@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.d.ts

@@ -1,210 +0,0 @@
-/**
- * Prefix every auto-minted marker's `approvedBy` carries, distinguishing
- * it from a human `harness approve understanding` marker (which carries
- * the operator's own identity string, never this prefix).
- */
-export declare const AUTO_APPROVED_BY_PREFIX = "auto-mode:";
-/** The harness identifier the Claude Code PreToolUse hook mints markers for. */
-export declare const CLAUDE_CODE_HARNESS = "claude-code";
-/**
- * The harness identifier the Codex PreToolUse hook mints markers for
- * (slice 2 of the ADR: same auto path, same fail-closed conditions, a
- * distinct `approvedBy` segment so an audit can tell the two runtimes
- * apart). Deliberately NOT re-exported through
- * `understanding-before-execution/index.ts`: its only consumer is
- * `src/cli/pack/hook-codex-pre-tool-use.ts`, and widening the runtime
- * shim's pinned public surface (tests/policy-packs/ube-export-surface.test.ts)
- * is a separate, conscious act.
- */
-export declare const CODEX_HARNESS = "codex";
-/**
- * Build the `approvedBy` value the hook writes into a signed auto-marker:
- * `auto-mode:<harness>:<mode>`, for example `auto-mode:claude-code:bypassPermissions`
- * or `auto-mode:codex:bypassPermissions` ("Audit and doctor" in the ADR).
- * Neither `harness` nor `mode` is validated here; callers pass
- * already-known-good values (one of the fixed harness constants above and
- * a `when`-matched mode string).
- */
-export declare function autoApprovedByFor(harness: string, mode: string): string;
-/** Parsed shape of an `approvedBy` string minted by {@link autoApprovedByFor}. */
-export interface ParsedAutoApprovedBy {
-    harness: string;
-    mode: string;
-}
-/**
- * Parse an `approvedBy` string back into its harness/mode pair. Returns
- * `null` for anything that is not exactly `auto-mode:<harness>:<mode>`
- * with both segments non-empty, including a human marker's `approvedBy`
- * (which never carries this prefix) and a malformed or truncated auto
- * value. A slice 3 delegation suffix (`;delegated:<parent-sid>`) is
- * tolerated: it is stripped before parsing and otherwise ignored, per
- * the ADR's "Audit and doctor" convention that the delegation binding
- * packs into the same field without changing the harness/mode shape.
- */
-export declare function parseAutoApprovedBy(approvedBy: unknown): ParsedAutoApprovedBy | null;
-/**
- * Build the audit-only ledger fact the ADR's "Audit and doctor" section
- * names: `understanding-auto-approved:<sid>`, distinct from the human
- * `understanding-approved:<sid>` tag (`ledger.ts`), following the same
- * `...:forced:<field>` suffix precedent the ADR cites. Ledger only, never
- * consulted for the gate decision itself.
- */
-export declare function autoApprovedLedgerTagFor(sessionId: string): string;
-/**
- * The harness identifiers `auto_approve.harnesses` accepts, in the order
- * the schema and every diagnostic list them. Shared with the pack's zod
- * `configSchema` (`../understanding-before-execution.ts`) so the lint-time
- * enum and this runtime parser cannot drift apart.
- */
-export declare const AUTO_APPROVE_HARNESS_VALUES: readonly ["claude-code", "codex"];
-/**
- * What `auto_approve.harnesses` resolves to when the key is ABSENT.
- * Claude Code only, deliberately: slice 1 shipped `auto_approve` as a
- * Claude-only opt-in, so a repo that opted in before slice 2 must keep
- * exactly the meaning it had — adding the Codex hook to the shared body
- * must not silently extend an existing opt-in to a second runtime
- * (reviewer round-1 finding on slice 2). Opting Codex in is an explicit,
- * visible config edit.
- */
-export declare const DEFAULT_AUTO_APPROVE_HARNESSES: readonly string[];
-/**
- * What `auto_approve.report_scan.max_wait` resolves to when the key is
- * ABSENT: the bound the child's PreToolUse hook waits for its own
- * Understanding Report to reach the session transcript before it blocks
- * (ADR "Report capture under `-p`", slice 3 acceptance criterion 3).
- *
- * The value is measured, not guessed: under `claude -p` the report is
- * absent from the transcript at the instant PreToolUse fires and lands
- * some time later, on a lag that scales with report length, so the
- * bound is set from the real end-to-end runs (a full-length grill_me
- * report), not only the shorter probe reports that first-guessed 500ms.
- * The measurement and the retuning derivation are both in
- * `docs/okf/understanding-gate-auto-mode-signals.md` ("Chosen
- * `report_scan.max_wait` default" section), from
- * `dogfood/ug-auto-mode-signals/`.
- *
- * ONE named constant on purpose: the hook, the schema default and every
- * test read this symbol, so re-tuning the bound against a new
- * measurement is a one-line change with no literal to hunt down.
- */
-export declare const DEFAULT_REPORT_SCAN_MAX_WAIT_MS = 2000;
-/**
- * Hard ceiling for `auto_approve.report_scan.max_wait`. A larger value
- * is a `harness validate` schema error AND a runtime parse failure (which
- * fails the whole `auto_approve` block closed), so no configuration can
- * make a PreToolUse hook sit on a session for an arbitrary time. 5 s is
- * an order of magnitude above the measured worst-case flush, which is
- * generous for a bound whose only job is to cover a transcript write
- * already in flight.
- */
-export declare const REPORT_SCAN_MAX_WAIT_CEILING_MS = 5000;
-/** Parsed, validated `auto_approve` pack-config block. */
-export interface AutoApproveConfig {
-    /** Allowlist of `permission_mode` payload literals eligible for auto-approval. */
-    when: string[];
-    /**
-     * Allowlist of HARNESSES whose PreToolUse hook may take the auto path
-     * at all. Always non-empty: an absent key resolves to
-     * {@link DEFAULT_AUTO_APPROVE_HARNESSES}, and every malformed shape
-     * fails the whole block closed rather than defaulting.
-     */
-    harnesses: string[];
-    /**
-     * The transcript-poll bound for the slice 3 delegation path. Always
-     * present: an absent `report_scan` block resolves to
-     * {@link DEFAULT_REPORT_SCAN_MAX_WAIT_MS}, and every malformed shape
-     * fails the whole `auto_approve` block closed, like every other key
-     * here.
-     */
-    reportScan: {
-        maxWaitMs: number;
-    };
-}
-export type ReportScanMaxWaitParse = {
-    ok: true;
-    maxWaitMs: number;
-} | {
-    ok: false;
-    reason: string;
-};
-/**
- * Parse `auto_approve.report_scan.max_wait` into milliseconds.
- *
- * Duration grammar: the pack's SHARED parser
- * ({@link parseDurationSeconds}, the same one `approval_lifecycle.max_age`
- * uses), plus an `<n>ms` shorthand it does not model. The extension is
- * not cosmetic: this bound is a transcript-flush allowance measured in
- * tens of milliseconds, so a second-granularity grammar could not express
- * the values the measurement actually argues for, and widening
- * `parseDurationSeconds` itself would change the grammar of every
- * `within:` / `max_age:` / `--since` value in the repo for one key's sake.
- *
- * Both bounds are errors, never clamps: zero or negative (a bound that
- * would disable the poll while the block still claimed to have one) and
- * anything above {@link REPORT_SCAN_MAX_WAIT_CEILING_MS} (a bound that
- * could park a PreToolUse hook). Returning a RESULT rather than throwing
- * keeps the two consumers symmetric: the zod schema turns it into a
- * `harness validate` diagnostic, the runtime parser into one stderr line
- * and a fail-closed `null`.
- */
-export declare function parseReportScanMaxWait(raw: unknown): ReportScanMaxWaitParse;
-/**
- * Parse the optional `auto_approve` pack-config block
- * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
- *
- * FAIL CLOSED, unlike {@link parseApprovalLifecycle}'s best-effort
- * fallback: this block is an opt-IN to a hook-side signing path
- * (hardening item 3 in the ADR's threat model (b) — `require_report:
- * false` must be a schema error, not a silently-ignored key), so any
- * malformed shape here means "not opted in" (`null`), never a partial
- * or default-filled config that could still enable the auto path. The
- * `configSchema` zod block in `../understanding-before-execution.ts` is
- * the first line of defence (`harness validate` / `harness doctor`
- * reject a malformed manifest at lint time); this parser is the second,
- * defensive line for the runtime hook, which must not trust that every
- * config it sees on disk passed the schema.
- *
- * `undefined` / `null` (the block is simply absent) returns `null`
- * silently — that is the ordinary "not opted in" case, not a warning.
- * Every other malformed shape writes exactly one stderr line and
- * returns `null`.
- *
- * `label` is the stderr prefix of the calling hook, so a Codex-side
- * warning reads `harness pack hook codex: ...` like every other line
- * that hook writes. The default reproduces the Claude Code hook's
- * wording byte-for-byte.
- */
-export declare function parseAutoApprove(raw: unknown, stderr?: {
-    write(s: string): void;
-} | null, label?: string): AutoApproveConfig | null;
-/**
- * ADR "Additional hardening to specify" item 2: `when` is an allowlist
- * of payload literals, membership by exact string equality, no case
- * folding, no substring, no wildcards. `mode` absent, empty, or not a
- * string means no auto-approval, and `cfg === null` (block absent or
- * malformed) means no auto-approval regardless of `mode`.
- *
- * Takes only the `when` slice of the config rather than the whole block:
- * this predicate reads exactly one field, and saying so in the signature
- * keeps it honest as the block grows further keys (`harnesses`,
- * `report_scan`) that have nothing to do with mode membership.
- */
-export declare function permissionModeAllowed(cfg: Pick<AutoApproveConfig, "when"> | null, mode: unknown): boolean;
-/**
- * Per-harness opt-in membership, the same exact-string-equality
- * discipline {@link permissionModeAllowed} applies to `when`. `cfg ===
- * null` (block absent or malformed) means no auto-approval regardless of
- * the harness, and an unlisted harness means no auto-approval regardless
- * of `when` — the two allowlists are independent AND conditions, not
- * alternatives.
- *
- * Re-exported through `understanding-before-execution/index.ts` (round-2
- * review finding on slice 2): its call site (`src/cli/pack/auto-approve-path.ts`)
- * imports every sibling symbol it needs (`parseAutoApprove`,
- * `permissionModeAllowed`, ...) through the runtime shim already, so this
- * one was pulled onto the pinned shim surface
- * (tests/policy-packs/ube-export-surface.test.ts) to match, unlike
- * {@link CODEX_HARNESS} which still has exactly one consumer and stays a
- * direct import.
- */
-export declare function harnessAllowed(cfg: Pick<AutoApproveConfig, "harnesses"> | null, harness: unknown): boolean;

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js

@@ -1,361 +0,0 @@
-// `auto_approve` pack-config parsing and shared conventions, split out
-// alongside lifecycle.ts (structural sibling of the former monolithic
-// understanding-before-execution-runtime.ts, agent-tasks 348a4d42).
-// Implements slice 1 of docs/decisions/2026-08-27-ug-auto-mode-approval.md
-// (agent-tasks 74b4b17d): the strict pack-config block that lets an
-// operator opt a permission mode into the hook-written signed
-// auto-marker path, plus the shared `approvedBy` / ledger-tag
-// conventions the hook and doctor consume so there is one authority
-// for the string shapes instead of each caller reimplementing them.
-//
-// This module owns no gate decision and no marker write: it only
-// parses the opt-in config (fail-closed: any malformed shape is
-// treated as "not opted in", never as a partial default) and builds /
-// parses the string conventions the ADR's "Audit and doctor" section
-// documents. The PreToolUse hook (auto-path condition checks) and
-// `harness doctor` (auto-approval listing) are the consumers; both
-// land in later slice-1 tasks and import from here.
-//
-// Slice 3 (agent-tasks 37ad0b05) adds `report_scan.max_wait`: the bound
-// of the child's transcript poll under `claude -p` ("Report capture
-// under `-p`" in the ADR). It lives in this block because it tunes the
-// same opt-in path, and it is parsed here rather than at the hook so
-// the lint-time schema and the runtime hook agree on one parser.
-import { InvalidDurationError, parseDurationSeconds } from "../../../policies/index.js";
-/**
- * Prefix every auto-minted marker's `approvedBy` carries, distinguishing
- * it from a human `harness approve understanding` marker (which carries
- * the operator's own identity string, never this prefix).
- */
-export const AUTO_APPROVED_BY_PREFIX = "auto-mode:";
-/** The harness identifier the Claude Code PreToolUse hook mints markers for. */
-export const CLAUDE_CODE_HARNESS = "claude-code";
-/**
- * The harness identifier the Codex PreToolUse hook mints markers for
- * (slice 2 of the ADR: same auto path, same fail-closed conditions, a
- * distinct `approvedBy` segment so an audit can tell the two runtimes
- * apart). Deliberately NOT re-exported through
- * `understanding-before-execution/index.ts`: its only consumer is
- * `src/cli/pack/hook-codex-pre-tool-use.ts`, and widening the runtime
- * shim's pinned public surface (tests/policy-packs/ube-export-surface.test.ts)
- * is a separate, conscious act.
- */
-export const CODEX_HARNESS = "codex";
-/**
- * Build the `approvedBy` value the hook writes into a signed auto-marker:
- * `auto-mode:<harness>:<mode>`, for example `auto-mode:claude-code:bypassPermissions`
- * or `auto-mode:codex:bypassPermissions` ("Audit and doctor" in the ADR).
- * Neither `harness` nor `mode` is validated here; callers pass
- * already-known-good values (one of the fixed harness constants above and
- * a `when`-matched mode string).
- */
-export function autoApprovedByFor(harness, mode) {
-    return `${AUTO_APPROVED_BY_PREFIX}${harness}:${mode}`;
-}
-/**
- * Parse an `approvedBy` string back into its harness/mode pair. Returns
- * `null` for anything that is not exactly `auto-mode:<harness>:<mode>`
- * with both segments non-empty, including a human marker's `approvedBy`
- * (which never carries this prefix) and a malformed or truncated auto
- * value. A slice 3 delegation suffix (`;delegated:<parent-sid>`) is
- * tolerated: it is stripped before parsing and otherwise ignored, per
- * the ADR's "Audit and doctor" convention that the delegation binding
- * packs into the same field without changing the harness/mode shape.
- */
-export function parseAutoApprovedBy(approvedBy) {
-    if (typeof approvedBy !== "string")
-        return null;
-    if (!approvedBy.startsWith(AUTO_APPROVED_BY_PREFIX))
-        return null;
-    const withoutPrefix = approvedBy.slice(AUTO_APPROVED_BY_PREFIX.length);
-    const [withoutDelegation] = withoutPrefix.split(";delegated:");
-    const segments = (withoutDelegation ?? "").split(":");
-    if (segments.length !== 2)
-        return null;
-    const [harness, mode] = segments;
-    if (!harness || !mode)
-        return null;
-    return { harness, mode };
-}
-/**
- * Build the audit-only ledger fact the ADR's "Audit and doctor" section
- * names: `understanding-auto-approved:<sid>`, distinct from the human
- * `understanding-approved:<sid>` tag (`ledger.ts`), following the same
- * `...:forced:<field>` suffix precedent the ADR cites. Ledger only, never
- * consulted for the gate decision itself.
- */
-export function autoApprovedLedgerTagFor(sessionId) {
-    return `understanding-auto-approved:${sessionId}`;
-}
-/**
- * The harness identifiers `auto_approve.harnesses` accepts, in the order
- * the schema and every diagnostic list them. Shared with the pack's zod
- * `configSchema` (`../understanding-before-execution.ts`) so the lint-time
- * enum and this runtime parser cannot drift apart.
- */
-export const AUTO_APPROVE_HARNESS_VALUES = [CLAUDE_CODE_HARNESS, CODEX_HARNESS];
-/**
- * What `auto_approve.harnesses` resolves to when the key is ABSENT.
- * Claude Code only, deliberately: slice 1 shipped `auto_approve` as a
- * Claude-only opt-in, so a repo that opted in before slice 2 must keep
- * exactly the meaning it had — adding the Codex hook to the shared body
- * must not silently extend an existing opt-in to a second runtime
- * (reviewer round-1 finding on slice 2). Opting Codex in is an explicit,
- * visible config edit.
- */
-export const DEFAULT_AUTO_APPROVE_HARNESSES = [CLAUDE_CODE_HARNESS];
-/**
- * What `auto_approve.report_scan.max_wait` resolves to when the key is
- * ABSENT: the bound the child's PreToolUse hook waits for its own
- * Understanding Report to reach the session transcript before it blocks
- * (ADR "Report capture under `-p`", slice 3 acceptance criterion 3).
- *
- * The value is measured, not guessed: under `claude -p` the report is
- * absent from the transcript at the instant PreToolUse fires and lands
- * some time later, on a lag that scales with report length, so the
- * bound is set from the real end-to-end runs (a full-length grill_me
- * report), not only the shorter probe reports that first-guessed 500ms.
- * The measurement and the retuning derivation are both in
- * `docs/okf/understanding-gate-auto-mode-signals.md` ("Chosen
- * `report_scan.max_wait` default" section), from
- * `dogfood/ug-auto-mode-signals/`.
- *
- * ONE named constant on purpose: the hook, the schema default and every
- * test read this symbol, so re-tuning the bound against a new
- * measurement is a one-line change with no literal to hunt down.
- */
-export const DEFAULT_REPORT_SCAN_MAX_WAIT_MS = 2_000;
-/**
- * Hard ceiling for `auto_approve.report_scan.max_wait`. A larger value
- * is a `harness validate` schema error AND a runtime parse failure (which
- * fails the whole `auto_approve` block closed), so no configuration can
- * make a PreToolUse hook sit on a session for an arbitrary time. 5 s is
- * an order of magnitude above the measured worst-case flush, which is
- * generous for a bound whose only job is to cover a transcript write
- * already in flight.
- */
-export const REPORT_SCAN_MAX_WAIT_CEILING_MS = 5_000;
-const KNOWN_AUTO_APPROVE_KEYS = new Set([
-    "when",
-    "harnesses",
-    "require_report",
-    "report_scan",
-]);
-/** The only key `auto_approve.report_scan` accepts. */
-const KNOWN_REPORT_SCAN_KEYS = new Set(["max_wait"]);
-/** Sub-second shorthand the shared duration parser does not model. */
-const MILLISECOND_SHORTHAND = /^(\d+)ms$/;
-/**
- * Parse `auto_approve.report_scan.max_wait` into milliseconds.
- *
- * Duration grammar: the pack's SHARED parser
- * ({@link parseDurationSeconds}, the same one `approval_lifecycle.max_age`
- * uses), plus an `<n>ms` shorthand it does not model. The extension is
- * not cosmetic: this bound is a transcript-flush allowance measured in
- * tens of milliseconds, so a second-granularity grammar could not express
- * the values the measurement actually argues for, and widening
- * `parseDurationSeconds` itself would change the grammar of every
- * `within:` / `max_age:` / `--since` value in the repo for one key's sake.
- *
- * Both bounds are errors, never clamps: zero or negative (a bound that
- * would disable the poll while the block still claimed to have one) and
- * anything above {@link REPORT_SCAN_MAX_WAIT_CEILING_MS} (a bound that
- * could park a PreToolUse hook). Returning a RESULT rather than throwing
- * keeps the two consumers symmetric: the zod schema turns it into a
- * `harness validate` diagnostic, the runtime parser into one stderr line
- * and a fail-closed `null`.
- */
-export function parseReportScanMaxWait(raw) {
-    if (typeof raw !== "string" || raw.trim().length === 0) {
-        return {
-            ok: false,
-            reason: `expected a duration string like "500ms", "1500ms" or "2s", got ${typeof raw === "string" ? "an empty string" : typeof raw}`,
-        };
-    }
-    const trimmed = raw.trim();
-    let maxWaitMs;
-    const ms = MILLISECOND_SHORTHAND.exec(trimmed);
-    if (ms) {
-        maxWaitMs = Number.parseInt(ms[1], 10);
-    }
-    else {
-        try {
-            maxWaitMs = parseDurationSeconds(trimmed) * 1_000;
-        }
-        catch (err) {
-            return {
-                ok: false,
-                reason: err instanceof InvalidDurationError ? err.message : String(err),
-            };
-        }
-    }
-    if (!Number.isFinite(maxWaitMs) || maxWaitMs <= 0) {
-        return {
-            ok: false,
-            reason: `must be greater than zero, got ${JSON.stringify(trimmed)}`,
-        };
-    }
-    if (maxWaitMs > REPORT_SCAN_MAX_WAIT_CEILING_MS) {
-        return {
-            ok: false,
-            reason: `must not exceed the ${REPORT_SCAN_MAX_WAIT_CEILING_MS}ms hard ceiling (a PreToolUse hook must never park a session), got ${JSON.stringify(trimmed)}`,
-        };
-    }
-    return { ok: true, maxWaitMs };
-}
-/**
- * Parse the optional `auto_approve` pack-config block
- * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
- *
- * FAIL CLOSED, unlike {@link parseApprovalLifecycle}'s best-effort
- * fallback: this block is an opt-IN to a hook-side signing path
- * (hardening item 3 in the ADR's threat model (b) — `require_report:
- * false` must be a schema error, not a silently-ignored key), so any
- * malformed shape here means "not opted in" (`null`), never a partial
- * or default-filled config that could still enable the auto path. The
- * `configSchema` zod block in `../understanding-before-execution.ts` is
- * the first line of defence (`harness validate` / `harness doctor`
- * reject a malformed manifest at lint time); this parser is the second,
- * defensive line for the runtime hook, which must not trust that every
- * config it sees on disk passed the schema.
- *
- * `undefined` / `null` (the block is simply absent) returns `null`
- * silently — that is the ordinary "not opted in" case, not a warning.
- * Every other malformed shape writes exactly one stderr line and
- * returns `null`.
- *
- * `label` is the stderr prefix of the calling hook, so a Codex-side
- * warning reads `harness pack hook codex: ...` like every other line
- * that hook writes. The default reproduces the Claude Code hook's
- * wording byte-for-byte.
- */
-export function parseAutoApprove(raw, stderr, label = "harness pack hook") {
-    if (raw === undefined || raw === null)
-        return null;
-    if (typeof raw !== "object" || Array.isArray(raw)) {
-        stderr?.write(`${label}: config.auto_approve ignored (expected object, got ${typeof raw})\n`);
-        return null;
-    }
-    const obj = raw;
-    const unknownKeys = Object.keys(obj).filter((k) => !KNOWN_AUTO_APPROVE_KEYS.has(k));
-    if (unknownKeys.length > 0) {
-        stderr?.write(`${label}: config.auto_approve ignored (unknown key(s): ${unknownKeys.join(", ")})\n`);
-        return null;
-    }
-    const whenRaw = obj["when"];
-    if (!Array.isArray(whenRaw) || whenRaw.length === 0) {
-        stderr?.write(`${label}: config.auto_approve.when ignored (expected a non-empty string[], got ${Array.isArray(whenRaw) ? "empty array" : typeof whenRaw})\n`);
-        return null;
-    }
-    const when = [];
-    for (const v of whenRaw) {
-        if (typeof v !== "string" || v.length === 0) {
-            stderr?.write(`${label}: config.auto_approve.when ignored (every entry must be a non-empty string, got ${typeof v})\n`);
-            return null;
-        }
-        when.push(v);
-    }
-    // `harnesses`: absent means the slice-1 default (Claude Code only).
-    // Present means an exact, non-empty, duplicate-free list of the known
-    // harness identifiers — anything else fails the whole block closed,
-    // like every other malformed shape here, so a typo'd entry can never
-    // widen the opt-in to a runtime the operator did not name.
-    const harnessesRaw = obj["harnesses"];
-    let harnesses = [...DEFAULT_AUTO_APPROVE_HARNESSES];
-    if (harnessesRaw !== undefined) {
-        if (!Array.isArray(harnessesRaw) || harnessesRaw.length === 0) {
-            stderr?.write(`${label}: config.auto_approve.harnesses ignored (expected a non-empty array of ${AUTO_APPROVE_HARNESS_VALUES.join(" | ")}, got ${Array.isArray(harnessesRaw) ? "empty array" : typeof harnessesRaw})\n`);
-            return null;
-        }
-        const seen = [];
-        for (const v of harnessesRaw) {
-            if (typeof v !== "string" || !AUTO_APPROVE_HARNESS_VALUES.includes(v)) {
-                stderr?.write(`${label}: config.auto_approve.harnesses ignored (every entry must be one of ${AUTO_APPROVE_HARNESS_VALUES.join(", ")}, got ${typeof v === "string" ? `"${v}"` : typeof v})\n`);
-                return null;
-            }
-            if (seen.includes(v)) {
-                stderr?.write(`${label}: config.auto_approve.harnesses ignored (duplicate entry "${v}")\n`);
-                return null;
-            }
-            seen.push(v);
-        }
-        harnesses = seen;
-    }
-    // `report_scan`: absent means the measured default
-    // ({@link DEFAULT_REPORT_SCAN_MAX_WAIT_MS}). Present means an object
-    // carrying exactly `max_wait` and nothing else, parsed and
-    // range-checked by `parseReportScanMaxWait`. Anything else fails the
-    // WHOLE block closed, like every other malformed shape here, so a
-    // typo'd bound can never silently fall back to the default while the
-    // operator believes they tuned it.
-    const reportScanRaw = obj["report_scan"];
-    let reportScanMaxWaitMs = DEFAULT_REPORT_SCAN_MAX_WAIT_MS;
-    if (reportScanRaw !== undefined) {
-        if (reportScanRaw === null || typeof reportScanRaw !== "object" || Array.isArray(reportScanRaw)) {
-            stderr?.write(`${label}: config.auto_approve.report_scan ignored (expected object, got ${reportScanRaw === null ? "null" : Array.isArray(reportScanRaw) ? "array" : typeof reportScanRaw})\n`);
-            return null;
-        }
-        const reportScanObj = reportScanRaw;
-        const unknownScanKeys = Object.keys(reportScanObj).filter((k) => !KNOWN_REPORT_SCAN_KEYS.has(k));
-        if (unknownScanKeys.length > 0) {
-            stderr?.write(`${label}: config.auto_approve.report_scan ignored (unknown key(s): ${unknownScanKeys.join(", ")})\n`);
-            return null;
-        }
-        const maxWait = parseReportScanMaxWait(reportScanObj["max_wait"]);
-        if (!maxWait.ok) {
-            stderr?.write(`${label}: config.auto_approve.report_scan.max_wait ignored (${maxWait.reason})\n`);
-            return null;
-        }
-        reportScanMaxWaitMs = maxWait.maxWaitMs;
-    }
-    const requireReport = obj["require_report"];
-    if (requireReport !== true) {
-        stderr?.write(`${label}: config.auto_approve ignored (require_report must be true, got ${requireReport === false ? "false" : typeof requireReport})\n`);
-        return null;
-    }
-    return { when, harnesses, reportScan: { maxWaitMs: reportScanMaxWaitMs } };
-}
-/**
- * ADR "Additional hardening to specify" item 2: `when` is an allowlist
- * of payload literals, membership by exact string equality, no case
- * folding, no substring, no wildcards. `mode` absent, empty, or not a
- * string means no auto-approval, and `cfg === null` (block absent or
- * malformed) means no auto-approval regardless of `mode`.
- *
- * Takes only the `when` slice of the config rather than the whole block:
- * this predicate reads exactly one field, and saying so in the signature
- * keeps it honest as the block grows further keys (`harnesses`,
- * `report_scan`) that have nothing to do with mode membership.
- */
-export function permissionModeAllowed(cfg, mode) {
-    if (cfg === null)
-        return false;
-    if (typeof mode !== "string" || mode.length === 0)
-        return false;
-    return cfg.when.includes(mode);
-}
-/**
- * Per-harness opt-in membership, the same exact-string-equality
- * discipline {@link permissionModeAllowed} applies to `when`. `cfg ===
- * null` (block absent or malformed) means no auto-approval regardless of
- * the harness, and an unlisted harness means no auto-approval regardless
- * of `when` — the two allowlists are independent AND conditions, not
- * alternatives.
- *
- * Re-exported through `understanding-before-execution/index.ts` (round-2
- * review finding on slice 2): its call site (`src/cli/pack/auto-approve-path.ts`)
- * imports every sibling symbol it needs (`parseAutoApprove`,
- * `permissionModeAllowed`, ...) through the runtime shim already, so this
- * one was pulled onto the pinned shim surface
- * (tests/policy-packs/ube-export-surface.test.ts) to match, unlike
- * {@link CODEX_HARNESS} which still has exactly one consumer and stays a
- * direct import.
- */
-export function harnessAllowed(cfg, harness) {
-    if (cfg === null)
-        return false;
-    if (typeof harness !== "string" || harness.length === 0)
-        return false;
-    return cfg.harnesses.includes(harness);
-}
-//# sourceMappingURL=auto-approve.js.map

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auto-approve.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/auto-approve.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,oEAAoE;AACpE,8DAA8D;AAC9D,8DAA8D;AAC9D,oEAAoE;AACpE,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,+BAA+B,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAU,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,mBAAmB,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAuBrD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,WAAW;IACX,gBAAgB;IAChB,aAAa;CACd,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAErD,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAM1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kEACN,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,GACvD,EAAE;SACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,SAAiB,CAAC;IACtB,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,EAAE,EAAE,CAAC;QACP,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,+BAA+B,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,+BAA+B,sEAAsE,IAAI,CAAC,SAAS,CAChJ,OAAO,CACR,EAAE;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,MAA0C,EAC1C,KAAK,GAAG,mBAAmB;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,GAAG,KAAK,CAC/E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,kDAAkD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EACN,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,OAClD,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mFAAmF,OAAO,CAAC,KAAK,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAAS,GAAa,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EAA0E,2BAA2B,CAAC,IAAI,CAChH,KAAK,CACN,SAAS,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,YAAY,KAAK,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAU,CAAC,EAAE,CAAC;gBAC/E,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uEAAuE,2BAA2B,CAAC,IAAI,CAC7G,IAAI,CACL,SAAS,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAC3D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,6DAA6D,CAAC,MAAM,CAC7E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,mDAAmD;IACnD,qEAAqE;IACrE,2DAA2D;IAC3D,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,mBAAmB,GAAG,+BAA+B,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aACpF,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,aAAwC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,8DAA8D,eAAe,CAAC,IAAI,CACxF,IAAI,CACL,KAAK,CACP,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,CAAC,MAAM,KAAK,CACnF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aAC7C,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAA2C,EAC3C,IAAa;IAEb,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgD,EAChD,OAAgB;IAEhB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}