@scotthuang/agent-knock-knock 0.2.46 → 0.2.48

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.2.48 - 2026-07-23
+
+### Added
+
+- Add Node 22/24 CI, Dependabot coverage, contribution templates, and a social preview asset.
+
+### Changed
+
+- Refresh the README and project metadata around OpenClaw orchestration, ACPX delegation, and shared Codex/Claude tmux control.
+- Pin the default Codex ACP adapter to the tested `@agentclientprotocol/codex-acp@1.1.7` release and require Node.js 22.14+.
+- Keep the installed OpenClaw skill on token-free plugin callbacks instead of recommending the legacy direct-token script.
+
+### Fixed
+
+- Respect the configured default agent and custom store for `/akk` commands, preserve callback delivery for slash-command tmux sends, and keep agent-specific settings out of unrelated follow-ups.
+- Include native and terminal sessions in `/akk list`, resolve relative plugin stores from the configured workspace, and recognize Claude's native versioned executable path.
+- Reconcile eligible tmux monitors after Gateway restarts, prevent duplicate monitors, preserve wrapper process ancestry across list and takeover, and safely migrate exact legacy Codex terminal identities.
+- Make CLI help, version, doctor requirements, and failure exit status predictable.
+
+### Security
+
+- Require an exact live agent identity before tmux input, revalidate auto approvals inside the executor against the observed prompt, and avoid persisting unmanaged Claude hook payloads.
+- Recheck keys-mode approval fingerprints immediately before input and use tmux bracketed paste for multiline tasks.
+- Keep Gateway tokens out of normal plugin callbacks, coding-agent environments, CLI output, and child-process arguments.
+- Store local task data with private permissions, atomic state replacement, tokenized control locks, serialized stale-lock recovery and event writes, path-containment checks, and symlink rejection.
+- Refuse shared runtime-log directories without changing their permissions and append through no-follow file descriptors.
+
+## 0.2.47 - 2026-07-23
+
+### Added
+
+- Add tmux control for Claude Code, including discovery, safe idle-only sends, Hook-backed monitoring, structured allow/deny, and exact-rule auto approval.
+- Add an idempotent `install-claude-hooks` command that preserves existing Claude settings and hooks.
+
+### Fixed
+
+- Bind Claude permission and Stop/StopFailure events to strong runtime identity, terminal, conversation, message, and active lease; keep background work from completing early and deliver each terminal result once.
+- Show a redacted permission target summary, preserve conservative manual fallback for unverifiable dialogs, and normalize only the exact source-tagged Tokenjuice Claude wrapper for policy matching.
+
 ## 0.2.46 - 2026-07-22
 
 ### Added

package/README.md

@@ -1,17 +1,33 @@
-# agent-knock-knock
+# Agent Knock Knock (AKK)
+
+[![npm](https://img.shields.io/npm/v/%40scotthuang%2Fagent-knock-knock)](https://www.npmjs.com/package/@scotthuang/agent-knock-knock)
+[![CI](https://github.com/scotthuang/agent-knock-knock/actions/workflows/ci.yml/badge.svg)](https://github.com/scotthuang/agent-knock-knock/actions/workflows/ci.yml)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22.14-339933)](https://nodejs.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/scotthuang/agent-knock-knock/blob/main/LICENSE)
+
+Agent Knock Knock turns OpenClaw into a control plane for local coding agents: delegate new work, preserve task state for follow-ups, and route results back to the original chat—even on channels without threads.
 
 ![Agent Knock Knock cover: OpenClaw knocking on coding agents' door](docs/assets/agent-knock-knock-cover.jpg)
 
-Agent Knock Knock (AKK) lets OpenClaw delegate work to local Codex, Claude Code, and Cursor agents, preserve each task for follow-ups, and route results back to chat—even on channels without threads. It can also discover and safely take over native Codex sessions.
+AKK provides two complementary execution paths, plus Codex-native discovery and takeover:
+
+| Path | Use it for | Agents |
+| --- | --- | --- |
+| **ACPX / ACP** | Launch a new AKK-managed task with durable state and callbacks. | Codex, Claude Code, Cursor |
+| **tmux bridge (experimental)** | Hand an existing live CLI session between OpenClaw and a human without starting another coding-agent process. | Codex, Claude Code |
+| **Native discovery and takeover** | Discover, resume, or fork a local native session. | Codex |
+
+[ACPX](https://github.com/openclaw/acpx) is the ACP client AKK uses for managed delegation; it is independent of tmux. Claude hooks are required only for structured approval and completion handling in Claude Code tmux sessions. Cursor tmux control is [not yet supported](https://github.com/scotthuang/agent-knock-knock/issues/42).
 
 ## Install
 
 Requirements:
 
-- Node.js 20+
-- OpenClaw installed and running
+- Node.js 22.14+ (Node.js 24 recommended; use a version supported by your OpenClaw release)
+- [OpenClaw](https://docs.openclaw.ai/) Gateway and plugin API `2026.3.24-beta.2` or newer
 - [ACPX](https://github.com/openclaw/acpx) installed globally
 - At least one authenticated coding agent: Codex, Claude Code, or Cursor
+- For terminal control: a Unix-like host and `tmux`, with Codex or Claude Code running in a pane owned by the same user as OpenClaw
 
 ```bash
 npm install -g acpx
@@ -22,25 +38,51 @@ agent-knock-knock doctor
 
 `install-openclaw` installs or updates the plugin, enables it, installs the AKK skill template, and restarts the OpenClaw Gateway. It is safe to rerun. Use `--skill-only` to skip plugin installation; add `--no-restart` to skip the automatic Gateway restart.
 
+> **Security:** ACPX delegations currently run with `--approve-all`. Treat them as trusted local automation, set an explicit workspace, and review the coding agent's own sandbox and credentials. tmux approval handling is separate and fails closed; terminal auto-approval is disabled by default.
+
+AKK's normal plugin callback uses OpenClaw's own Gateway configuration and does not put the Gateway token in the coding-agent prompt or child-process arguments. Keep credentials out of a custom `callbackCommand`. The legacy direct CLI `--token` callback remains only for compatibility and embeds that credential in its callback command; do not use it for untrusted delegations.
+
+To control Claude Code in tmux, install AKK's structured hooks once:
+
+```bash
+agent-knock-knock install-claude-hooks
+```
+
+The installer merges AKK hooks into `~/.claude/settings.json` and preserves existing settings and hooks. Rerun it if the AKK executable path changes. It is not needed for ACPX delegation.
+
 If OpenClaw runs from a local checkout or another nonstandard location, pass its CLI explicitly:
 
 ```bash
 agent-knock-knock install-openclaw --openclaw-bin /path/to/openclaw/openclaw.mjs
 ```
 
-For local AKK development:
+## Quick Start
 
-```bash
-npm install
-npm run build
-node dist/src/cli.js install-openclaw
+First merge this configuration into `~/.openclaw/openclaw.json`, setting `workspace` to the absolute path of the project agents may modify:
+
+```json5
+// ~/.openclaw/openclaw.json
+{
+  plugins: {
+    entries: {
+      "agent-knock-knock": {
+        config: {
+          defaultAgent: "codex",
+          workspace: "/absolute/path/to/project"
+        }
+      }
+    }
+  }
+}
 ```
 
-Rerun the build and installer after pulling or editing plugin sources. OpenClaw loads the compiled files from `dist/`.
+Restart the Gateway after changing the configuration:
 
-## Quick Start
+```bash
+openclaw gateway restart
+```
 
-Start a task from an OpenClaw chat, then use its conversation ID for follow-ups:
+Then start a task from an OpenClaw chat and use the returned conversation ID for follow-ups:
 
 ```text
 AKK Codex: inspect this repository and summarize it
@@ -55,19 +97,21 @@ If no agent is named, AKK uses the configured `defaultAgent`, falling back to Co
 
 OpenClaw can spawn agents directly, but persistent sessions may depend on channel threads. WeChat and many direct-message surfaces do not provide that primitive. AKK keeps task state outside the chat channel so OpenClaw can recover, inspect, and continue coding-agent work from any supported surface.
 
-OpenClaw remains the orchestrator. AKK provides the plugin bridge, ACPX/ACP transport, durable task state, tmux terminal control, and structured callbacks.
+OpenClaw remains the orchestrator. AKK provides the plugin bridge, ACPX/ACP transport, durable task state, tmux terminal control, and structured callbacks. The tmux path is a handoff: avoid typing into a pane while AKK is driving the same turn.
 
 ```mermaid
 flowchart LR
   user["User / chat surface"] --> openclaw["OpenClaw"]
+  user <--> terminal["tmux terminal"]
   openclaw --> plugin["AKK plugin"]
   plugin --> state["Task state<br/>~/.agent-knock-knock"]
   plugin --> acpx["ACPX/ACP"]
-  plugin --> terminal["tmux terminal bridge"]
+  plugin <--> terminal
   acpx --> codex["Codex"]
   acpx --> claude["Claude Code"]
   acpx --> cursor["Cursor"]
   terminal --> codex
+  terminal --> claude
   codex --> plugin
   claude --> plugin
   cursor --> plugin
@@ -75,7 +119,7 @@ flowchart LR
   callback --> openclaw
 ```
 
-See [ROADMAP.md](ROADMAP.md) for planned reliability and orchestration work.
+See the [roadmap](https://github.com/scotthuang/agent-knock-knock/blob/main/ROADMAP.md) for planned reliability and orchestration work.
 
 ## Usage
 
@@ -108,28 +152,13 @@ Surfaces with native commands also support:
 
 ## Configuration
 
-Configure AKK under `plugins.entries.agent-knock-knock.config` in `~/.openclaw/openclaw.json`:
-
-```json5
-{
-  plugins: {
-    entries: {
-      "agent-knock-knock": {
-        config: {
-          defaultAgent: "codex",
-          workspace: "/Users/scott/project"
-        }
-      }
-    }
-  }
-}
-```
+Configure AKK under `plugins.entries.agent-knock-knock.config` in `~/.openclaw/openclaw.json`, as shown in the Quick Start.
 
 | Option | Default | Purpose |
 | --- | --- | --- |
 | `defaultAgent` | `codex` | Agent used when a request does not name one. |
 | `workspace` | OpenClaw process directory | Working directory for delegated tasks. |
-| `storeDir` | `~/.agent-knock-knock/conversations` | Conversation state location. |
+| `storeDir` | `~/.agent-knock-knock/conversations` | Conversation state location; relative plugin paths resolve from `workspace`. |
 | `openclawBin` | Auto-detected | OpenClaw CLI used for callback delivery. |
 | `codexAllProxy`, `cursorAllProxy`, `allProxy` | Unset | Per-agent or shared `ALL_PROXY` for ACPX launches. |
 | `codexModel`, `cursorModel`, `model` | Unset | Per-agent or shared ACPX model override. |
@@ -141,9 +170,9 @@ Configure AKK under `plugins.entries.agent-knock-knock.config` in `~/.openclaw/o
 
 See [`openclaw.plugin.json`](openclaw.plugin.json) for the complete schema and compatibility aliases.
 
-## Native Codex Takeover
+## Native Sessions and tmux Control
 
-Experimental: AKK can discover Codex CLI sessions started outside AKK. `AKK list` separates managed `delegated` tasks, discovered `native` sessions, and tmux-backed `terminal_controlled` sessions.
+Experimental: AKK can discover Codex CLI sessions started outside AKK and control Codex or Claude Code sessions in tmux. `AKK list` separates managed `delegated` tasks, discovered `native` sessions, and tmux-backed `terminal_controlled` sessions. Native stop/resume and fork takeover remain Codex-only.
 
 | Strategy | Behavior |
 | --- | --- |
@@ -151,24 +180,29 @@ Experimental: AKK can discover Codex CLI sessions started outside AKK. `AKK list
 | `AKK terminal takeover Codex <session-id>` | After confirmation, control the existing tmux session without stopping it. |
 | `AKK fork takeover Codex <session-id>` | Keep the original running and create a new task from an OpenClaw-approved summary. |
 
-A terminal-controlled ID works directly with `send`, `status`, `describe`, `cancel`, and `approve`. Monitoring is activity-aware and has a separate hard lifetime. Use `renew` for a stalled monitor and `retry-callback` if callback delivery remains failed.
+A terminal-controlled ID works directly with `send`, `status`, `describe`, and `cancel`. Claude accepts new messages only at a verified idle prompt. Codex visible prompts can also be approved directly. Claude structured approval and durable monitoring require a managed lease: use `send --background` first (the OpenClaw send tool already does this), then use the returned managed conversation ID with `approve`, `cancel`, or `status`. Monitoring is activity-aware, survives Gateway restarts when AKK can revalidate the exact task, and has a separate hard lifetime. Use `renew` for a stalled monitor and `retry-callback` if callback delivery remains failed.
 
-New terminal-controlled IDs use `terminal:v2:tmux:<agent>:<target>:<pid>`, for example `terminal:v2:tmux:codex:codex-work:0.1:33389`. Legacy `terminal:tmux:<target>:<pid>` IDs remain valid and are treated as Codex. The production terminal adapter registry currently includes Codex; other agents require their own adapter.
+New terminal-controlled IDs use `terminal:v2:tmux:<agent>:<target>:<pid>`, for example `terminal:v2:tmux:claude:claude-work:0.1:33389`. Legacy `terminal:tmux:<target>:<pid>` IDs remain valid and are treated as Codex. Cursor tmux sessions are not yet supported.
 
 Start sessions you may want to control remotely inside tmux:
 
 ```bash
 tmux new -s codex-work
 codex
+
+tmux new -s claude-work
+claude
 ```
 
-Avoid opening a second live client on the same Codex session; concurrent clients can produce inconsistent visible history.
+For Claude Code, `send --background` creates the managed lease that binds hook events to the exact session, terminal, conversation, and message. A `Stop` event produces one callback from `last_assistant_message` only after background tasks and scheduled jobs have finished; `StopFailure` produces an actionable error. If hooks are unavailable or identity is stale or ambiguous, AKK can still discover, send, and inspect through tmux, but it will not approve or claim durable completion. `cancel` uses Escape only when no unverified permission dialog is visible; unsafe dialogs must be resolved manually in the terminal.
+
+Avoid opening a second live client on the same agent session; concurrent clients can produce inconsistent visible history.
 
 ## Approvals
 
 AKK runs ACPX-backed agents with `--approve-all`. Claude Code surfaces permission requests through ACPX, but some Codex sandbox-sensitive operations fail directly. Keep Codex background work inside its workspace, or prefer Claude Code when a task requires ACPX-approved access elsewhere.
 
-For tmux-backed Codex, AKK reports visible approval prompts through OpenClaw. Use `AKK approve <conversation-id>` to continue or `AKK cancel <conversation-id>` to deny and stop.
+For tmux-backed Codex, AKK reports visible approval prompts. For Claude Code, the installed hook reports structured `PermissionRequest` events and AKK shows the tool name plus a redacted, bounded target summary without copying the full tool input. Inspect the current request through OpenClaw, then use `AKK approve <conversation-id>` to allow it or `AKK cancel <conversation-id>` to deny and stop. Unknown, stale, or ambiguous requests are never approved or interrupted by synthetic keys; resolve those dialogs manually in the terminal.
 
 Trusted terminal commands can be auto-approved with a deterministic policy:
 
@@ -177,8 +211,8 @@ autoApprove: {
   enabled: true,
   rules: [{
     id: "project-read-status",
-    agents: ["codex"],
-    workspaces: ["/Users/scott/project"],
+    agents: ["codex", "claude"],
+    workspaces: ["/absolute/path/to/project"],
     commands: [
       ["pwd"],
       ["git", "status"],
@@ -188,21 +222,23 @@ autoApprove: {
 }
 ```
 
-Place `autoApprove` inside the plugin `config` object. It is disabled by default and applies only to exact Codex `run command` argument vectors inside configured workspaces. Shell composition, substitutions, globs, environment assignments, unparseable commands, and out-of-workspace paths always require user approval. AKK rechecks the visible prompt immediately before approval and records the matched rule and policy fingerprint.
+Place `autoApprove` inside the plugin `config` object. It is disabled by default and applies only to exact Codex run-command or Claude Code `Bash` argument vectors inside configured workspaces. Shell composition, substitutions, globs, environment assignments, unparseable commands, and out-of-workspace paths always require user approval. AKK revalidates the current request immediately before approval and records the matched rule and policy fingerprint. Enable it only with a trusted `PATH` and workspace: rules match command arguments, not executable hashes.
 
 ## Troubleshooting
 
-Start with `agent-knock-knock doctor`. It checks Node.js, OpenClaw, ACPX, at least one supported coding-agent command, and the packaged plugin files. The OpenClaw CLI must be on `PATH` or in a common user install directory for this check.
+Start with `agent-knock-knock doctor`. It checks for Node.js 22.14+, OpenClaw, ACPX, at least one supported coding-agent command, and the packaged plugin files. It does not authenticate an agent, verify live Gateway/plugin connectivity, or run a real delegation. The OpenClaw CLI must be on `PATH` or in a common user install directory for this check.
 
 | Symptom | Action |
 | --- | --- |
 | Installer or callbacks cannot find a local OpenClaw CLI | Set `openclawBin` and pass `--openclaw-bin` to `install-openclaw`. |
 | Source changes do not appear | Build, reinstall from the checkout, and restart the Gateway. |
-| Terminal bridge task is `stalled` | Run `AKK renew <conversation-id> --minutes <minutes>`. |
+| Terminal bridge task is `stalled` | Run `/akk renew <conversation-id> <minutes>` in a native-command chat, or ask OpenClaw to renew it. |
 | ACPX task is `stalled` | Inspect `status --trace`; close and redelegate if the executor cannot continue. |
-| Task is `callback_failed` | Run `AKK retry-callback <conversation-id>`. |
+| Task is `callback_failed` | Run `/akk retry-callback <conversation-id>` in a native-command chat. |
 | Codex delegation rejects the deprecated adapter | Remove the old override or select a supported adapter as described below. |
-| Terminal takeover is unavailable | Run Codex inside tmux and check `AKK list` for a `terminal_controlled` entry. |
+| Terminal takeover is unavailable | Run Codex or Claude Code inside tmux and check `AKK list` for a `terminal_controlled` entry. |
+| An upgraded tmux task reports no exact agent PID | List the live terminal session and attach it again; AKK migrates only an unambiguous legacy Codex session/pane match. |
+| Claude permission or completion is not detected | Run `agent-knock-knock install-claude-hooks`, then retry in the managed tmux session. |
 
 For local diagnostics, use:
 
@@ -214,7 +250,7 @@ agent-knock-knock list --managed-only # skip native and terminal discovery
 
 ### Codex ACP Adapter
 
-Codex delegation uses `npx -y @agentclientprotocol/codex-acp@^1.1.0` by default and rejects the deprecated `@zed-industries/codex-acp`. The first run may take longer while `npx` downloads the adapter. To select another compatible adapter, set this in the environment that runs OpenClaw/AKK:
+Codex delegation uses the tested, pinned adapter `npx -y @agentclientprotocol/codex-acp@1.1.7` by default and rejects the deprecated `@zed-industries/codex-acp`. The first run may take longer while `npx` downloads the adapter. To select another compatible adapter, set this in the environment that runs OpenClaw/AKK:
 
 ```bash
 export AKK_CODEX_ACPX_AGENT_COMMAND='your-compatible-adapter-command'
@@ -231,7 +267,9 @@ npm run simulate:weather
 npm run transcript -- --conversation ~/.agent-knock-knock/conversations/<conversation-id>
 ```
 
-Pass `--include-raw` to the transcript command only when debugging model exchange events. See [CONTRIBUTING.md](CONTRIBUTING.md) for the development and pull request workflow.
+Pass `--include-raw` to the transcript command only when debugging model exchange events. See [CONTRIBUTING.md](https://github.com/scotthuang/agent-knock-knock/blob/main/CONTRIBUTING.md) for the development and pull request workflow.
+
+For local OpenClaw testing, run `node dist/src/cli.js install-openclaw` after each build or plugin-source update. OpenClaw loads the compiled files from `dist/`.
 
 ## Storage and Logs
 
@@ -246,26 +284,26 @@ Pass `--include-raw` to the transcript command only when debugging model exchang
     runtime-YYYY-MM-DD.ndjson
 ```
 
-Use `--store-dir <dir>` to override the conversation store; `--log-dir` remains a compatibility alias. Agent output and runtime logs are diagnostic-only and are not part of OpenClaw-agent communication.
+Use `--store-dir <dir>` to override the conversation store with a dedicated private directory; `--log-dir` remains a compatibility alias. Agent output and runtime logs are diagnostic-only and are not part of OpenClaw-agent communication.
 
-Runtime logs use local timestamps, redact common secrets, and are cleaned by retention policy. Configure them with `AKK_LOG_DIR`, `AKK_LOG_LEVEL`, and `AKK_LOG_RETENTION_DAYS`. Defaults are `~/.agent-knock-knock/logs` and 14 days.
+AKK keeps its store and conversation directories at `0700` and state, event, agent-output, and runtime-log files at `0600`. Runtime logs use local timestamps, redact common secrets, and are cleaned by retention policy. Configure them with `AKK_LOG_DIR`, `AKK_LOG_LEVEL`, and `AKK_LOG_RETENTION_DAYS`. Defaults are `~/.agent-knock-knock/logs` and 14 days. A custom `AKK_LOG_DIR` must be empty or dedicated to AKK; shared directories are rejected without changing their permissions.
 
 ## Release
 
-`package.json` is the version source. Create a release with npm's version command, then push the commit and tag:
+`package.json` is the version source. Update it, `package-lock.json`, and the changelog in the release PR. After that commit reaches `main`, tag the exact version:
 
 ```bash
-npm version patch # or minor / major
-git push
-git push --tags
+AKK_RELEASE_VERSION="$(node -p "require('./package.json').version")"
+git tag "v${AKK_RELEASE_VERSION}"
+git push origin "v${AKK_RELEASE_VERSION}"
 ```
 
 Tags matching `v*` run the release workflow, which tests the package, publishes it to npm, and creates a GitHub Release. Publishing requires an `NPM_TOKEN` repository secret.
 
 ## Security
 
-Do not open public issues for sensitive security reports. See [SECURITY.md](SECURITY.md).
+Do not open public issues for sensitive security reports. See the [security policy](https://github.com/scotthuang/agent-knock-knock/blob/main/SECURITY.md).
 
 ## License
 
-MIT. See [LICENSE](LICENSE).
+MIT. See [LICENSE](https://github.com/scotthuang/agent-knock-knock/blob/main/LICENSE).

package/dist/src/approval-policy.d.ts

@@ -1,6 +1,7 @@
 export interface ApprovalCandidate {
     agent: string;
     kind: string;
+    decisionMode?: "keys" | "structured";
     command?: string;
     cwd?: string;
     fingerprint: string;
@@ -32,10 +33,11 @@ export declare function evaluateApprovalPolicy({ policy, candidate }: {
     policy: unknown;
     candidate: ApprovalCandidate;
 }): ApprovalPolicyDecision;
-export declare function autoApprovalCliArgs({ statePath, candidate, decision }: {
+export declare function autoApprovalCliArgs({ statePath, candidate, decision, policy }: {
     statePath: string;
     candidate: ApprovalCandidate;
     decision: ApprovalPolicyDecision;
+    policy: unknown;
 }): string[] | undefined;
 export declare function attemptAutoApproval({ message, policy, statePath, execute }: {
     message: unknown;

package/dist/src/approval-policy.js

@@ -23,6 +23,9 @@ export function approvalCandidateFromMessage(message) {
         agent,
         kind,
         fingerprint,
+        ...(candidate?.decision_mode === "structured" || candidate?.decision_mode === "keys"
+            ? { decisionMode: candidate.decision_mode }
+            : {}),
         command: stringValue(candidate?.command),
         cwd: stringValue(candidate?.cwd),
         terminalTarget: stringValue(candidate?.terminal_target)
@@ -36,6 +39,9 @@ export function evaluateApprovalPolicy({ policy, candidate }) {
     if (candidate.kind !== "run_command") {
         return ask(`approval kind is not supported: ${candidate.kind}`, policyFingerprint);
     }
+    if (candidate.agent === "claude" && candidate.decisionMode !== "structured") {
+        return ask("Claude auto approval requires a structured hook request", policyFingerprint);
+    }
     if (!candidate.command) {
         return ask("approval command is unavailable", policyFingerprint);
     }
@@ -72,8 +78,12 @@ export function evaluateApprovalPolicy({ policy, candidate }) {
     }
     return ask("no explicit auto-approval rule matched", policyFingerprint, parsed.argv);
 }
-export function autoApprovalCliArgs({ statePath, candidate, decision }) {
-    if (decision.action !== "approve" || !decision.ruleId || !statePath) {
+export function autoApprovalCliArgs({ statePath, candidate, decision, policy }) {
+    const serializedPolicy = JSON.stringify(policy);
+    if (decision.action !== "approve" ||
+        !decision.ruleId ||
+        !statePath ||
+        typeof serializedPolicy !== "string") {
         return undefined;
     }
     return [
@@ -86,7 +96,9 @@ export function autoApprovalCliArgs({ statePath, candidate, decision }) {
         "--policy-rule-id",
         decision.ruleId,
         "--policy-fingerprint",
-        decision.policyFingerprint
+        decision.policyFingerprint,
+        "--auto-approval-policy-json",
+        serializedPolicy
     ];
 }
 export function attemptAutoApproval({ message, policy, statePath, execute }) {
@@ -95,7 +107,9 @@ export function attemptAutoApproval({ message, policy, statePath, execute }) {
         return undefined;
     }
     const decision = evaluateApprovalPolicy({ policy, candidate });
-    const cliArgs = statePath ? autoApprovalCliArgs({ statePath, candidate, decision }) : undefined;
+    const cliArgs = statePath
+        ? autoApprovalCliArgs({ statePath, candidate, decision, policy })
+        : undefined;
     if (!cliArgs || !decision.ruleId) {
         return {
             approved: false,

package/dist/src/approval-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmC7B,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IACE,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,QAAQ,EAAE,MAAM,KAAK,iBAAiB;QACtC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,WAAW;QACX,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;QACxC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC;QAChC,cAAc,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,SAAS,EAIV;IACC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,GAAG,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,mCAAmC,SAAS,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,sCAAsC,EAAE,iBAAiB,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAK,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8BAA8B,IAAI,CAAC,EAAE,EAAE;YAC/C,iBAAiB;YACjB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,wCAAwC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,SAAS,EACT,QAAQ,EAKT;IACC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,iCAAiC;QACjC,SAAS,CAAC,WAAW;QACrB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ,CAAC,MAAM;QACf,sBAAsB;QACtB,QAAQ,CAAC,iBAAiB;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EACT,OAAO,EAMR;IACC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;YAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;QAClC,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;QACrD,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;YAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,qCAAqC;QACvE,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;QAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;QAC3C,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAE3C,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzD,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACzD,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,IAAI,IAAI,CAAC;QACd,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IAMnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAuB,EAAE,CAAC,CACxD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAClG,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;IACrF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACzF,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAe;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,iBAAyB,EAAE,IAAe;IACrE,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM;QACN,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAoC7B,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IACE,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,QAAQ,EAAE,MAAM,KAAK,iBAAiB;QACtC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,WAAW;QACX,GAAG,CAAC,SAAS,EAAE,aAAa,KAAK,YAAY,IAAI,SAAS,EAAE,aAAa,KAAK,MAAM;YAClF,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;QACxC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC;QAChC,cAAc,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,SAAS,EAIV;IACC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,GAAG,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,mCAAmC,SAAS,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QAC5E,OAAO,GAAG,CAAC,yDAAyD,EAAE,iBAAiB,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,sCAAsC,EAAE,iBAAiB,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAK,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8BAA8B,IAAI,CAAC,EAAE,EAAE;YAC/C,iBAAiB;YACjB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,wCAAwC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,SAAS,EACT,QAAQ,EACR,MAAM,EAMP;IACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IACE,QAAQ,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,QAAQ,CAAC,MAAM;QAChB,CAAC,SAAS;QACV,OAAO,gBAAgB,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,iCAAiC;QACjC,SAAS,CAAC,WAAW;QACrB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ,CAAC,MAAM;QACf,sBAAsB;QACtB,QAAQ,CAAC,iBAAiB;QAC1B,6BAA6B;QAC7B,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EACT,OAAO,EAMR;IACC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;YAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;QAClC,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;QACrD,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;YAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,qCAAqC;QACvE,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;QAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;QAC3C,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAE3C,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzD,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACzD,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,IAAI,IAAI,CAAC;QACd,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IAMnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAuB,EAAE,CAAC,CACxD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAClG,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;IACrF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACzF,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAe;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,iBAAyB,EAAE,IAAe;IACrE,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM;QACN,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/src/claude-hook-installer.d.ts

@@ -0,0 +1,65 @@
+export declare const CLAUDE_HOOK_EVENT_NAMES: readonly ["SessionStart", "UserPromptSubmit", "PermissionRequest", "Stop", "StopFailure", "Notification"];
+export type InstalledClaudeHookEventName = typeof CLAUDE_HOOK_EVENT_NAMES[number];
+export interface InstallClaudeHooksOptions {
+    /** Absolute path to the agent-knock-knock executable. */
+    executablePath: string;
+    /** Defaults to ~/.claude/settings.json. */
+    settingsPath?: string;
+    /** Computes and returns a summary without creating or changing any files. */
+    dryRun?: boolean;
+    /** Injectable for deterministic backup names in tests. */
+    now?: () => Date;
+}
+export interface ClaudeHookInstallSummary {
+    addedCount: number;
+    existingCount: number;
+    warningCount: number;
+}
+export interface InstallClaudeHooksResult {
+    settingsPath: string;
+    changed: boolean;
+    written: boolean;
+    dryRun: boolean;
+    created: boolean;
+    backupPath?: string;
+    addedEvents: InstalledClaudeHookEventName[];
+    existingEvents: InstalledClaudeHookEventName[];
+    warnings: string[];
+    summary: ClaudeHookInstallSummary;
+}
+export interface MergeClaudeHookSettingsResult {
+    settings: Record<string, unknown>;
+    changed: boolean;
+    addedEvents: InstalledClaudeHookEventName[];
+    existingEvents: InstalledClaudeHookEventName[];
+    warnings: string[];
+}
+export interface TrustedClaudeTokenjuiceLauncher {
+    /** Exact absolute path configured by the trusted Claude PreToolUse hook. */
+    configuredPath: string;
+    /** Canonical target observed while loading that configuration. */
+    canonicalPath: string;
+}
+/** Returns Claude Code's user settings path without reading it. */
+export declare function defaultClaudeSettingsPath(): string;
+/**
+ * Reads only Tokenjuice launcher provenance from Claude's trusted user settings.
+ * Invalid, missing, non-executable, or relative launchers are ignored so approval
+ * normalization fails closed without exposing settings contents.
+ */
+export declare function loadTrustedClaudeTokenjuiceLaunchers(settingsPath?: string): TrustedClaudeTokenjuiceLauncher[];
+export declare function extractClaudeTokenjuiceLaunchers(settingsValue: unknown): string[];
+/**
+ * Adds AKK matcher groups without mutating the supplied settings object.
+ * Existing groups and sibling handlers are retained byte-for-byte when the
+ * result is serialized, apart from JSON's normal formatting.
+ */
+export declare function mergeClaudeHookSettings(settingsValue: unknown, executablePathValue: string): MergeClaudeHookSettingsResult;
+/**
+ * Safely installs Claude Code user hooks. This function does not log settings
+ * contents and its result contains only paths, event names, counts, and
+ * non-sensitive warnings.
+ */
+export declare function installClaudeHooks(options: InstallClaudeHooksOptions): InstallClaudeHooksResult;
+/** Compatibility-friendly explicit name for callers wiring an install command. */
+export declare const installClaudeHookSettings: typeof installClaudeHooks;