@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/pack/hook-post-merge-gate-record.js

@@ -1,190 +0,0 @@
-// `harness pack hook post-merge-gate-record` — PostToolUse producer for
-// the `post-merge-gate` policy pack.
-//
-// Receives Claude Code's PostToolUse event JSON on stdin. Fires only when
-// the just-completed tool was Bash AND the command matched `gh pr merge`
-// (see "Trigger arms" below) AND the merge is CONFIRMED by one of two contracts (see
-// `resolveMergeConfirmation` in post-merge-gate-runtime.ts, "PAYLOAD
-// REALITY" follow-up):
-//
-//   Contract A (original, unchanged): `tool_output.exit_code === 0`.
-//   Contract B (2.1.218 payload reality): `tool_response` present with
-//     `interrupted === false` AND `stdout`+`stderr` containing `gh pr
-//     merge`'s own past-tense success sentence (all three merge methods).
-//
-// Contract A wins whenever it resolves to any definite verdict (success
-// OR failure); Contract B is consulted only when Contract A's exit_code
-// is entirely unresolvable. On a confirmed merge, records a
-// `post-merge-gate:merged:<repo>:<branch>:<sha>` fact (plus PR number and
-// timestamp, audit-only) to the evidence ledger via the same
-// Trusted-Writer path `harness session-start branch-check` /
-// `harness record *` use (`resolveManifestLedgerWriter` /
-// `addLedgerFact`) — never an agent-issued `ledger_add`.
-//
-// `<sha>` is the LOCAL branch tip observed right after the tool ran:
-// `gh pr merge` merges the PR on the remote side and does not itself move
-// the local branch pointer, so this IS the exact commit that got merged
-// (see post-merge-gate-runtime.ts's header for the full squash-fest
-// rationale — no ancestry walk, no `git` subprocess).
-//
-// Trigger arms: the trigger mirrors the four arms the `gh pr merge` gate
-// policies test in `policyMatchesEvent` (src/runtime/intercept.ts), in the
-// same raw-first, lazy order: `GH_PR_MERGE_BASH_RE` against (1) the raw
-// command, then (2) `normalizeCommand`, (3) `normalizeCommandAmpAware`,
-// (4) `normalizeCommandQuoteAware`. Each later arm is computed only when
-// every earlier arm missed, so a raw match never normalizes, and the
-// result is strictly additive (a command that matched raw keeps matching;
-// no arm removes a hit). That closes wrapper spellings (`nice`/`env`/
-// `command`/`time`), the bare-`&` chain (`echo hi & nice gh pr merge 1`)
-// and a boundary character inside a quoted assignment value
-// (`VAR='a; b' gh pr merge 1`), which the raw regex alone missed while the
-// gate blocked them. Normalisation is skipped above MAX_NORMALIZE_LENGTH,
-// like the gate; such a command is tested raw only, which is the one named
-// residual (a wrapper spelling in a command longer than that bound).
-// Like the gate, quoted text that holds a wrapper plus `gh pr merge` behind
-// a boundary (`git commit -m 'x; env gh pr merge 1'`) also matches; the
-// merged fact is still written only on a confirmed merge result.
-// Only the TRIGGER is widened: the PR number is still read from the raw
-// command and the merged fact is still written only when
-// `resolveMergeConfirmation` confirms the merge.
-//
-// Every non-match / failure path is a no-op: wrong tool, non-matching
-// command, neither contract confirms, an unresolvable git context, no
-// session id, a manifest/ledger failure. `PostToolUse` is `blocking:false`
-// by contract (see the pack's Hook entry) so none of these ever break the
-// session; the only observable effect of a miss is that the blocker has
-// no merged-tip fact to compare against for this particular merge.
-import { buildMergedTagContent, GH_PR_MERGE_BASH_RE, PACK_NAME, resolveMergeConfirmation, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
-import { normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, } from "../../runtime/command-normalize.js";
-import { resolveGitContext } from "../../runtime/git-context.js";
-import { resolveManifestLedgerWriter } from "../../runtime/ledger-writer.js";
-import { checkHookPause, loadManifestOrInjected, readStdin } from "./hook-bootstrap.js";
-const LEDGER_SOURCE = "harness-pack-hook-post-merge-gate-record";
-function bashCommandOf(toolInput) {
-    if (typeof toolInput !== "object" || toolInput === null)
-        return "";
-    const cmd = toolInput["command"];
-    return typeof cmd === "string" ? cmd : "";
-}
-/**
- * Does `command` look like a `gh pr merge` invocation to any of the four
- * arms the gate policies use? Raw first, then each normalised form, lazily:
- * a later arm runs only after every earlier arm missed. Exported for the
- * divergence measurement and the ordering test.
- */
-export function recorderTriggerMatches(command) {
-    if (GH_PR_MERGE_BASH_RE.test(command))
-        return true;
-    if (GH_PR_MERGE_BASH_RE.test(normalizeCommand(command).normalized))
-        return true;
-    if (GH_PR_MERGE_BASH_RE.test(normalizeCommandAmpAware(command).normalized))
-        return true;
-    return GH_PR_MERGE_BASH_RE.test(normalizeCommandQuoteAware(command).normalized);
-}
-export async function runPackHookPostMergeGateRecordCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stderr = opts.stderr ?? process.stderr;
-    const note = (msg) => {
-        stderr.write(`harness pack hook post-merge-gate-record: ${msg}\n`);
-    };
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        const diagnostic = "malformed event JSON, skipping";
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    // Pause sentinel — mirrors every other pack hook's operator kill-switch.
-    if (checkHookPause(PACK_NAME, stderr, opts, opts.generatedDir).paused) {
-        const diagnostic = "harness paused; post-merge-gate-record skipping without evaluating.";
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    const toolName = typeof event.tool_name === "string" ? event.tool_name : "";
-    if (toolName !== "Bash") {
-        const diagnostic = `tool ${toolName || "(unknown)"} is not Bash, skipping`;
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    const command = bashCommandOf(event.tool_input);
-    if (!command || !recorderTriggerMatches(command)) {
-        const diagnostic = "command did not match gh pr merge, skipping";
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    // The confirmed-success gate: neither contract confirming — including
-    // any unresolvable / unexpected payload shape on either — writes NO
-    // fact. Fail-safe against a false "merged" record, which would be a
-    // self-lock in the wrong direction (03-decisions.md). See
-    // resolveMergeConfirmation's own doc comment for the dual-contract /
-    // "Contract A wins" ordering decision.
-    const confirmation = resolveMergeConfirmation(event.tool_output, event.tool_response, command);
-    if (!confirmation.confirmed) {
-        const diagnostic = `not a confirmed merge success (${confirmation.reason}); skipping (no fact written)`;
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
-        ? opts.cwd
-        : typeof event.cwd === "string" && event.cwd.length > 0
-            ? event.cwd
-            : process.cwd();
-    const { repo, branch, sha } = resolveGitContext(cwd);
-    if (repo === "" || branch === "" || sha === "") {
-        const diagnostic = `cannot resolve git context for ${cwd} ` +
-            `(repo=${JSON.stringify(repo)} branch=${JSON.stringify(branch)} sha=${JSON.stringify(sha)}); ` +
-            `skipping (no fact written)`;
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    const sessionId = (typeof event.session_id === "string" && event.session_id.length > 0
-        ? event.session_id
-        : undefined) ??
-        process.env.CLAUDE_CODE_SESSION_ID ??
-        process.env.CLAUDE_SESSION_ID ??
-        "";
-    if (sessionId === "") {
-        const diagnostic = "no session_id resolvable from stdin or $CLAUDE_CODE_SESSION_ID/$CLAUDE_SESSION_ID; skipping (no fact written)";
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    // PR number: resolveMergeConfirmation already applied the binding
-    // resolution order (command-first, gh-success-sentence fallback only
-    // for Contract B; Contract A stays command-only, unchanged).
-    const whenIso = (opts.now ?? new Date()).toISOString();
-    const content = buildMergedTagContent({ repo, branch, sha, pr: confirmation.pr, whenIso });
-    let writeLedger = opts.writeLedger;
-    if (!writeLedger) {
-        let manifest;
-        try {
-            ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
-        }
-        catch (err) {
-            const diagnostic = `manifest load failed (${err.message}); skipping (no fact written)`;
-            note(diagnostic);
-            return { exitCode: 0, wrote: false, diagnostic };
-        }
-        const resolved = resolveManifestLedgerWriter(manifest, {
-            ...(opts.ledgerTimeoutMs !== undefined ? { ledgerTimeoutMs: opts.ledgerTimeoutMs } : {}),
-        });
-        if (!resolved.ok) {
-            const diagnostic = `${resolved.reason}; cannot record ${content}`;
-            note(diagnostic);
-            return { exitCode: 0, wrote: false, diagnostic };
-        }
-        writeLedger = resolved.write;
-    }
-    const result = await writeLedger({ sessionId, content, source: LEDGER_SOURCE });
-    if (!result.ok) {
-        const diagnostic = `ledger write failed: ${result.reason ?? "unknown error"}`;
-        note(diagnostic);
-        return { exitCode: 0, wrote: false, diagnostic };
-    }
-    const diagnostic = `recorded ${content} for session ${sessionId}`;
-    note(diagnostic);
-    return { exitCode: 0, wrote: true, diagnostic };
-}
-//# sourceMappingURL=hook-post-merge-gate-record.js.map

package/dist/cli/pack/hook-post-merge-gate-record.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-post-merge-gate-record.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate-record.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,qFAAqF;AACrF,qEAAqE;AACrE,uBAAuB;AACvB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,4DAA4D;AAC5D,0EAA0E;AAC1E,6DAA6D;AAC7D,6DAA6D;AAC7D,0DAA0D;AAC1D,yDAAyD;AACzD,EAAE;AACF,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,4DAA4D;AAC5D,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,wEAAwE;AACxE,iEAAiE;AACjE,wEAAwE;AACxE,yDAAyD;AACzD,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAsB,MAAM,gCAAgC,CAAC;AAGjG,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExF,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAyCjE,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,mBAAmB,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,mBAAmB,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,gCAAgC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,qEAAqE,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,QAAQ,QAAQ,IAAI,WAAW,wBAAwB,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,kCAAkC,YAAY,CAAC,MAAM,+BAA+B,CAAC;QACxG,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GACd,kCAAkC,GAAG,GAAG;YACxC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;YAC9F,4BAA4B,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GACd,+GAA+G,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3F,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,+BAA+B,CAAC;YAClG,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,mBAAmB,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,OAAO,gBAAgB,SAAS,EAAE,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC"}

package/dist/cli/pack/hook-post-merge-gate.d.ts

@@ -1,34 +0,0 @@
-import { type LedgerEntry } from "../../policies/index.js";
-import { type Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookPostMergeGateOptions extends LoaderOptions {
-    /** Defaults to process.stdin. */
-    stdin?: NodeJS.ReadableStream;
-    /** Defaults to process.stdout. */
-    stdout?: NodeJS.WritableStream;
-    /** Defaults to process.stderr. */
-    stderr?: NodeJS.WritableStream;
-    /** Override cwd resolution (test injection). Falls back to event.cwd then process.cwd(). */
-    cwd?: string;
-    /** Per-call ledger timeout in ms. */
-    ledgerTimeoutMs?: number;
-    /** Inject a manifest (test). */
-    manifest?: Manifest;
-    /** Inject a fake ledger query (test). */
-    ledgerQuery?: (sessionId: string) => Promise<LedgerEntry[] | {
-        degraded: string;
-    }>;
-}
-export interface PackHookPostMergeGateResult {
-    exitCode: number;
-    blocked: boolean;
-    /** Diagnostic line emitted to stderr (always, even on allow). */
-    diagnostic: string;
-}
-/**
- * `harness pack hook post-merge-gate`. A stdin read that times out is refused here
- * instead of being handed to the gate as an empty or truncated event it would
- * treat as malformed input (task 7dfdcaaf). The operator pause still wins;
- * every other input runs the gate unchanged.
- */
-export declare function runPackHookPostMergeGateCli(opts?: PackHookPostMergeGateOptions): Promise<PackHookPostMergeGateResult>;

package/dist/cli/pack/hook-post-merge-gate.js

@@ -1,277 +0,0 @@
-// `harness pack hook post-merge-gate` — PreToolUse blocker for the
-// `post-merge-gate` policy pack.
-//
-// Receives Claude Code's PreToolUse event JSON on stdin and emits a
-// `{ decision: "block" }` envelope when a CURATED history-mutating Bash
-// command is about to run on a branch whose current tip exactly matches
-// a merged-tip fact the producer recorded (see hook-post-merge-gate-record.ts).
-//
-// Evaluation order — deliberate, and pinned by the self-lock test suite
-// (task 19356be7 REVERSED the original escape-first ordering; the escape
-// allowlist no longer short-circuits the whole command):
-//
-//   1. Parse stdin. Malformed JSON, a non-Bash tool, or an empty command
-//      all ALLOW immediately (nothing to classify).
-//   2. Pause sentinel (operator kill-switch) — same convention as every
-//      other pack hook.
-//   3. GATE-ELIGIBILITY CLASSIFICATION (`isGateEligibleCommand`) — checked
-//      BEFORE manifest load, pack lookup, or any ledger query: the curated
-//      mutation matcher (git commit/add/push/merge/rebase/cherry-pick/
-//      revert/reset/stash pop|apply, gh pr create/merge), applied after
-//      harness-attached quoted-heredoc bodies are stripped. Commands it
-//      does not match ALLOW immediately, with NO dependency on whether the
-//      manifest or the ledger are reachable — that unconditionally covers
-//      the whole recovery path the deny message recommends (`git switch`/
-//      `checkout`/`pull`/`fetch`, `git branch -d`/`-D`, `git stash list`/
-//      `show`, bare `harness ...` commands including report heredocs),
-//      because none of those are curated mutations (verb disjointness,
-//      pinned). The recovery path must never be starved by an unrelated
-//      failure (the incident class this guards against: a different gate
-//      once got blocked alongside its own recovery command, and only the
-//      operator could unstick it).
-//      DENY WINS when a command mixes both: `harness preflight && git
-//      push origin master` — the documented normal workflow spelling —
-//      used to skip the gate entirely under escape-first (task 19356be7,
-//      measured); it is now classified by its mutation half.
-//   4. Manifest load, pack-enabled check, git-context resolution
-//      (detached HEAD / no-repo ALLOWS — nothing to compare), then the
-//      ledger query.
-//   5. DENY only when the current branch tip exactly matches a recorded
-//      `post-merge-gate:merged:<repo>:<branch>:<sha>` fact.
-//
-// Fail posture: OPEN. A manifest-load failure or a degraded ledger both
-// ALLOW (with a stderr warning) — the inverse of branch-protection's
-// fail-closed contract. Without the ledger, "merged" and "not merged" are
-// indistinguishable, and fail-closed here would block ordinary git
-// history work on every branch whenever grounding-mcp hiccups. See
-// post-merge-gate-runtime.ts's header for the full rationale.
-//
-// The one exception is a stdin read that times out (the idle bound in
-// src/cli/bounded-stdin.ts fired before stdin closed): the event never
-// finished arriving, so the command cannot even be classified, and the gate
-// BLOCKS instead of allowing (the operator pause still yields). That refusal
-// sits in the exported wrapper at the end of this file.
-import { isEscapeCommand, isGateEligibleCommand, MERGED_TAG_PREFIX, mergedTagMatchKey, PACK_NAME, resolveDefaultBranchName, } from "../../policy-packs/builtin/post-merge-gate-runtime.js";
-import { queryLedgerByTag } from "../../policies/index.js";
-import { resolveGitContext } from "../../runtime/git-context.js";
-import { renderAgentFacing } from "../../runtime/agent-facing.js";
-import { POLICY_DECISION_TYPE } from "../../io/ledger-record.js";
-import { checkHookPause, loadManifestOrInjected, parseConfigUx, readStdin, runGateWithStdinRefusal, stdoutBlockRefusal, } from "./hook-bootstrap.js";
-const DEFAULT_BRANCH_PLACEHOLDER = "<default-branch>";
-function bashCommandOf(toolInput) {
-    if (typeof toolInput !== "object" || toolInput === null)
-        return "";
-    const cmd = toolInput["command"];
-    return typeof cmd === "string" ? cmd : "";
-}
-function findGroundingMcp(manifest) {
-    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
-}
-function evaluateEntries(entries, matchKey) {
-    for (const e of entries) {
-        // Skip policy_decision audit rows — a past DENIED decision this very
-        // pack recorded would otherwise incidentally carry the match key in
-        // its serialized payload, falsely satisfying itself. Same two-tier
-        // filter branch-protection's blocker uses (type first, legacy
-        // content-prefix backstop second).
-        if (e.type === POLICY_DECISION_TYPE)
-            continue;
-        if (e.content.startsWith(`${POLICY_DECISION_TYPE}:`))
-            continue;
-        if (e.content.includes(matchKey)) {
-            return { merged: true, matchedContent: e.content, degraded: null };
-        }
-    }
-    return { merged: false, matchedContent: null, degraded: null };
-}
-async function probeLedger(manifest, sessionId, matchKey, opts) {
-    if (opts.ledgerQuery) {
-        const r = await opts.ledgerQuery(sessionId);
-        if ("degraded" in r) {
-            return { merged: false, matchedContent: null, degraded: r.degraded };
-        }
-        return evaluateEntries(r, matchKey);
-    }
-    if (!manifest) {
-        return { merged: false, matchedContent: null, degraded: "manifest unavailable" };
-    }
-    const server = findGroundingMcp(manifest);
-    if (!server) {
-        return { merged: false, matchedContent: null, degraded: "grounding-mcp not declared in manifest" };
-    }
-    const command = Array.isArray(server.command)
-        ? server.command
-        : server.command.trim().split(/\s+/);
-    const env = server.env ?? undefined;
-    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
-    const result = await queryLedgerByTag({
-        mcpCommand: command,
-        ...(env && { mcpEnv: env }),
-        sessionId,
-        timeoutMs,
-    });
-    if (result.kind === "degraded") {
-        return { merged: false, matchedContent: null, degraded: result.reason };
-    }
-    return evaluateEntries(result.entries, matchKey);
-}
-function blockJson(toolName, command, branch, defaultBranch, matchedContent, ux, sessionId) {
-    let reasonText;
-    if (ux) {
-        reasonText = renderAgentFacing(ux, {
-            BRANCH: branch,
-            DEFAULT_BRANCH: defaultBranch,
-            TOOL_NAME: toolName,
-            SESSION_ID: sessionId,
-        });
-    }
-    else {
-        reasonText =
-            `post-merge-gate: refusing ${toolName} ("${command}") on branch "${branch}" — ` +
-                `its current tip was already merged (recorded: ${matchedContent}).\n` +
-                `Further history-mutating commands on an already-merged branch usually mean stale local state.\n` +
-                `\n` +
-                `To proceed:\n` +
-                `  git switch ${defaultBranch}\n` +
-                `  git pull --ff-only\n` +
-                `  git branch -d ${branch}   # optional cleanup\n` +
-                `\n` +
-                `If you have NEW work to continue on this branch (not leftover local state): make a commit first —` +
-                ` this gate only fires while the branch tip still exactly matches the merged commit, so a new commit` +
-                ` moves the tip and this check no longer applies.\n` +
-                `\n` +
-                `Escape hatches (always allowed, independent of this gate): git switch/checkout, git pull/fetch,` +
-                ` git branch -d/-D, git stash list/show, and any \`harness ...\` command — each as its OWN command.` +
-                ` Chaining one of them with a history-mutating command does not exempt the mutation: run the` +
-                ` recovery steps separately.`;
-    }
-    return JSON.stringify({
-        decision: "block",
-        reason: reasonText,
-        hookSpecificOutput: {
-            hookEventName: "PreToolUse",
-            permissionDecision: "deny",
-            permissionDecisionReason: reasonText,
-        },
-    });
-}
-async function runPackHookPostMergeGateCliInner(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stdout = opts.stdout ?? process.stdout;
-    const stderr = opts.stderr ?? process.stderr;
-    const note = (msg) => {
-        stderr.write(`harness pack hook post-merge-gate: ${msg}\n`);
-    };
-    const raw = await readStdin(stdin);
-    let event = {};
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch {
-        const diagnostic = "malformed event JSON, cannot classify; allowing";
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    // Pause sentinel — even this gate yields to an operator pause.
-    if (checkHookPause(PACK_NAME, stderr, opts).paused) {
-        const diagnostic = "harness paused; post-merge-gate allowing without evaluating.";
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const sessionId = (typeof event.session_id === "string" ? event.session_id : undefined) ??
-        process.env.CLAUDE_CODE_SESSION_ID ??
-        process.env.CLAUDE_SESSION_ID ??
-        "";
-    const toolName = typeof event.tool_name === "string" ? event.tool_name : "(unknown)";
-    const cwd = typeof opts.cwd === "string" && opts.cwd.length > 0
-        ? opts.cwd
-        : typeof event.cwd === "string" && event.cwd.length > 0
-            ? event.cwd
-            : process.cwd();
-    if (toolName !== "Bash") {
-        const diagnostic = `${toolName} is not Bash; allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const command = bashCommandOf(event.tool_input);
-    if (command === "") {
-        const diagnostic = "no resolvable command text; allowing";
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    // GATE-ELIGIBILITY CLASSIFICATION — checked FIRST, before manifest
-    // load, pack lookup, or any ledger query, so every non-eligible command
-    // (the whole recovery path included) can never be starved by an
-    // unreachable manifest/ledger. Deny wins over the escape vocabulary
-    // when a command mixes both (task 19356be7). See module header.
-    if (!isGateEligibleCommand(command)) {
-        const diagnostic = isEscapeCommand(command)
-            ? `command is not in the curated v1 deny-scope (recovery/escape vocabulary matched); allowing regardless of ledger/manifest state`
-            : `command is not in the curated v1 deny-scope; allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    if (isEscapeCommand(command)) {
-        // Observability only — the decision is already made: a command that
-        // chains recovery vocabulary WITH a curated mutation is judged by its
-        // mutation half (the escape-first ordering this replaced let exactly
-        // these chains skip the gate).
-        note("recovery/escape vocabulary present but a curated mutation is chained; deny-scope wins (task 19356be7)");
-    }
-    // Fail-open manifest load (opposite of branch-protection's fail-closed):
-    // without the manifest we cannot tell if the pack is even enabled, and
-    // this pack's whole posture is advisory, not a hard security boundary.
-    let manifest;
-    try {
-        ({ manifest } = loadManifestOrInjected(opts, opts.manifest));
-    }
-    catch (err) {
-        const diagnostic = `manifest load failed (${err.message}); post-merge-gate fails open, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const pack = manifest.policy_packs.find((p) => p.name === PACK_NAME);
-    if (!pack) {
-        const diagnostic = `pack "${PACK_NAME}" not declared in manifest, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    if (!pack.enabled) {
-        const diagnostic = `pack "${PACK_NAME}" is enabled:false, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const { repo, branch, sha } = resolveGitContext(cwd);
-    if (branch === "" || sha === "" || repo === "") {
-        const diagnostic = `cannot resolve git context for ${cwd} (detached HEAD, outside a git work tree, or unresolvable sha); allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const configUx = parseConfigUx(pack.config["ux"], stderr, "harness pack hook post-merge-gate");
-    const matchKey = mergedTagMatchKey(repo, branch, sha);
-    const check = await probeLedger(manifest, sessionId, matchKey, opts);
-    if (check.degraded !== null) {
-        const diagnostic = `ledger degraded (${check.degraded}); post-merge-gate fails open, allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    if (!check.merged) {
-        const diagnostic = `no recorded ${MERGED_TAG_PREFIX} fact for ${repo}:${branch} at tip ${sha.slice(0, 7)}; allowing`;
-        note(diagnostic);
-        return { exitCode: 0, blocked: false, diagnostic };
-    }
-    const defaultBranch = resolveDefaultBranchName(cwd) ?? DEFAULT_BRANCH_PLACEHOLDER;
-    const diagnostic = `BLOCK — branch tip ${sha.slice(0, 7)} matches a recorded merged tip (${check.matchedContent ?? matchKey})`;
-    note(diagnostic);
-    stdout.write(`${blockJson(toolName, command, branch, defaultBranch, check.matchedContent ?? matchKey, configUx, sessionId)}\n`);
-    return { exitCode: 0, blocked: true, diagnostic };
-}
-/**
- * `harness pack hook post-merge-gate`. A stdin read that times out is refused here
- * instead of being handed to the gate as an empty or truncated event it would
- * treat as malformed input (task 7dfdcaaf). The operator pause still wins;
- * every other input runs the gate unchanged.
- */
-export function runPackHookPostMergeGateCli(opts = {}) {
-    return runGateWithStdinRefusal(opts, (stderr) => checkHookPause(PACK_NAME, stderr, opts).paused, stdoutBlockRefusal("post-merge-gate"), runPackHookPostMergeGateCliInner);
-}
-//# sourceMappingURL=hook-post-merge-gate.js.map

package/dist/cli/pack/hook-post-merge-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hook-post-merge-gate.js","sourceRoot":"","sources":["../../../src/cli/pack/hook-post-merge-gate.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,iCAAiC;AACjC,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,yDAAyD;AACzD,EAAE;AACF,yEAAyE;AACzE,oDAAoD;AACpD,wEAAwE;AACxE,wBAAwB;AACxB,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,mCAAmC;AACnC,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,6DAA6D;AAC7D,iEAAiE;AACjE,uEAAuE;AACvE,qBAAqB;AACrB,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,mEAAmE;AACnE,mEAAmE;AACnE,8DAA8D;AAC9D,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,wDAAwD;AAExD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,wBAAwB,GACzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAiCtD,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAI,SAAqC,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAQD,SAAS,eAAe,CAAC,OAAsB,EAAE,QAAgB;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,mCAAmC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyB,EACzB,SAAiB,EACjB,QAAgB,EAChB,IAAkC;IAElC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,wCAAwC,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,EAAwB,EACxB,SAAiB;IAEjB,IAAI,UAAkB,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,UAAU,GAAG,iBAAiB,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,UAAU;YACR,6BAA6B,QAAQ,MAAM,OAAO,iBAAiB,MAAM,MAAM;gBAC/E,iDAAiD,cAAc,MAAM;gBACrE,iGAAiG;gBACjG,IAAI;gBACJ,eAAe;gBACf,gBAAgB,aAAa,IAAI;gBACjC,wBAAwB;gBACxB,mBAAmB,MAAM,yBAAyB;gBAClD,IAAI;gBACJ,mGAAmG;gBACnG,qGAAqG;gBACrG,oDAAoD;gBACpD,IAAI;gBACJ,iGAAiG;gBACjG,oGAAoG;gBACpG,6FAA6F;gBAC7F,6BAA6B,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAkB,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,iDAAiD,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,IAAI,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,8DAA8D,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GACb,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACrF,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,QAAQ,wBAAwB,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,sCAAsC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,gIAAgI;YAClI,CAAC,CAAC,uDAAuD,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,CAAC,uGAAuG,CAAC,CAAC;IAChH,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,yBAA0B,GAAa,CAAC,OAAO,yCAAyC,CAAC;QAC5G,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,SAAS,SAAS,sCAAsC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,SAAS,SAAS,8BAA8B,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,kCAAkC,GAAG,0EAA0E,CAAC;QACnI,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAC3B,IAAI,CAAC,MAAkC,CAAC,IAAI,CAAC,EAC9C,MAAM,EACN,mCAAmC,CACpC,CAAC;IAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,oBAAoB,KAAK,CAAC,QAAQ,yCAAyC,CAAC;QAC/F,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,eAAe,iBAAiB,aAAa,IAAI,IAAI,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;QACrH,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;IAClF,MAAM,UAAU,GAAG,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCAAmC,KAAK,CAAC,cAAc,IAAI,QAAQ,GAAG,CAAC;IAC/H,IAAI,CAAC,UAAU,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,CACV,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAClH,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAqC,EAAE;IAEvC,OAAO,uBAAuB,CAC5B,IAAI,EACJ,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAC1D,kBAAkB,CAAC,iBAAiB,CAAC,EACrC,gCAAgC,CACjC,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-post-tool-use.d.ts

@@ -1,45 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookPostToolUseOptions extends LoaderOptions {
-    pack?: string;
-    generatedDir?: string;
-    /**
-     * Override the persisted-report directory. Defaults to
-     * `defaultReportsDir()` which honours `UNDERSTANDING_GATE_REPORT_DIR`
-     * (set by the pack's hook-command wrapper) or falls back to
-     * `<cwd>/.understanding-gate/reports`.
-     */
-    reportsDir?: string;
-    stdin?: NodeJS.ReadableStream;
-    stderr?: NodeJS.WritableStream;
-    manifest?: Manifest;
-    /** Override "now" for deterministic tests. */
-    now?: Date;
-}
-export interface PackHookPostToolUseResult {
-    exitCode: number;
-    /** Did the just-completed tool match the expiry list? */
-    matchedExpiry: boolean;
-    /** Was the session marker actually cleared (false if it was already absent). */
-    markerCleared: boolean;
-    /**
-     * Was a task-scoped marker also cleared (harness/1ee26e77)? Only set
-     * when the matched tool was an agent-tasks task-transition verb AND
-     * `tool_input.taskId` was present in the event, AND a marker existed
-     * for that task id. False otherwise. Independent of markerCleared.
-     */
-    taskMarkerCleared: boolean;
-    /**
-     * Was the persisted report (`.understanding-gate/reports/...json`)
-     * flipped from `approved` to `expired`? Originally closed a silent
-     * re-approval bypass that pre-this-fix existed since PR #172: the
-     * marker was deleted on task_finish but the persisted-report fallback
-     * still satisfied the gate. Since task 7402301d the report can no
-     * longer satisfy the gate on its own, so this now exists so the audit
-     * record agrees with the cleared marker.
-     */
-    persistedReportExpired: boolean;
-    /** Diagnostic line emitted to stderr. */
-    diagnostic: string;
-}
-export declare function runPackHookPostToolUseCli(opts?: PackHookPostToolUseOptions): Promise<PackHookPostToolUseResult>;