf(delim, 3) === -1)
-                multilineDelim = delim;
-            continue;
-        }
-        const parsed = matchTomlString(valuePart);
-        if (parsed === null) {
-            if (valuePart.startsWith('"') || valuePart.startsWith("'"))
-                malformed = true;
-            continue;
-        }
-        values[key] = parsed;
-    }
-    return { values, malformed };
-}
-/** A basic (`"..."`) or literal (`'...'`) single-line TOML string, or `null` if `value` is not one. */
-function matchTomlString(value) {
-    if (value.startsWith('"')) {
-        const m = /^"((?:[^"\\]|\\.)*)"/.exec(value);
-        if (!m)
-            return null;
-        return (m[1] ?? "")
-            .replace(/\\"/g, '"')
-            .replace(/\\n/g, "\n")
-            .replace(/\\t/g, "\t")
-            .replace(/\\\\/g, "\\");
-    }
-    if (value.startsWith("'")) {
-        const m = /^'([^']*)'/.exec(value);
-        if (!m)
-            return null;
-        return m[1] ?? "";
-    }
-    return null;
-}
-function checkOneFile(file, warnings) {
-    let raw;
-    try {
-        raw = fs.readFileSync(file.absolutePath, "utf8");
-    }
-    catch {
-        return;
-    }
-    const scan = scanRootLevelStringKeys(raw);
-    if (scan.malformed) {
-        warnings.push(`${file.displayLabel}: unreadable/invalid Codex config TOML`);
-        // Keep going: a malformed line elsewhere in the file must not hide a
-        // risky key that DID parse from a different line of the same file.
-    }
-    const approvalPolicy = scan.values["approval_policy"];
-    if (approvalPolicy === "never") {
-        warnings.push(`approval_policy = "never" set in ${file.displayLabel}${NO_SNAPSHOT_SUFFIX}`);
-    }
-    const defaultPermissions = scan.values["default_permissions"];
-    if (defaultPermissions !== undefined) {
-        const stripped = defaultPermissions.startsWith(":")
-            ? defaultPermissions.slice(1)
-            : defaultPermissions;
-        if (stripped === "danger-full-access") {
-            warnings.push(`default_permissions = ${JSON.stringify(defaultPermissions)} (full access) set in ${file.displayLabel}${NO_SNAPSHOT_SUFFIX}`);
-        }
-    }
-}
-export function buildCodexConfigDrift(opts) {
-    const warnings = [];
-    const codexHomeEnv = opts.env["CODEX_HOME"];
-    const codexHomeFromEnv = typeof codexHomeEnv === "string" && codexHomeEnv.trim().length > 0;
-    const codexHomeDir = codexHomeFromEnv ? codexHomeEnv : path.join(opts.home, ".codex");
-    const codexHomeConfigPath = path.join(codexHomeDir, "config.toml");
-    const candidates = [
-        {
-            absolutePath: path.resolve(codexHomeConfigPath),
-            displayLabel: codexHomeFromEnv
-                ? "$CODEX_HOME/config.toml"
-                : tildeize(codexHomeConfigPath, opts.home),
-        },
-        {
-            absolutePath: path.resolve(opts.cwd, ".codex", "config.toml"),
-            displayLabel: ".codex/config.toml",
-        },
-    ];
-    for (const c of candidates) {
-        checkOneFile(c, warnings);
-    }
-    return { warnings };
-}
-//# sourceMappingURL=codex-config-drift.js.map

package/dist/cli/doctor/codex-config-drift.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-config-drift.js","sourceRoot":"","sources":["../../../src/cli/doctor/codex-config-drift.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,gDAAgD;AAChD,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,qBAAqB;AACrB,EAAE;AACF,oEAAoE;AACpE,2DAA2D;AAC3D,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,sEAAsE;AACtE,sEAAsE;AACtE,kEAAkE;AAClE,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AACzE,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,uBAAuB;AAEvB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,IAAI,uBAAuB,EAAE,MAAM,8DAA8D,CAAC;AACpH,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,2EAA2E,CAAC;AAEnF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAa/C,6HAA6H;AAC7H,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CACjE,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,iEAAiE;YACjE,+DAA+D;YAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,cAAc,GAAG,IAAI,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,kEAAkE;QAClE,4DAA4D;QAC5D,mBAAmB;QACnB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7D,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,EAC7D,CAAC;YACD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,yDAAyD;YACzD,+DAA+D;YAC/D,iEAAiE;YACjE,+DAA+D;YAC/D,uCAAuC;YACvC,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,cAAc,GAAG,KAAK,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAChB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;aACrB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;aACrB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B,EAAE,QAAkB;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,wCAAwC,CAAC,CAAC;QAC5E,qEAAqE;QACrE,mEAAmE;IACrE,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC9D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC;YACjD,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,kBAAkB,CAAC;QACvB,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,yBAAyB,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,yBAAyB,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAE,YAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAEnE,MAAM,UAAU,GAA2B;QACzC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC/C,YAAY,EAAE,gBAAgB;gBAC5B,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC;SAC7C;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC;YAC7D,YAAY,EAAE,oBAAoB;SACnC;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/cli/doctor/expire-on-tool-match.d.ts

@@ -1,15 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-export interface ExpireOnToolMatchWarning {
-    /** Rendered as the `⚠` line itself. */
-    message: string;
-    /** Indented detail lines rendered directly under {@link message}. */
-    detail: string[];
-}
-/**
- * Pure: manifest in, a warning out (or `undefined` when there is nothing
- * to flag). Fires only when the pack is declared and enabled, the
- * `approval_lifecycle` block is an object that is not `mode: session`,
- * and `expire_on_tool_match` is a non-empty array that contains
- * `task_finish` but not `task_merge`.
- */
-export declare function checkExpireOnToolMatch(manifest: Manifest): ExpireOnToolMatchWarning | undefined;

package/dist/cli/doctor/expire-on-tool-match.js

@@ -1,58 +0,0 @@
-// Doctor advisory (agent-tasks 0c6b2cb9): warn when an operator's explicit
-// `policy_packs[understanding-before-execution].config.approval_lifecycle
-// .expire_on_tool_match` lists `task_finish` but not `task_merge`.
-//
-// Why this matters: a `task_finish` that lands the task in `review` keeps
-// the approval marker (the work claim is kept, task 5018c0c4), so the
-// approval only expires on the later `task_merge`. An explicit list
-// without `task_merge` therefore never re-arms the gate on the
-// review-then-merge path. Every `harness init` scaffold lists it; a
-// hand-written list can miss it.
-//
-// Deliberately advisory, never an error: the list is the operator's
-// explicit choice. Silent for an absent block (the runtime applies
-// DEFAULT_BOUNDARY_TOOL_NAMES, which includes `task_merge`), for
-// `mode: session` (tool expiry is off by design), for an empty list, and
-// for a list that has `task_merge`.
-//
-// Tool names are matched through `toolNameMatchesAny`, the same
-// alias-aware helper the PostToolUse hook uses, so a Claude Code or Codex
-// name variant of the two tools counts the way it does at runtime.
-import { toolNameMatchesAny } from "../../policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js";
-import { TASK_FINISH_TOOL, TASK_MERGE_TOOL, } from "../../runtime/task-providers/agent-tasks.js";
-import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
-/**
- * Pure: manifest in, a warning out (or `undefined` when there is nothing
- * to flag). Fires only when the pack is declared and enabled, the
- * `approval_lifecycle` block is an object that is not `mode: session`,
- * and `expire_on_tool_match` is a non-empty array that contains
- * `task_finish` but not `task_merge`.
- */
-export function checkExpireOnToolMatch(manifest) {
-    const pack = findEnabledUnderstandingPack(manifest);
-    if (!pack)
-        return undefined;
-    const block = pack.config["approval_lifecycle"];
-    if (typeof block !== "object" || block === null || Array.isArray(block))
-        return undefined;
-    const lifecycle = block;
-    if (lifecycle["mode"] === "session")
-        return undefined;
-    const list = lifecycle["expire_on_tool_match"];
-    if (!Array.isArray(list))
-        return undefined;
-    const tools = list.filter((v) => typeof v === "string" && v.length > 0);
-    if (tools.length === 0)
-        return undefined;
-    const hasFinish = tools.some((t) => toolNameMatchesAny(t, [TASK_FINISH_TOOL]));
-    const hasMerge = tools.some((t) => toolNameMatchesAny(t, [TASK_MERGE_TOOL]));
-    if (!hasFinish || hasMerge)
-        return undefined;
-    return {
-        message: "approval_lifecycle.expire_on_tool_match lists task_finish but not task_merge (policy_packs[understanding-before-execution].config); a task_finish that lands in review keeps the approval, so it never expires on the review-then-task_merge path",
-        detail: [
-            `add ${TASK_MERGE_TOOL} to expire_on_tool_match; see docs/policy-packs/understanding-before-execution.md`,
-        ],
-    };
-}
-//# sourceMappingURL=expire-on-tool-match.js.map

package/dist/cli/doctor/expire-on-tool-match.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"expire-on-tool-match.js","sourceRoot":"","sources":["../../../src/cli/doctor/expire-on-tool-match.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,oEAAoE;AACpE,+DAA+D;AAC/D,oEAAoE;AACpE,iCAAiC;AACjC,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,yEAAyE;AACzE,oCAAoC;AACpC,EAAE;AACF,gEAAgE;AAChE,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qFAAqF,CAAC;AACzH,OAAO,EACL,gBAAgB,EAChB,eAAe,GAChB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAS3E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE7C,OAAO;QACL,OAAO,EACL,mPAAmP;QACrP,MAAM,EAAE;YACN,OAAO,eAAe,mFAAmF;SAC1G;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/rogue-ledger.d.ts

@@ -1,53 +0,0 @@
-import * as fs from "node:fs";
-export interface RogueLedgerDb {
-    /** Absolute path to the rogue ledger.db file. */
-    path: string;
-    /** Absolute path to the rogue `~` directory (the cleanup target). */
-    rogueDir: string;
-}
-export interface RogueLedgerScanOptions {
-    homeDir: string;
-    cwd: string;
-    /**
-     * Test injection: override fs operations. realpathSync is included so
-     * fixtures can simulate symlinks-with-same-target without actually
-     * creating cross-tmpdir symlinks (which surface differently on macOS
-     * and Linux because of /tmp -> /private/tmp resolution).
-     */
-    fsInterface?: Pick<typeof fs, "existsSync" | "statSync" | "lstatSync" | "readdirSync" | "realpathSync">;
-}
-/**
- * Walk a small set of well-known parent directories for a literal `~`
- * subdirectory that contains `.evidence-ledger/ledger.db`. Best-effort:
- * unreadable directories are silently skipped. Returns deduplicated
- * results (by realpath) sorted by path for stable rendering.
- */
-export declare function scanForRogueLedgers(opts: RogueLedgerScanOptions): RogueLedgerDb[];
-export interface DeleteRogueLedgersOptions {
-    /**
-     * When true, skip per-hit confirmation prompts and delete immediately.
-     * Maps to `harness doctor --rm-rogue-ledgers --yes`.
-     */
-    yes?: boolean;
-    /**
-     * Test injection: called per hit with the rogueDir path; returns true to
-     * confirm deletion, false to skip. When omitted and `yes` is false,
-     * production code prompts via readline on stdin.
-     * Same knob pattern as `mcpProbe` / `fsInterface` elsewhere in doctor.
-     */
-    promptFn?: (rogueDir: string) => Promise<boolean>;
-}
-export interface DeleteRogueLedgersResult {
-    /** Hits that were confirmed and whose rogueDir was removed. */
-    deleted: RogueLedgerDb[];
-    /** Hits that were skipped (operator declined or safety check failed). */
-    skipped: RogueLedgerDb[];
-}
-/**
- * Delete confirmed rogue ledger directories.
- *
- * Safety invariant: only deletes `hit.rogueDir` (the literal-tilde `~`
- * directory), never its parent. Any hit whose rogueDir basename is not
- * exactly `~` is silently skipped as a belt-and-suspenders guard.
- */
-export declare function deleteRogueLedgers(hits: RogueLedgerDb[], opts?: DeleteRogueLedgersOptions): Promise<DeleteRogueLedgersResult>;