@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/policy/intercept.js

@@ -1,1022 +0,0 @@
-// Phase 4 #5 — `harness policy intercept` CLI entrypoint.
-//
-// Wired by Claude Code's settings.json (regenerated by `harness apply`) as
-// the PreToolUse hook. Reads the event JSON from stdin, runs the runtime
-// interceptor, writes Claude Code's deny JSON to stdout on block.
-import { openLedgerSession, } from "../../policies/index.js";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import { readStdinBounded, STDIN_IDLE_TIMEOUT_MS, stdinTimeoutNote, stdinTimeoutBlockJson, stdinTimeoutBlockReason } from "../bounded-stdin.js";
-import { buildActionEnvelope, intercept, isBlockingDecision, recordPolicyDecisionOnSession, resolveEnvironment, resolveGitContext, resolveKubeContext, sanitizeEnvelopeReason, } from "../../runtime/index.js";
-import { resolveGeneratedDir, writePendingApproval } from "../../runtime/pending-approval.js";
-import { ENV_RANK, resolveBashPrefixEnrichment } from "./risk-envelope-enrichment.js";
-import { parseKubectlTarget } from "../../runtime/kubectl-target-parse.js";
-import { MAX_NORMALIZE_LENGTH, normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, segmentViewOf, } from "../../runtime/command-normalize.js";
-import { extractShellCommand, SHELL_ALIASES } from "../../runtime/tool-name-aliases.js";
-import { loadManifest } from "../loader.js";
-import { checkPauseFromLoader } from "../pause-check.js";
-function findGroundingMcp(manifest) {
-    return manifest.tools.mcp.find((m) => m.name === "grounding-mcp") ?? null;
-}
-/** Resolve an `os` fact, returning "" on the (rare) lookup failure. */
-function safeOs(fn) {
-    try {
-        return fn();
-    }
-    catch {
-        return "";
-    }
-}
-/**
- * Render the hook-identity suffix for a stderr diagnostic. Returns the
- * empty string when no `--hook` flag was supplied, so an operator
- * invoking `harness policy intercept` by hand (and tests that don't
- * inject hookName) see the original prefix verbatim.
- */
-function hookSuffix(hookName) {
-    return hookName !== undefined && hookName.length > 0 ? ` [hook=${hookName}]` : "";
-}
-/**
- * Phase 5 #3 — render a deny / warn-degraded decision as a stderr
- * diagnostic block. Multiline, indented; each block is bounded by the
- * policy name so concurrent fires (rare but possible) stay readable.
- */
-function formatDecisionDiagnostic(decision, hookName) {
-    // The deny-degraded suffix names the fail_open opt-out ON PURPOSE and
-    // ONLY here: stderr is the operator's surface. The agent-facing deny
-    // envelope deliberately omits it (see the deny-degraded branch in
-    // `runtime/intercept.ts` — a deny that includes its own disable recipe
-    // is not a gate).
-    // Both degraded arms are cause-neutral: the degraded family has five
-    // causes and only one of them is the ledger; the true cause follows
-    // on the block's own `reason:` line (review 2026-08-08, rounds 3+5).
-    const header = `harness policy intercept${hookSuffix(hookName)}: ${decision.policyName}: ${decision.outcome}${decision.outcome === "warn-degraded"
-        ? " (evidence could not be evaluated; non-blocking per warn tier or fail_open opt-out)"
-        : decision.outcome === "deny-degraded"
-            ? " (evidence could not be evaluated; failing closed per enforcement tier; operator opt-out: risk.degraded_fail_posture: fail_open)"
-            : ""}`;
-    const lines = [header];
-    lines.push(`  ledger_tag: ${decision.ledgerTag}`);
-    if (decision.requiresEval !== undefined) {
-        lines.push(`  matched: ${decision.requiresEval.matchedCount}`);
-    }
-    lines.push(`  reason: ${decision.reason}`);
-    const extractKeys = Object.keys(decision.extractValues);
-    if (extractKeys.length > 0) {
-        lines.push("  extract:");
-        for (const k of extractKeys.sort()) {
-            lines.push(`    ${k}=${decision.extractValues[k]}`);
-        }
-    }
-    return `${lines.join("\n")}\n`;
-}
-function isVerboseEnabled(opts) {
-    if (opts.verbose === true)
-        return true;
-    if (opts.verbose === false)
-        return false;
-    const env = process.env.HARNESS_POLICY_VERBOSE;
-    if (typeof env !== "string")
-        return false;
-    if (env.length === 0)
-        return false;
-    // Accept anything truthy except literal disable-words (case-insensitive).
-    return !/^(0|false|no|off)$/i.test(env.trim());
-}
-// Derived from `SHELL_ALIASES` rather than hand-copying its members (fix
-// round 2): `tool-name-aliases.ts`'s own header warns against the copy,
-// and since fix round 1 the precompute-matches-matcher argument above
-// depends on this set and the alias expansion agreeing. Deriving it means
-// they cannot drift apart.
-function isCodexShellTool(toolName) {
-    return typeof toolName === "string" && SHELL_ALIASES.includes(toolName);
-}
-function extractPerCallCwd(input) {
-    if (!input || typeof input !== "object" || Array.isArray(input))
-        return null;
-    const args = input;
-    for (const candidate of [args.workdir, args.cwd]) {
-        if (typeof candidate === "string" && candidate.length > 0)
-            return candidate;
-    }
-    return null;
-}
-function readCodexCommandCwdFromProc() {
-    let argv;
-    try {
-        argv = fs.readFileSync("/proc/1/cmdline", "utf8").split("\0");
-    }
-    catch {
-        return null;
-    }
-    const idx = argv.indexOf("--command-cwd");
-    const cwd = idx >= 0 ? argv[idx + 1] : undefined;
-    return typeof cwd === "string" && cwd.length > 0 ? cwd : null;
-}
-function resolvePolicyCwd(event, codexCommandCwd) {
-    if (typeof event.cwd === "string" && event.cwd.length > 0)
-        return event.cwd;
-    if (isCodexShellTool(event.tool_name)) {
-        for (const input of [event.raw_input, event.tool_input, event.input]) {
-            const cwd = extractPerCallCwd(input);
-            if (cwd)
-                return cwd;
-        }
-        if (codexCommandCwd !== undefined && codexCommandCwd.length > 0) {
-            return codexCommandCwd;
-        }
-        const procCwd = readCodexCommandCwdFromProc();
-        if (procCwd)
-            return procCwd;
-    }
-    return process.cwd();
-}
-/**
- * Explicit kubectl target, upgrade-only merge (task a7eb1a71): an
- * explicit --context/--namespace/-n on a kubectl command can only push
- * the resolved environment to something MORE dangerous than the
- * ambient kubeconfig alone already gave, never less, mirroring
- * applyBranchSwitchUpgrade exactly (both the ambient-only base and the
- * merged-candidate kube inputs run through the SAME resolveEnvironment
- * call with identical git/env inputs, so ENV_RANK picks the more
- * dangerous of the two). See the `CHANGELOG.md:#0.49.0` entry (task
- * a7eb1a71) for the measured downgrade this fixes.
- */
-function applyKubeTargetUpgrade(event, manifest, cwd, git, ambientKube, kubectlTarget, env, user, host, now) {
-    if (kubectlTarget === null)
-        return ambientKube;
-    const candidateKube = {
-        context: kubectlTarget.context ?? ambientKube.context,
-        namespace: kubectlTarget.namespace ?? ambientKube.namespace,
-    };
-    if (candidateKube.context === ambientKube.context &&
-        candidateKube.namespace === ambientKube.namespace) {
-        return ambientKube;
-    }
-    const effectiveNow = now ?? new Date();
-    const baseResolution = resolveEnvironment(buildActionEnvelope(event, { cwd, git, user, host, now: effectiveNow }), manifest.environments.resolvers, { env, kubeContext: ambientKube.context, kubeNamespace: ambientKube.namespace });
-    const candidateResolution = resolveEnvironment(buildActionEnvelope(event, { cwd, git, user, host, now: effectiveNow }), manifest.environments.resolvers, { env, kubeContext: candidateKube.context, kubeNamespace: candidateKube.namespace });
-    return ENV_RANK[candidateResolution.name] < ENV_RANK[baseResolution.name]
-        ? candidateKube
-        : ambientKube;
-}
-/**
- * Real grounding-mcp-backed ledger client. Exported for testing: the
- * `record` adapter's failure-surfacing path is exercised against a
- * bogus mcpCommand in tests/runtime/intercept-cli.test.ts.
- *
- * Connection discipline (2026-07-01 review, enforcement-subprocess-latency):
- * ONE lazily-opened grounding-mcp session serves every query and audit
- * record of the intercept invocation this client was constructed for,
- * instead of 2 fresh subprocess spawns per matching policy. On top,
- * `ledger_summary` returns the WHOLE session's entries (per-tag filtering
- * happens client-side in `intercept()`), so the K per-policy queries are
- * textually identical — they collapse into one cached round-trip per
- * sessionId. `runInterceptCli` calls `dispose()` when the intercept
- * completes; a caller constructing this client directly owns that call.
- */
-export function realLedgerClient(server, opts) {
-    const command = Array.isArray(server.command)
-        ? server.command
-        : server.command.trim().split(/\s+/);
-    const env = server.env ?? undefined;
-    const timeoutMs = opts.ledgerTimeoutMs ?? server.health?.timeout_ms ?? 5_000;
-    const stderr = opts.stderr ?? process.stderr;
-    let session = null;
-    const summaryCache = new Map();
-    // One fresh-session retry for audit writes per client instance,
-    // reserved for `deny-degraded` decisions (task f1aea826, AC4; review
-    // 2026-08-08 tightened both the reservation and the budget). The
-    // pooled session carries a session-wide timeout latch: a single slow
-    // QUERY (the very condition that produces a blocking `deny-degraded`)
-    // short-circuits every later call on the same session, including the
-    // audit write for that decision — so the one row that most needs to
-    // land was guaranteed to be lost. A fresh subprocess lands it whenever
-    // grounding-mcp itself is healthy (the measured 2026-08-06 case: only
-    // the artificial 1ms query budget latched; follow-up calls answered
-    // fine).
-    //
-    // Bounds, stated precisely because the record runs on the deny path
-    // BEFORE the envelope is emitted and any stall risks the outer
-    // hook-timeout-is-allow contract: the retry is (a) reserved for
-    // decisions whose outcome is `deny-degraded` — an allow/warn row
-    // failing first must not consume it — (b) taken at most once per
-    // client instance, and (c) run on a session whose OWN timeout is
-    // `auditRetryTimeoutMs(timeoutMs)` = max(250ms, timeoutMs/4). Its two
-    // calls (initialize + ledger_add) therefore add at most
-    // 2 * max(250ms, timeoutMs/4) on top of the query's timeoutMs — that
-    // is <=timeoutMs/2 (total <=1.5x) once timeoutMs >= 1s, while below
-    // 1s the 250ms floor dominates and the ADD is bounded at 500ms
-    // absolute (review 2026-08-08 round 2: at the audit's 1-100ms probe
-    // settings that is a multiple of the query budget, but a trivial
-    // absolute cost). The fresh session replaces the latched one, so
-    // later audit writes in the same invocation inherit the working
-    // transport (and its tighter budget). If the retry also fails, the
-    // loud-stderr contract stands (audit degradation never blocks,
-    // docs/okf matrix).
-    const retryTimeoutMs = auditRetryTimeoutMs(timeoutMs);
-    let recordRetryUsed = false;
-    const getSession = () => (session ??= openLedgerSession({
-        mcpCommand: command,
-        ...(env && { mcpEnv: env }),
-        timeoutMs,
-    }));
-    return {
-        async query(_tag, sessionId) {
-            // Cache the Promise (not the value) so concurrent queries for the
-            // same session dedupe onto one in-flight round-trip. A degraded
-            // result is cached too — deliberately: a first-query timeout
-            // degrades ALL K policies off the one cached round-trip instead of
-            // retrying per policy, which would reintroduce the fan-out. (What
-            // a degraded evaluation MEANS is tier-dependent since task
-            // f1aea826: warn policies stay non-blocking `warn-degraded`,
-            // block/require_approval fail closed as `deny-degraded`.)
-            // Staleness: our own
-            // `record` rows are filtered out by the evaluator by design; an
-            // EXTERNAL writer landing evidence mid-loop would make a later
-            // policy deny where a fresh query would allow — a fail-closed,
-            // ms-wide window resolved by the agent's retry (next intercept =
-            // fresh session + fresh snapshot).
-            let cached = summaryCache.get(sessionId);
-            if (cached === undefined) {
-                cached = getSession().querySummary({ sessionId });
-                summaryCache.set(sessionId, cached);
-            }
-            return cached;
-        },
-        async record(decision, sessionId) {
-            let result = await recordPolicyDecisionOnSession(getSession(), decision, sessionId);
-            if (!result.ok &&
-                decision.outcome === "deny-degraded" &&
-                !recordRetryUsed) {
-                // Latched-session recovery (bounds documented at retryTimeoutMs
-                // above): drop the pooled session and retry ONCE over a fresh
-                // subprocess with the tighter retry budget. Queries are
-                // unaffected — their per-session summary promise is already
-                // cached by the time any record runs.
-                recordRetryUsed = true;
-                session?.dispose();
-                session = openLedgerSession({
-                    mcpCommand: command,
-                    ...(env && { mcpEnv: env }),
-                    timeoutMs: retryTimeoutMs,
-                });
-                result = await recordPolicyDecisionOnSession(session, decision, sessionId);
-            }
-            // A failed audit-write must not block the tool — the decision is
-            // still applied — but it must not be silent either: an unrecorded
-            // decision is invisible to `harness audit` / `explain --trace`.
-            // Goes to stderr so Claude Code's stdout deny-JSON contract holds.
-            if (!result.ok) {
-                stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: audit-write failed for ` +
-                    `${decision.policyName}: ${result.reason ?? "unknown error"}\n`);
-            }
-        },
-        dispose() {
-            session?.dispose();
-        },
-    };
-}
-/**
- * Per-call budget of the audit-retry session (task f1aea826, review
- * round 2): a quarter of the ledger timeout with a 250ms floor (a fresh
- * node subprocess must cold-start + initialize within it). Exported as a
- * pure function so the FORMULA itself is pinned by a unit test — the
- * round-1 finding this bounds was precisely that an unbounded retry
- * reused the full budget, and nothing would go red if that regressed.
- */
-export function auditRetryTimeoutMs(timeoutMs) {
-    return Math.max(250, Math.floor(timeoutMs / 4));
-}
-/**
- * Recognise a hook `command` string as an invocation of `harness policy
- * intercept`'s subcommand, regardless of how the leading interpreter /
- * binary token is spelled: a bare `harness policy intercept`, a node-path
- * form (`node /abs/path/dist/cli/index.js policy intercept`, e.g. a local
- * dev build), an `npx` form (`npx harness policy intercept`), a leading
- * inline env-var assignment (`FOO=bar harness policy intercept` — the
- * same shape `understanding-before-execution.ts`'s `wrap()` helper
- * prefixes pack-contributed commands with), or a trailing flag
- * (`harness policy intercept --hook <name>`, the tag
- * `generate-codex-config.ts#commandWithHookTag` appends).
- *
- * Every OTHER call site that needs to recognise this subcommand in this
- * codebase today (`generate-settings.ts#hookTimeoutSeconds`,
- * `generate-codex-config.ts#commandWithHookTag`) still compares
- * `command.trim() === "harness policy intercept"` VERBATIM — deliberately
- * left unchanged (task d20a7e0c scope: the hook-timeout projection
- * contract those two own is out of scope). For THEM a missed match only
- * changes a floor/flag on a command harness itself emits byte-for-byte,
- * so the single canonical spelling is enough. This matcher exists for a
- * caller (the validate/doctor hook-budget-vs-ledger-timeout guard, task
- * d20a7e0c) where under-recognition is a false NEGATIVE on a security
- * check against an OPERATOR-authored `manifest.hooks[]` entry, which is
- * under no obligation to spell the command exactly the way harness's own
- * generators do.
- *
- * Deliberately narrow, not a shell parser: matches the two literal words
- * `policy` and `intercept` as adjacent, whitespace-separated tokens,
- * preceded by start-of-string / whitespace / a path separator (so
- * `mypolicy intercept` inside one longer token cannot match) and followed
- * by whitespace, end-of-string, or a semicolon/quote character (`;`, `"`,
- * `'`) immediately abutting the word — the shape a chained shell command
- * (`harness policy intercept; echo done`) or an embedded `sh -c
- * "harness policy intercept"` wrapper produces, where nothing whitespace
- * separates `intercept` from the next token (review 2026-08-09, fix round
- * 1, finding 3). The quote arm accepts more than it strictly should: a
- * quote glued directly onto the word (`intercept'or'`) also matches, even
- * though a shell concatenates that into a different, longer identifier
- * (`interceptor`). This is a deliberate, harmless OVER-flag — at worst a
- * spurious validate/doctor diagnostic on an exotic command, never a missed
- * real hook — accepted because the same quote boundary is load-bearing for
- * the legitimate `sh -c "...intercept"` wrapper above. Still not
- * exhaustive: a trailing `)`, `|`, `&`, or
- * backtick immediately abutting the word (e.g. `$(harness policy
- * intercept)`) is a KNOWN, deliberately-unclosed gap — widening further
- * risks matching inside an unrelated longer token with no whitespace
- * boundary at all, and the shapes above already cover the realistic
- * manifest-authoring patterns this matcher exists for. A false negative
- * here degrades to the pre-existing verbatim behaviour (the hook is
- * simply not classified as ledger-consulting, so the margin check has
- * nothing to say about it) — not a runtime bypass; the dispatch this
- * check advises about is unaffected either way.
- */
-export function isPolicyInterceptCommand(command) {
-    return /(?:^|[\s/\\])policy\s+intercept(?:\s|$|[;"'])/.test(command);
-}
-/**
- * Minimum `budget_ms` a blocking, ledger-consulting hook needs to clear
- * the worst-case wall time `realLedgerClient` (below) can spend before it
- * writes its own fail-closed decision — derived from that function's OWN
- * two round-trip shapes, not a measured-then-eyeballed constant. Both
- * halves are pinned against the real client in
- * tests/e2e/policy-intercept.test.ts ("hook-budget-ledger-margin
- * derivation (task d20a7e0c)").
- *
- * SCOPE, stated precisely (review 2026-08-09, fix round 1): this is the
- * worst case on the PURE-TIMEOUT HANG SHAPE — the shape where the
- * `query()` call that degrades does so by tripping `LedgerSession`'s own
- * session-wide `timedOut` latch (src/policies/ledger-client.ts), which is
- * what lets the retry sequence below start from an INSTANT first
- * `record()` attempt. A query() that instead degrades via a NON-timeout
- * path — `ledger_summary` coming back a genuine JSON-RPC error, an
- * unparseable payload, or a payload missing the `entries` shape
- * (`querySummary`'s non-timeout `degraded` branches in
- * src/policies/ledger-client.ts) — never sets that latch, so it falls
- * OUTSIDE this bound. See the KNOWN RESIDUAL paragraph at the end of this
- * comment; do not read this function, or the `checkHookBudgetLedgerMargin`
- * diagnostic it backs, as a blanket worst-case guarantee.
- *
- * `T` = the ledger's own per-call budget (`health.timeout_ms`, defaulted
- * to 5000 exactly like `realLedgerClient` itself). `R` =
- * `auditRetryTimeoutMs(T)`, the audit-retry session's own per-call budget.
- *
- *   1. query() — up to 2×T. `LedgerSession.querySummary`
- *      (src/policies/ledger-client.ts) performs `ensureInitialized()`
- *      (the `initialize` handshake, its own T-bounded wait) and, only
- *      once THAT resolves, the actual `ledger_summary` `tools/call` (a
- *      SEPARATE T-bounded wait). A ledger that is merely SLOW rather than
- *      hard-down (the threat class docs/risk-gate.md and this file's own
- *      `deny-degraded` diagnostics already name, distinct from an
- *      instantly-refusing one) can answer `initialize` just under T and
- *      still time out on the following `ledger_summary` — the case a
- *      naive "1×T" assumption undercounts.
- *
- *   2. the deny-degraded audit retry — up to 3×R. On the pure-timeout
- *      hang shape, the pooled session's `timedOut` latch (tripped by the
- *      query()-side timeout itself) makes the FIRST `record()` attempt on
- *      it instant (see `realLedgerClient`'s own doc comment above). The
- *      ONE reserved retry then opens a FRESH session budgeted at R and
- *      calls `recordPolicyDecisionOnSession` (src/runtime/ledger-
- *      record.ts), which can spend up to three independent R-bounded
- *      round-trips before it can report success or give up: the fresh
- *      session's own `initialize` handshake, the first `ledger_add`
- *      attempt at `type: "policy_decision"`, and — only reached when that
- *      attempt comes back a genuine JSON-RPC error rather than a
- *      transport timeout (an older/incompatible grounding-mcp rejecting
- *      the newer type) — the legacy `type: "fact"` fallback `ledger_add`.
- *
- * query() must complete (or degrade) before any policy decision — and so
- * any record() — is computed (`intercept()`'s per-policy loop in
- * src/runtime/intercept.ts awaits `evaluateOnePolicy`, which calls
- * `ledger.query`, before it calls `ledger.record`), and the retry only
- * starts after the first record() attempt on the pooled session already
- * failed, so the two stages are SEQUENTIAL within one hook invocation:
- * worst case ON THE PURE-TIMEOUT HANG SHAPE = 2T + 3R.
- *
- * KNOWN RESIDUAL (review 2026-08-09, fix round 1): when `query()` instead
- * degrades via one of the NON-timeout branches named in the SCOPE
- * paragraph above, the pooled session's `timedOut` latch is never set, so
- * `record()`'s own first attempt is a REAL round-trip too — up to T for
- * the `type: "policy_decision"` `ledger_add` attempt, plus another up to
- * T for the legacy `type: "fact"` fallback if that attempt is itself
- * rejected non-timeout — BEFORE the 3R retry sequence even starts. Worst
- * case on this "error-then-hang" shape is therefore up to 4T + 3R, not
- * 2T + 3R: 23750ms at the shipped T=5000 default, against this
- * function's 13750ms. This formula is DELIBERATELY NOT raised to
- * 4T + 3R: doing so would fail `checkHookBudgetLedgerMargin` against the
- * shipped, reviewer-confirmed-clean fresh-init budget of 15000ms
- * (src/cli/init/templates.ts, task 7bf47554/#414 — out of scope here) at
- * the same T=5000 default, since 15000 < 23750. The guard this function
- * backs GUARANTEES delivery of the fail-closed verdict on the
- * pure-timeout hang shape, but NOT on this error-then-hang shape.
- * Unlike an earlier draft of this note, this residual is NOT confined to
- * one runtime projection: Claude Code and Codex both convert `budget_ms`
- * into the outer hook-kill seconds via the identical `hookTimeoutSeconds`
- * helper (src/cli/apply/generate-settings.ts, shared by
- * generate-codex-config.ts) since task 7bf47554/#414, so a manifest at
- * the shipped defaults is equally exposed on both — this was checked
- * against both generators' current source, not assumed.
- */
-export function requiredHookBudgetMs(ledgerTimeoutMs) {
-    return 2 * ledgerTimeoutMs + 3 * auditRetryTimeoutMs(ledgerTimeoutMs);
-}
-function degradedLedgerClient(reason, stderr, hookName) {
-    return {
-        async query() {
-            return { kind: "degraded", reason };
-        },
-        async record(decision) {
-            // No transport exists, so no audit row can ever land. Stay silent
-            // for non-blocking rows (a manifest without grounding-mcp would
-            // otherwise emit one line per policy per tool event), but a
-            // BLOCKING decision with no audit row must not also be invisible
-            // (review 2026-08-08: previously a deny-degraded produced neither
-            // a row nor an audit-write-failed line on this path). Blocking-ness
-            // is the runtime's own isBlockingDecision — round 2 caught a third
-            // hand-rolled copy of that predicate here.
-            if (isBlockingDecision(decision)) {
-                stderr.write(`harness policy intercept${hookSuffix(hookName)}: blocking decision for ` +
-                    `${decision.policyName} has NO audit row (${reason})\n`);
-            }
-        },
-    };
-}
-/**
- * The hook event name a timed-out read carries when it names a hook event other
- * than PreToolUse, else `undefined`: the text is empty, truncated, not a JSON
- * object, names no event, or names PreToolUse. The caller keeps its pre-existing
- * continue behaviour only for an event this returns a name for.
- */
-function otherHookEventName(text) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text.trim());
-    }
-    catch {
-        return undefined;
-    }
-    if (typeof parsed !== "object" || parsed === null)
-        return undefined;
-    const name = parsed.hook_event_name;
-    return typeof name === "string" && name.length > 0 && name !== "PreToolUse" ? name : undefined;
-}
-export async function runInterceptCli(opts = {}) {
-    const stdin = opts.stdin ?? process.stdin;
-    const stdout = opts.stdout ?? process.stdout;
-    const stderr = opts.stderr ?? process.stderr;
-    const verbose = isVerboseEnabled(opts);
-    const idleTimeoutMs = opts.stdinIdleTimeoutMs ?? STDIN_IDLE_TIMEOUT_MS;
-    // Single pause-check options, shared by both checkPauseFromLoader calls.
-    const pauseOpts = {
-        loaderOpts: opts,
-        hookLabel: "policy intercept",
-        stderr,
-    };
-    if (opts.generatedDir !== undefined)
-        pauseOpts.generatedDir = opts.generatedDir;
-    if (opts.now !== undefined)
-        pauseOpts.now = opts.now;
-    const read = await readStdinBounded(stdin, idleTimeoutMs);
-    if (read.timedOut && otherHookEventName(read.text) === undefined) {
-        // A timed-out read leaves no event to judge, and this verb is the
-        // PreToolUse gate entrypoint: continuing as an empty event turned a block
-        // into an allow whenever the host stalled past the bound and then wrote a
-        // complete gated event. The rendered hook command carries no event name, so
-        // the event the read itself declares is the only signal there is: an event
-        // naming another hook event keeps the continue path below, anything else
-        // (nothing read, a truncated or unparseable prefix, a PreToolUse event, or
-        // an object with no event name) is treated as the PreToolUse call this
-        // verb is registered for. The operator pause still wins, and a paused run
-        // allows exactly as it does after a read that closed.
-        if (checkPauseFromLoader(pauseOpts).paused) {
-            return { exitCode: 0, decisions: [], blocked: false };
-        }
-        const reason = stdinTimeoutBlockReason(idleTimeoutMs);
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: BLOCK: ${reason}\n`);
-        stdout.write(`${stdinTimeoutBlockJson(reason)}\n`);
-        return { exitCode: 0, decisions: [], blocked: true };
-    }
-    if (read.timedOut) {
-        // Only an event that names another hook event gets here (see above), so the
-        // text read is non-empty and parsed as that event below.
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: ${stdinTimeoutNote(read, idleTimeoutMs)}\n`);
-    }
-    const raw = read.text;
-    let event;
-    try {
-        event = JSON.parse(raw.trim() || "{}");
-    }
-    catch (err) {
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: malformed event JSON: ${err.message}\n`);
-        return { exitCode: 0, decisions: [], blocked: false };
-    }
-    // Pause sentinel — operator-only kill switch. Honoured BEFORE manifest
-    // load so the lockout-recovery flow (where the manifest is exactly what
-    // is broken) still respects an active pause. Mirrors the pack PreToolUse
-    // hook: without this the policy gates kept firing while paused, i.e. the
-    // very gates the kill switch most needs to silence (a wedged preflight /
-    // grounding gate is the canonical reason an operator pauses at all).
-    {
-        if (checkPauseFromLoader(pauseOpts).paused) {
-            return { exitCode: 0, decisions: [], blocked: false };
-        }
-    }
-    let manifest;
-    let manifestPath;
-    try {
-        if (opts.manifest) {
-            manifest = opts.manifest;
-        }
-        else {
-            const loaded = loadManifest(opts);
-            manifest = loaded.manifest;
-            manifestPath = loaded.resolved.base;
-        }
-    }
-    catch (err) {
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: manifest load failed: ${err.message}\n`);
-        return { exitCode: 0, decisions: [], blocked: false };
-    }
-    let ledger;
-    if (opts.ledger) {
-        ledger = opts.ledger;
-    }
-    else {
-        const server = findGroundingMcp(manifest);
-        ledger = server
-            ? realLedgerClient(server, opts)
-            : degradedLedgerClient("grounding-mcp not declared in manifest", stderr, opts.hookName);
-    }
-    // For the SESSION_ID builtin we keep the empty-string fallback rather
-    // than routing through resolveSessionId (which lands on "default").
-    // Routing through "default" would silently bake the literal string
-    // into ledger_tag templates like `dogfood:${SESSION_ID}` →
-    // `dogfood:default`, which would substring-match anything in the
-    // shared "default" session — a worse failure mode than the current
-    // empty substitution. The empty path produces tags like `dogfood:`
-    // (substituteTemplate treats the registered "" value as a successful
-    // substitution since the key is hasOwnProperty-present, so this is
-    // NOT marked warn-degraded by the requires evaluator); the ledger
-    // query for that fire also lands on the resolveSessionId-derived
-    // session, so the asymmetry is acceptable in practice. Do NOT
-    // "simplify" by routing this through resolveSessionId.
-    // The env fallback is still applied so a Claude-Code-driven hook with
-    // a stripped event can pick up the active session.
-    const eventSessionId = typeof event.session_id === "string" ? event.session_id : undefined;
-    // Env-var fallback chain: $CLAUDE_CODE_SESSION_ID first (the var Claude
-    // Code actually exports), then legacy $CLAUDE_SESSION_ID. Matches the
-    // resolver precedence in src/runtime/session-id.ts.
-    const builtinSessionId = eventSessionId ??
-        process.env.CLAUDE_CODE_SESSION_ID ??
-        process.env.CLAUDE_SESSION_ID ??
-        "";
-    // REPO / BRANCH are derived from the tool event's cwd so that per-repo
-    // and per-branch ledger tags (`preflight:${REPO}`, `preflight:${BRANCH}`)
-    // actually namespace — they were previously read from HARNESS_REPO /
-    // HARNESS_BRANCH env vars that nothing sets, collapsing every tag to the
-    // literal `preflight:`. An explicit env var still wins: it is the
-    // operator's deliberate override of the derived value.
-    //
-    // `cwdGitContext` below is the DEFAULT / FALLBACK builtins basis, not
-    // the only one used anymore (task `98ad072f`, T-003). A command that
-    // explicitly names a different repository (`git -C <B>`, `env -C <B>`,
-    // a leading `cd <B> &&`) still resolves `builtins.REPO`/`.BRANCH` (and
-    // `currentHeadSha`, below) from THIS cwd for the majority of policies —
-    // any policy whose `requires:` doesn't reference `${REPO}`/`${BRANCH}`/
-    // `at_head` stays exactly on this cwd-only path, as does any policy
-    // whose own trigger-satisfying segment names no foreign target. Only a
-    // MATCHED policy that (a) uses `${REPO}`/`${BRANCH}`/`at_head` and (b)
-    // whose own `bash_match`-satisfying segment names a different,
-    // resolvable git repository gets a per-policy override — resolved
-    // lazily, inside `intercept()`, from the `commandSegments` view threaded
-    // below, never from this `cwdGitContext`. A prior attempt (run
-    // `2026-07-27-gate-target-repo-resolution`) tried a single global
-    // `targetDir` per event instead and was removed before shipping: three
-    // consecutive review rounds each found a different way one event-wide
-    // target leaked into the wrong evaluation (Risk Gate risk
-    // declassification; a push-gate multi-invocation fail-open; a non-git
-    // gated verb sharing a chain with a targeted git call). This
-    // `cwdGitContext` variable, and the `builtins` object built from it
-    // below, remain exactly what they were before this task — the resolved
-    // fallback every policy without a foreign attribution still uses,
-    // including the Risk Gate's own `resolverGit` further down, which
-    // this task does not touch at all.
-    const cwd = resolvePolicyCwd(event, opts.codexCommandCwd);
-    const cwdGitContext = resolveGitContext(cwd);
-    // Computed once here (not per-policy) so `intercept()` below can thread
-    // the SAME `NormalizedCommand` into every `bash_match` trigger check
-    // instead of each one recomputing it.
-    //
-    // Fix round 1, finding F4: derive this from `extractShellCommand(event)`
-    // — the SAME function `policyMatchesEvent`'s `bash_match` branch itself
-    // calls (`src/runtime/tool-name-aliases.ts`) — instead of the narrower
-    // `event.tool_name === "Bash"` + `readBashCommand(event.tool_input)` pair
-    // this used before, which only ever looked at `tool_input.command`. A
-    // Codex shell event (`tool_name: "shell"` / `"exec_command"` /
-    // `"functions.exec_command"`, which `expandToolNameAliases` maps onto
-    // `match: "Bash"` policies) commonly carries its command under
-    // `raw_input`/`input` rather than `tool_input`, or under a `cmd` key —
-    // `extractShellCommand` reads all of those, `readBashCommand` read none
-    // of them. Before this fix such an event still reached the `bash_match`
-    // branch (via alias expansion) but with no precomputed value, so
-    // `policyMatchesEvent`'s per-policy fallback ran BOTH normalisation
-    // passes once PER MATCHING POLICY instead of once per event.
-    // `isCodexShellTool` scopes the precompute to exactly the tool-name set
-    // `SHELL_ALIASES` expands (Bash plus the three Codex shell aliases), so
-    // this does not start normalising unrelated tool calls that merely
-    // happen to carry a `command`/`cmd`-named argument for some other
-    // purpose.
-    //
-    // Fix round 2: that set is NOT, as this comment previously claimed, the
-    // only way a `match: "Bash"` policy's `bash_match` branch can be
-    // reached. `trigger.match` is a SUBSTRING test over the expanded alias
-    // list, so `BashOutput` and `KillBash` — real Claude Code tool names —
-    // satisfy `match: "Bash"` too and do reach that branch (measured: both
-    // return `policyMatchesEvent === true`). They simply fall through to
-    // the per-policy fallback here, exactly as they did before this change,
-    // so nothing is gated differently; the precompute just does not
-    // de-duplicate for them.
-    //
-    // This also makes the precomputed value and the matcher's own value
-    // PROVABLY consistent for the common case: both are now the same
-    // `extractShellCommand(event)` call, so the latent
-    // `raw_input`/`input`/`cmd` divergence `InterceptOptions.normalizedCommand`'s
-    // own JSDoc warns about (nothing verifies the threaded value came from
-    // the event's real command) can no longer actually diverge for a
-    // `tool_name` in `SHELL_ALIASES` — the one production call site
-    // (`runInterceptCli`) derives both from the identical event via the
-    // identical function. It remains an unenforced INVARIANT, not a checked
-    // one: nothing stops a future second caller from threading a mismatched
-    // value in, and `event.tool_input`/`raw_input`/`input` could still
-    // change between the moment this is read and any later read of the same
-    // event object, however unlikely in practice.
-    //
-    // TWO behavioural differences, both checked (fix round 2 corrects the
-    // prior wording, which named only the first):
-    //
-    // 1. `readBashCommand` required a NON-EMPTY string; `extractShellCommand`
-    //    accepts an empty one. An empty command now becomes
-    //    `bashCommand = ""` instead of `null`, so `normalizedCommand`
-    //    becomes a defined `normalizeCommand("") = {normalized: "",
-    //    truncated: false, ...}` instead of staying `undefined` —
-    //    behaviourally identical either way (a pure function of the empty
-    //    string, now computed once instead of falling back per policy), and
-    //    `truncated` can never be `true` for an empty string, so the
-    //    `MAX_NORMALIZE_LENGTH` stderr line just below cannot fire from it.
-    //
-    // 2. That stderr line's SCOPE widened. Under the old ternary
-    //    `bashCommand` was unconditionally `null` for any non-`Bash`
-    //    `tool_name`, so `normalizedCommand` stayed `undefined` and the
-    //    guard could never fire for a Codex shell event, nor for a command
-    //    carried under `raw_input`/`input` or a `cmd` key. Measured at
-    //    HEAD: a `tool_name: "shell"` event with a 100,001-char
-    //    `raw_input.cmd` now emits the line. The direction is
-    //    safety-positive — a previously SILENT loss of normalised-form
-    //    coverage on those events is now reported — but it is a real change
-    //    in observable output, so it is named here rather than implied.
-    const bashCommand = isCodexShellTool(event.tool_name) ? extractShellCommand(event) : null;
-    const normalizedCommand = bashCommand === null ? undefined : normalizeCommand(bashCommand);
-    // Per-segment view for `intercept()`'s per-policy attribution (task
-    // `98ad072f`, T-003) — deferred behind a memoised thunk, mirroring
-    // `ampNormalizedCommandThunk` below (D-015 fix round, run
-    // 2026-08-02-per-repo-gate-scoping-redesign, correcting this comment's
-    // own prior claim). CORRECTED: this is NOT "the same class as
-    // `normalizeCommand`'s own eager call just above" — `segmentViewOf` runs
-    // its OWN full segmentation walk over `bashCommand` (`command-
-    // normalize.ts`'s `segmentAndCanonicalize`, a SEPARATE call from the one
-    // `normalizeCommand` just made on the SAME string), and computing it
-    // unconditionally, for every Bash event, regardless of whether any
-    // policy in the manifest even uses `${REPO}`/`${BRANCH}`/`at_head`, was
-    // measured as a real, avoidable second pass — +206% at
-    // `MAX_NORMALIZE_LENGTH` (2.73 → 8.36 ms; see `segmentViewOf`'s own doc
-    // comment in `command-normalize.ts`). Threading it as a self-memoising
-    // thunk instead — the exact shape `ampNormalizedCommandThunk` below
-    // already uses for the same reason — lets `intercept()`'s
-    // `usesPerRepoBuiltins` gate decide whether the walk happens at all: a
-    // manifest with none of those policies never calls `segmentViewOf`, and
-    // a manifest that DOES still only pays the cost once per event, on
-    // first use, not once per Bash event regardless of need.
-    let commandSegmentsCache;
-    const commandSegmentsThunk = bashCommand === null
-        ? undefined
-        : () => {
-            if (commandSegmentsCache === undefined) {
-                commandSegmentsCache = segmentViewOf(bashCommand);
-            }
-            return commandSegmentsCache;
-        };
-    // Memoised thunk for the ampersand-aware SECOND normalisation pass
-    // (task aabbad63). Unlike `normalizedCommand` above — eagerly computed
-    // once per Bash event, because `policyMatchesEvent`'s first two arms
-    // may need it on every raw-miss — the amp-aware pass is consulted only
-    // as a THIRD, additional arm, and only when a policy's regex has
-    // already missed BOTH the raw command and `normalizedCommand`; most
-    // events never reach it at all. Computing it eagerly here would pay
-    // its segmentation cost on the common path for every single Bash call
-    // inside the ~1000ms hook budget, whether or not any policy ends up
-    // needing it. Wrapping it in a lazily-evaluated, self-memoising thunk
-    // instead lets `policyMatchesEvent` call it from inside the manifest-
-    // wide `matching` loop below (once per policy that still hasn't
-    // matched) while the actual segmentation work happens AT MOST ONCE per
-    // event — the same "computed once per event, not once per policy"
-    // discipline `normalizedCommand` already has, just deferred until
-    // first use instead of forced up front.
-    let ampNormalizedCommandCache;
-    const ampNormalizedCommandThunk = bashCommand === null
-        ? undefined
-        : () => (ampNormalizedCommandCache ??= normalizeCommandAmpAware(bashCommand));
-    // Memoised thunk for the quote-aware THIRD normalisation pass (task
-    // cf3dff51) — the SAME shape as `ampNormalizedCommandThunk` immediately
-    // above, for the same reason: `policyMatchesEvent`'s fourth arm calls
-    // this only when a policy's regex has already missed the raw command,
-    // `normalizedCommand`, AND the amp-aware pass, so most events never
-    // reach it at all; computing it eagerly here would pay its
-    // segmentation cost on the common path for every Bash call regardless
-    // of whether any policy ends up needing it.
-    let quoteNormalizedCommandCache;
-    const quoteNormalizedCommandThunk = bashCommand === null
-        ? undefined
-        : () => (quoteNormalizedCommandCache ??= normalizeCommandQuoteAware(bashCommand));
-    // Above `MAX_NORMALIZE_LENGTH`, `normalizeCommand` skips normalisation
-    // entirely and `truncated` comes back `true`. Raw matching still
-    // applies regardless (`policyMatchesEvent`'s raw-OR-normalised-OR-amp-
-    // normalised-OR-quote-normalised construction), so an oversized command
-    // only loses the ADDITIONAL normalised-form coverage — but that skip
-    // must not be silent, so one stderr line reports it here, keeping the
-    // module itself pure and I/O-free. This one line also covers the
-    // amp-aware SECOND pass (`normalizeCommandAmpAware`, task `aabbad63`,
-    // fix round 1 finding F6) and the quote-aware THIRD pass
-    // (`normalizeCommandQuoteAware`, task `cf3dff51`): both share the
-    // identical `MAX_NORMALIZE_LENGTH` bound over the identical
-    // `bashCommand`, so neither one's own `truncated` can ever disagree
-    // with `normalizedCommand`'s for this call — no separate stderr line
-    // names either pass's own skip, nor does one need to.
-    if (normalizedCommand?.truncated === true) {
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: Bash command exceeds ${MAX_NORMALIZE_LENGTH} chars; normalised-form matching skipped for this call (raw match only)\n`);
-    }
-    const builtins = {
-        SESSION_ID: builtinSessionId,
-        REPO: process.env.HARNESS_REPO ?? cwdGitContext.repo,
-        BRANCH: process.env.HARNESS_BRANCH ?? cwdGitContext.branch,
-        TOOL_NAME: typeof event.tool_name === "string" ? event.tool_name : "",
-        CWD: cwd,
-    };
-    // Risk Gate ambient context — resolved only when the manifest
-    // declares a `when:`-bearing policy, so a pure Phase-4 manifest pays
-    // no kube-config read. `intercept()` applies the same gate; this just
-    // avoids the host I/O when nothing would consume it.
-    let riskContext;
-    if (manifest.policies.some((p) => p.when !== undefined)) {
-        const kube = opts.kubeContext !== undefined || opts.kubeNamespace !== undefined
-            ? {
-                context: opts.kubeContext ?? "",
-                namespace: opts.kubeNamespace ?? "",
-            }
-            : resolveKubeContext();
-        // Three POSIX Bash idioms (`VAR=value command`, `cd <path> &&
-        // command`, and — since task 341e024b — `git switch|checkout
-        // <branch> && command`) were invisible to the resolver before: the
-        // env resolver read `process.env` and the branch resolver read
-        // `.git/HEAD` under the hook's starting cwd, so a prod signal
-        // smuggled through any of the three idioms silently passed the
-        // gate. Parse the leading prefix once from the Bash command and
-        // merge the result into the resolver inputs only. ${CWD} always
-        // names the hook's own cwd; ${REPO}/${BRANCH} (`cwdGitContext`
-        // above, feeding `builtins`) are cwd-only too — see the comment
-        // above `cwdGitContext`'s declaration. The Risk Gate resolver's git
-        // base, `resolverGit` (risk-envelope-enrichment.ts), is its own narrow parse: it
-        // recognises only a leading `cd`, never `git -C` / `--work-tree` /
-        // `--git-dir` / `env -C`. Bottom line: `resolverGit` must never read
-        // anything other than `cwdGitContext`, or the leading-`cd` target
-        // within THIS same narrow parse — this feeds `when:`-clause risk
-        // classification, not ledger-tag namespacing.
-        //
-        // G5 (review round 2, 2026-07-27): that leading-`cd` parse is itself
-        // still a live declassification lever, PRE-EXISTING and NOT changed
-        // by this run — identical on the shipped 0.42.0 control, so this is
-        // documentation of a known asymmetry, not a new gap. From a repo on
-        // `main`, `rm -rf /data` BLOCKS, but `cd <repo-on-feature/x> && rm -rf
-        // /data` is ALLOWED: the `cd` target makes the resolver read
-        // feature/x's branch instead of cwd's `main`, so `branch_patterns:
-        // [main]` no longer matches. The asymmetry cuts both ways and neither
-        // direction is fixed here: a leading `cd` can make a prod signal
-        // VISIBLE that cwd alone would have missed (cwd on a feature branch,
-        // `cd` into a repo actually on `main`) just as readily as it can make
-        // one INVISIBLE (cwd on `main`, `cd` into a repo on a feature
-        // branch, as in the example above) — `resolverGit` trusts whichever
-        // of the two the command happens to name, with no independent check
-        // that the `cd` target is the repo the destructive command actually
-        // runs against. The `git switch`/`checkout` merge in that helper
-        // (`gitForRisk`, `applyBranchSwitchUpgrade`, same module) deliberately does
-        // NOT share this bidirectional-risk shape: it is a SEPARATE,
-        // upgrade-only step layered on top of `resolverGit`, not a change to
-        // `resolverGit` itself — a switch away from a production branch can
-        // never downgrade what `resolverGit` (cwd- or cd-based) already
-        // resolved.
-        const riskUser = safeOs(() => os.userInfo().username);
-        const riskHost = safeOs(() => os.hostname());
-        // The leading-prefix parse and the three merges it feeds (inline
-        // `VAR=value` env, leading `cd`, leading `git switch|checkout`)
-        // live in `resolveBashPrefixEnrichment`, shared (via
-        // `src/cli/enriched-event.ts`) with `harness explain-policy`,
-        // `resolve-env`, `test-risk` and `explain-action` so the debug verbs
-        // cannot drift from this hook.
-        // The kubectl-target merge below stays hook-only.
-        const { bashPrefix, riskBashCommand, git: gitForRisk, env: resolverEnv } = resolveBashPrefixEnrichment({
-            event,
-            manifest,
-            cwd,
-            cwdGitContext,
-            env: opts.env ?? process.env,
-            kubeContext: kube.context,
-            kubeNamespace: kube.namespace,
-            user: riskUser,
-            host: riskHost,
-            now: opts.now,
-        });
-        // Explicit `--context`/`--namespace`/`-n` on a `kubectl ...`
-        // invocation (task a7eb1a71). Fed the REMAINDER after `bashPrefix`
-        // consumed a leading `cd <path> &&` / `VAR=value` / `git switch
-        // <branch> &&` prefix, not the raw command, so a wrapped invocation
-        // like `cd /tmp && kubectl ... --context x` is still covered; see
-        // `parseKubectlTarget`'s own doc comment for the narrow,
-        // command-head-anchored scope this is otherwise kept to, and for
-        // the forms still NOT unwrapped (sudo/time/env wrappers, a kubectl
-        // that is not the first chained segment, a piped kubectl).
-        const kubectlSubject = riskBashCommand === null ? null : riskBashCommand.slice(bashPrefix?.remainderStart ?? 0);
-        const kubectlTarget = kubectlSubject === null ? null : parseKubectlTarget(kubectlSubject);
-        // CONFLICT PRIORITY (task a7eb1a71): an explicit kubectl
-        // --context/--namespace/-n is merged on top of the AMBIENT kube
-        // state (`kube`), on top of `gitForRisk` above (the git context
-        // AFTER the branch-switch upgrade), upgrade-only, exactly the same
-        // asymmetric shape the branch-switch merge itself uses. Command
-        // text can only raise the resolved environment toward production,
-        // never lower an already-resolved production; see
-        // `applyKubeTargetUpgrade`'s own doc comment for the measured
-        // downgrade this fixes.
-        const kubeForRisk = applyKubeTargetUpgrade(event, manifest, cwd, gitForRisk, { context: kube.context, namespace: kube.namespace }, kubectlTarget, resolverEnv, riskUser, riskHost, opts.now);
-        riskContext = {
-            git: gitForRisk,
-            cwd,
-            user: riskUser,
-            host: riskHost,
-            env: resolverEnv,
-            kubeContext: kubeForRisk.context,
-            kubeNamespace: kubeForRisk.namespace,
-        };
-    }
-    let result;
-    try {
-        result = await intercept({
-            manifest,
-            event,
-            ledger,
-            builtins,
-            stderr,
-            ...(opts.ledgerTimeoutMs !== undefined && { ledgerTimeoutMs: opts.ledgerTimeoutMs }),
-            ...(opts.now && { now: opts.now }),
-            ...(cwdGitContext.sha.length > 0 && { currentHeadSha: cwdGitContext.sha }),
-            ...(riskContext && { riskContext }),
-            ...(normalizedCommand && { normalizedCommand }),
-            ...(ampNormalizedCommandThunk && { ampNormalizedCommandThunk }),
-            ...(quoteNormalizedCommandThunk && { quoteNormalizedCommandThunk }),
-            ...(commandSegmentsThunk && { commandSegmentsThunk }),
-            ...(process.env.HARNESS_REPO !== undefined && { repoOverridden: true }),
-            ...(process.env.HARNESS_BRANCH !== undefined && { branchOverridden: true }),
-        });
-    }
-    finally {
-        // Tear down the pooled grounding-mcp session (no-op for injected test
-        // doubles and the degraded client). All queries/records are awaited
-        // inside intercept(), so nothing is in flight here.
-        ledger.dispose?.();
-    }
-    // Stage the session id for a later arg-less `harness approve risk`
-    // whenever the FIRST blocking decision is `require_approval`. Mirrors
-    // the Understanding Gate hook (src/cli/pack/hook-pre-tool-use.ts):
-    // the producer side knows the live session id (it just received it on
-    // the hook event), but `harness approve risk` runs from the operator's
-    // `!`-shell where `$CLAUDE_SESSION_ID` is unset, so it has to read the
-    // marker. `deny` and `deny-degraded` decisions are deliberately not
-    // staged: `harness approve risk` cannot unblock either (a deny is a
-    // real verdict, a deny-degraded means the evidence source is
-    // unreadable, so no approval tag could even be read), and writing a
-    // marker the verb cannot act on would just lie about the
-    // recoverability of the block. The "first blocking decision" check
-    // (rather than `.some()`) matters when two `when:`-bearing policies
-    // fire on the same event: the runtime's `intercept()` picks the first
-    // blocking decision (its `isBlockingDecision`, imported here so the
-    // two surfaces cannot drift — review 2026-08-08), so a blocking-first
-    // / `require_approval`-second order produces an unrecoverable block;
-    // we mustn't stage in that case either.
-    //
-    // Best-effort: a staging-write failure must never escalate a gate block
-    // into a thrown hook error. `resolveGeneratedDir` is skipped (along
-    // with the write) when no manifest path could be resolved — tests
-    // exercise the policy logic with injected manifests and no on-disk
-    // path, and the test path is also the only place an empty
-    // `eventSessionId` is interesting.
-    const firstBlocking = result.decisions.find(isBlockingDecision);
-    if (result.blockJson &&
-        eventSessionId !== undefined &&
-        eventSessionId.length > 0 &&
-        firstBlocking?.outcome === "require_approval" &&
-        // An empty-identifier decision never reads the ledger, so no approval
-        // tag could unblock it: staging a marker `harness approve risk` cannot
-        // act on would misstate the recoverability of the block.
-        firstBlocking.emptyIdentifier === undefined) {
-        const generatedDir = opts.generatedDir
-            ?? (manifestPath !== undefined
-                ? resolveGeneratedDir({
-                    ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-                    manifestPath,
-                })
-                : undefined);
-        if (generatedDir !== undefined) {
-            try {
-                writePendingApproval(generatedDir, eventSessionId);
-            }
-            catch {
-                /* best-effort; the block below proceeds regardless */
-            }
-        }
-    }
-    if (result.blockJson) {
-        stdout.write(`${JSON.stringify(result.blockJson)}\n`);
-    }
-    // No-match diagnostic. Always (not gated on --verbose) when the
-    // manifest has at least one policy but none of them matched this
-    // event. Catches the common debug footgun where an operator probes
-    // `harness policy intercept` by hand and forgets `hook_event_name`,
-    // making the engine return exit 0 + empty stdout. The probe then
-    // looks like "policy did not load", when in fact the trigger filter
-    // simply rejected the input. Emits to stderr so the Claude Code
-    // hook contract on stdout is preserved.
-    if (result.decisions.length === 0 && manifest.policies.length > 0) {
-        stderr.write(formatNoMatchHint(event, manifest, opts.hookName));
-    }
-    // Degraded-deny operator hint. Default-verbosity, ONE line per event:
-    // the envelope deliberately tells the agent only to involve the
-    // operator, and the full diagnostic (which names the fail_open
-    // opt-out) is verbose-only — without this line an operator whose
-    // fleet wedges on a degraded ledger has no default-verbosity pointer
-    // at all (review 2026-08-08, round 2). Two deliberate properties:
-    //   - It carries the decision's OWN reason (sanitised: it can embed
-    //     grounding-mcp subprocess output) instead of asserting a ledger
-    //     fault — deny-degraded has five causes and only one of them is
-    //     the ledger; a hardcoded "ledger unreadable" sent operators of
-    //     the other four down a false doctor-path (round 3, medium).
-    //   - It does NOT name the opt-out knob: hook stderr can be surfaced
-    //     to the model in some harness configurations, so the default
-    //     channel points at the operator docs and the verbose diagnostic
-    //     instead of carrying the disable recipe (deviation from round
-    //     2's suggested fix, recorded in the run's 03-decisions.md).
-    // Suppressed under --verbose, where formatDecisionDiagnostic already
-    // prints the same reason with more context.
-    const firstDegradedDeny = result.decisions.find((d) => d.outcome === "deny-degraded");
-    if (firstDegradedDeny && !verbose) {
-        stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: ${firstDegradedDeny.policyName}: ` +
-            `deny-degraded (evidence could not be evaluated: ` +
-            `${sanitizeEnvelopeReason(firstDegradedDeny.reason)}); failing closed. ` +
-            `Operator recovery: check the reason above, then harness doctor if it names ` +
-            `the ledger; details and the availability opt-out: docs/risk-gate.md ` +
-            `("Degraded mode") or rerun with HARNESS_POLICY_VERBOSE=1\n`);
-    }
-    if (verbose) {
-        for (const decision of result.decisions) {
-            if (decision.outcome === "allow")
-                continue;
-            stderr.write(formatDecisionDiagnostic(decision, opts.hookName));
-        }
-    }
-    return {
-        exitCode: 0,
-        decisions: result.decisions,
-        blocked: result.blockJson !== null,
-    };
-}
-function formatNoMatchHint(event, manifest, hookName) {
-    const observedEvent = typeof event.hook_event_name === "string" && event.hook_event_name.length > 0
-        ? `"${event.hook_event_name}"`
-        : "(missing)";
-    const observedTool = typeof event.tool_name === "string" && event.tool_name.length > 0
-        ? `"${event.tool_name}"`
-        : "(missing)";
-    const registeredEvents = Array.from(new Set(manifest.policies.map((p) => p.trigger.event))).sort();
-    return (`harness policy intercept${hookSuffix(hookName)}: no policy matched event ` +
-        `hook_event_name=${observedEvent} tool_name=${observedTool} ` +
-        `(registered policy events: ${registeredEvents.join(", ")}). ` +
-        `If probing by hand, ensure stdin includes hook_event_name (e.g. "PreToolUse" for tool gates).\n`);
-}
-//# sourceMappingURL=intercept.js.map