@scotthuang/agent-knock-knock 0.2.50 → 0.3.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.3.0-beta.1 - 2026-07-28
+
+### Added
+
+- Add ClawHub package metadata, bundled skill discovery, a square catalog icon, and a package-local OpenClaw runtime entry.
+- Add manifest/runtime contract tests and a ClawHub validation and dry-run release path.
+
+### Changed
+
+- Compile against the tested OpenClaw `2026.7.1-2` SDK instead of a handwritten type shim.
+- Separate ClawHub and npm installation guidance, including the explicit optional-tool grant required by a clean OpenClaw profile.
+- Publish prerelease builds to npm's `next` dist-tag and mark their GitHub releases as prereleases.
+
+### Fixed
+
+- Align the declared `/akk` command, bundled skill, and tool inventory with the capabilities registered at runtime.
+- Resolve the bundled CLI relative to the loaded plugin entry so ClawHub installs do not depend on a global executable.
+
+## 0.2.51 - 2026-07-25
+
+### Added
+
+- Add disabled-by-default exact command and workspace auto-approval for hookless Claude Code tmux turns by intersecting the current one-time Bash dialog with owner-private local transcript evidence.
+
+### Changed
+
+- Allow trusted `autoApprove` rules to target Claude as well as Codex, while leaving unmatched, unsupported, or ambiguous requests on the manual approval path.
+
+### Fixed
+
+- Deliver Gateway callback attempts outside conversation locks and recover interrupted approval-notification outboxes with stable message identities without duplicating message events.
+- Preserve terminal monitor ownership across inline auto-approval, callback retries, and post-delivery crashes, and track consumed Claude dialogs by transcript request identity plus an observed prompt-generation boundary so redraws cannot replay Enter while later identical requests remain approvable.
+
+### Security
+
+- Keep raw Claude commands executor-local and expose only bounded hashes and opaque identities through callbacks, state, events, logs, and screen summaries.
+- Re-evaluate the exact policy and recapture the prompt, selected one-time action, transcript evidence, and process identity after the one-shot dispatch reservation before sending one Enter; stale, changed, replayed, or uncertain requests fail closed.
+- Restrict pending-approval transcript evidence to compatible Claude Code `2.1.x` releases at `2.1.198` or later while retaining forward-compatible durable completion detection.
+
 ## 0.2.50 - 2026-07-24
 
 ### Changed

package/README.md

@@ -5,7 +5,21 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22.14-339933)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/scotthuang/agent-knock-knock/blob/main/LICENSE)
 
-Agent Knock Knock connects OpenClaw to local coding agents. Share a live terminal through tmux, delegate managed work through ACP, and continue the same task from chat or the terminal.
+Agent Knock Knock lets you control local Codex and Claude Code from any configured OpenClaw channel, then take over the same live tmux session without losing context. For managed background work, Managed ACP (via ACPX) also supports Cursor.
+
+**Local-first, with no hosted control plane or telemetry. tmux mode keeps the coding agent's existing permission settings; Managed ACP uses a separate background permission model.**
+
+## See It in Action
+
+[![AKK orchestrating a Claude Code-to-Codex handoff through tmux](docs/assets/akk-tmux-handoff-demo.gif)](docs/assets/akk-tmux-handoff-demo.mp4)
+
+*OpenClaw asks Claude Code to write a file, waits for AKK to report completion, then hands the result to Codex. Both terminals remain available for direct human takeover. The demo uses the agents' existing permission settings; AKK does not switch them. Click the preview to watch in full quality.*
+
+## Use Cases
+
+**Delegate from anywhere.** Use any configured OpenClaw channel to hand work to a local coding agent wherever you are. AKK keeps the task running outside the chat, reports when the agent needs input or finishes, and lets you continue from chat or the shared terminal.
+
+**Orchestrate specialist agents.** OpenClaw can coordinate agent handoffs: Claude Code can plan, Codex can implement, and Claude Code can review. In tmux mode, AKK can also automatically approve trusted permission requests under rules you define. At any point, you can take over the shared terminal, keep working yourself, then hand the same task back to OpenClaw—with context intact.
 
 ![Agent Knock Knock cover: OpenClaw knocking on coding agents' door](docs/assets/agent-knock-knock-cover.jpg)
 
@@ -13,32 +27,53 @@ Agent Knock Knock connects OpenClaw to local coding agents. Share a live termina
 
 | Mode | Best for | Agents | Requires |
 | --- | --- | --- | --- |
-| **tmux bridge (recommended, experimental)** | Share one live CLI session. OpenClaw and a human can hand the task back and forth. | Codex, Claude Code | `tmux` |
+| **tmux bridge (recommended)** | Share one live CLI session. OpenClaw and a human can hand the task back and forth. | Codex, Claude Code | `tmux` |
 | **Managed ACP** | Start background tasks with durable ACP state and callbacks. | Codex, Claude Code, Cursor | [ACPX](https://github.com/openclaw/acpx) |
 
 Install either mode or both. tmux does not require ACPX. Cursor tmux control is [not yet supported](https://github.com/scotthuang/agent-knock-knock/issues/42). AKK can also discover, resume, or fork local Codex sessions; that is a Codex capability, not a third installation mode.
 
+### Permission Boundaries
+
+The two modes intentionally use different permission models:
+
+- **tmux bridge:** AKK does not change the coding agent's configured permission mode. For supported prompts in an AKK-managed turn, disabled-by-default exact-command rules may auto-approve a trusted request; unmatched or uncertain requests stay manual.
+- **Managed ACP:** AKK starts ACPX-backed agents with `--approve-all`; the tmux prompt inspection and exact-command `autoApprove` policy do not apply to this mode. Claude Code may still surface permission requests through ACPX, while some Codex sandbox-sensitive operations fail directly. Keep managed work inside an explicit workspace.
+
 ## Install
 
 Core requirements:
 
 - Node.js 22.14+ (Node.js 24 recommended; use a version supported by your OpenClaw release)
-- [OpenClaw](https://docs.openclaw.ai/) Gateway and plugin API `2026.3.24-beta.2` or newer
+- [OpenClaw](https://docs.openclaw.ai/) Gateway and plugin API `2026.7.1-2` or newer
 - At least one authenticated coding agent: Codex, Claude Code, or Cursor
 
+### Install from ClawHub (recommended)
+
 ```bash
-npm install -g @scotthuang/agent-knock-knock
-agent-knock-knock install-openclaw
+openclaw plugins install clawhub:@scotthuang/agent-knock-knock@beta
+openclaw gateway restart
 ```
 
-`install-openclaw` installs or updates the plugin, enables it, installs the AKK skill template, and restarts the OpenClaw Gateway. It is safe to rerun. Use `--skill-only` to skip plugin installation; add `--no-restart` to skip the automatic Gateway restart.
+The explicit `@beta` selector follows the `0.3.0` prerelease channel. Remove it after the stable ClawHub release is available.
+
+ClawHub installs the OpenClaw plugin, bundled AKK skill, and package-local relay CLI together. OpenClaw invokes that bundled CLI directly, but ClawHub does not add the `agent-knock-knock` command to your shell `PATH`. Do not run `install-openclaw` after a ClawHub install; that command belongs to the npm installation path below and would repeat the plugin setup.
+
+If you also want standalone shell commands such as `agent-knock-knock doctor`, install the npm package globally without running `install-openclaw`:
 
-Then enable at least one execution mode:
+```bash
+npm install -g @scotthuang/agent-knock-knock@next
+```
+
+### Install from npm (beta)
+
+```bash
+npm install -g @scotthuang/agent-knock-knock@next
+agent-knock-knock install-openclaw
+```
 
-- **tmux (recommended):** install `tmux` on a Unix-like host and run Codex or Claude Code in a pane owned by the same user as OpenClaw.
-- **Managed ACP:** install ACPX with `npm install -g acpx`.
+The npm `next` dist-tag follows the same prerelease line. Remove `@next` after `0.3.0` becomes stable.
 
-Claude tmux support requires no hooks and does not modify Claude Code settings. Hook-free completion monitoring is verified on Claude Code `2.1.198` and `2.1.218`; newer versions are accepted when their interactive transcripts preserve the required identity and completion structure.
+`install-openclaw` installs or updates the plugin, enables it, installs the AKK skill template, and restarts the OpenClaw Gateway. It is safe to rerun. Use `--skill-only` to skip plugin installation; add `--no-restart` to skip the automatic Gateway restart.
 
 If OpenClaw runs from a local checkout or another nonstandard location, pass its CLI explicitly:
 
@@ -46,21 +81,72 @@ If OpenClaw runs from a local checkout or another nonstandard location, pass its
 agent-knock-knock install-openclaw --openclaw-bin /path/to/openclaw/openclaw.mjs
 ```
 
-Finally, check which modes are ready:
+AKK's agent tools are optional and require an explicit OpenClaw tool-policy opt-in. If you use the default `coding` profile and do not already have `tools.allow`, add AKK without replacing the profile:
+
+```json5
+{
+  tools: {
+    profile: "coding",
+    alsoAllow: ["agent-knock-knock"]
+  }
+}
+```
+
+If your configuration already has a restrictive `tools.allow` list, add `"agent-knock-knock"` to that existing list instead. Do not set `allow` and `alsoAllow` at the same scope.
+
+Choose one execution mode, or install both.
+
+### Option A: tmux bridge (recommended)
+
+Install tmux on macOS:
+
+```bash
+brew install tmux
+```
+
+Or on Debian/Ubuntu:
+
+```bash
+sudo apt-get install tmux
+```
+
+Then start a shared terminal session:
+
+```bash
+tmux new -s coding
+```
+
+Run `codex` or `claude` inside the tmux session. AKK will discover it automatically when OpenClaw and the coding agent run as the same user.
+
+Claude tmux support requires no hooks and does not modify Claude Code settings. Hook-free completion monitoring is verified on Claude Code `2.1.198` and `2.1.218`; newer versions remain eligible when their interactive transcripts preserve the required identity and completion structure. Hookless auto-approval is deliberately narrower: approval evidence currently requires Claude Code `2.1.x` at `2.1.198` or later, and any other version falls back to manual handling.
+
+### Option B: Managed ACP
+
+Install ACPX:
+
+```bash
+npm install -g acpx
+```
+
+AKK uses ACPX to start managed Codex, Claude Code, or Cursor sessions from OpenClaw.
+
+Finally, check which modes are ready if the global CLI is installed:
 
 ```bash
 agent-knock-knock doctor
 ```
 
-### Trust and Privacy
+For a ClawHub-only installation, verify that OpenClaw loaded the packaged runtime:
 
-AKK is local-first: its state, logs, and terminal control stay on your machine. AKK has no hosted control plane or telemetry, and its tmux integration does not modify coding-agent settings.
+```bash
+openclaw plugins inspect agent-knock-knock --runtime
+```
 
-For a managed Claude tmux turn, AKK reads only the bytes appended to Claude Code's owner-private local JSONL transcript after the send boundary. It uses them locally to bind the exact prompt and extract a redacted final answer; it does not upload the transcript or persist a copy of its raw contents. The final answer still travels through your configured local OpenClaw callback.
+### Trust and Privacy
 
-This does not mean task content can never leave the machine. OpenClaw and each coding agent or model provider still process content according to your configuration. Managed ACP tasks currently use ACPX `--approve-all`; treat them as trusted automation, set an explicit workspace, and review the agent's sandbox and credentials.
+AKK is local-first. It has no hosted control plane or telemetry, does not modify coding-agent settings, and keeps its state, logs, terminal control, and approval decisions on your machine. Sensitive approval commands are never included in callbacks or AKK logs.
 
-AKK's normal callback uses the OpenClaw Gateway configuration without putting its token in the agent prompt or child-process arguments. Keep credentials out of a custom `callbackCommand`. The legacy direct CLI `--token` callback embeds that credential in its callback command and should not be used for untrusted delegations.
+Your task content is still processed by OpenClaw and the coding-agent or model providers you configure. Use explicit workspaces, review agent permissions, and keep secrets out of custom callback commands.
 
 ## Quick Start
 
@@ -69,6 +155,10 @@ First merge this configuration into `~/.openclaw/openclaw.json`, setting `worksp
 ```json5
 // ~/.openclaw/openclaw.json
 {
+  tools: {
+    profile: "coding",
+    alsoAllow: ["agent-knock-knock"]
+  },
   plugins: {
     entries: {
       "agent-knock-knock": {
@@ -142,6 +232,14 @@ Surfaces with native commands use the same operations:
 /akk close <conversation-id> [reason]
 ```
 
+Codex CLI sessions started outside AKK can also be resumed, opened in a terminal, or forked:
+
+```text
+AKK takeover Codex <session-id>
+AKK terminal takeover Codex <session-id>
+AKK fork takeover Codex <session-id>
+```
+
 ## Configuration
 
 Configure AKK under `plugins.entries.agent-knock-knock.config` in `~/.openclaw/openclaw.json`, as shown in the Quick Start.
@@ -158,24 +256,6 @@ Configure AKK under `plugins.entries.agent-knock-knock.config` in `~/.openclaw/o
 
 See [`openclaw.plugin.json`](openclaw.plugin.json) for the complete schema and compatibility aliases.
 
-## Native Sessions and tmux Control
-
-AKK can discover Codex CLI sessions started outside AKK and control Codex or Claude Code sessions in tmux. `AKK list` separates managed `delegated` tasks, discovered `native` sessions, and tmux-backed `terminal_controlled` sessions. Native stop/resume and fork takeover remain Codex-only:
-
-```text
-AKK takeover Codex <session-id>
-AKK terminal takeover Codex <session-id>
-AKK fork takeover Codex <session-id>
-```
-
-A terminal-controlled ID works with `send`, `status`, `describe`, `approve`, and `cancel`. Claude accepts new messages only at a verified idle prompt. Use `send --background` (the OpenClaw send tool does this automatically) to bind a managed turn, then use the returned conversation ID with `approve`, `cancel`, or `status`.
-
-Claude tmux support is hook-free: AKK can discover the session, send at a verified idle prompt, report status, handle a narrowly verified approval, and detect completion for a verified local transcript schema. Before sending, AKK binds the Claude PID, process start time, session ID, cwd, and transcript file boundary. Completion requires the exact managed prompt, its UUID chain, an `end_turn` assistant response, a matching `turn_duration`, an idle unchanged process, and two stable monitor polls.
-
-This detector is deliberately conservative. An unknown Claude version or schema, partial or replaced transcript, ambiguous prompt, unresolved tool call, sidechain, or background work does not become `done`; the monitor remains pending and may eventually become `stalled`. `Agent`, `SendMessage`, and scheduled/background tool turns currently take this safe path because their child lifecycle is not fully visible in the main transcript. A visible idle prompt alone is never completion evidence.
-
-Avoid opening a second live client on the same agent session; concurrent clients can produce inconsistent visible history.
-
 ## Approvals
 
 AKK runs ACPX-backed agents with `--approve-all`. Claude Code surfaces permission requests through ACPX, but some Codex sandbox-sensitive operations fail directly. Keep Codex background work inside its workspace, or prefer Claude Code when a task requires ACPX-approved access elsewhere.
@@ -183,41 +263,43 @@ AKK runs ACPX-backed agents with `--approve-all`. Claude Code surfaces permissio
 For tmux-backed Codex, AKK reports visible approval prompts. Claude approval is deliberately narrower:
 
 - It is available only for the current AKK-managed turn.
-- AKK accepts only an exact, current Bash dialog with the one-time **Yes** choice already highlighted. Persistent permission choices are rejected.
-- A human must explicitly run `AKK approve <conversation-id>`. AKK never auto-approves Claude tmux requests.
-- The request is short-lived, fingerprinted to the terminal and managed-turn identity, and captured and validated again immediately before AKK sends Enter. Each dispatch is reserved first; an uncertain outcome fails closed and must be resolved in the terminal.
+- AKK accepts only an exact, current Bash dialog with the one-time **Yes** choice already highlighted, correlated to one unresolved foreground Bash tool request in the anchored owner-private transcript. Persistent permission choices are rejected.
+- When no trusted rule matches, the callback takes the manual path. The user must personally inspect the named tmux pane, explicitly confirm the exact request, and then run `AKK approve <conversation-id>`; the hash-only callback is not sufficient for review.
+- A disabled-by-default `autoApprove` rule may approve Claude only when its agent, canonical workspace, and exact argument vector all match the freshly re-read local evidence.
+- AKK re-evaluates the policy, reserves the one-shot dispatch, recaptures the one-time choice and transcript evidence, and revalidates the process and pane before sending one Enter. A stale, changed, replayed, or uncertain request fails closed and must be resolved in the terminal.
 
 Unknown, stale, changed, ambiguous, or unmanaged dialogs fail closed and must be resolved in the terminal.
 
-Trusted Codex terminal commands can optionally be auto-approved with a deterministic policy:
+Trusted Codex and hookless Claude terminal commands can optionally be auto-approved with a deterministic policy:
 
 ```json5
 autoApprove: {
   enabled: true,
   rules: [{
     id: "project-read-status",
-    agents: ["codex"],
+    agents: ["codex", "claude"],
     workspaces: ["/absolute/path/to/project"],
     commands: [["pwd"], ["git", "status"], ["git", "diff", "--stat"]]
   }]
 }
 ```
 
-Place `autoApprove` inside the plugin `config` object. It is disabled by default and matches only exact Codex argument vectors in configured workspaces. Shell composition, substitutions, globs, environment assignments, unparseable commands, and out-of-workspace paths require manual approval. Rules match arguments, not executable hashes.
+Place `autoApprove` inside the plugin `config` object. It is disabled by default and matches only exact argument vectors in configured workspaces. Shell composition, substitutions, globs, environment assignments, unparseable commands, and out-of-workspace paths require manual approval. Rules match arguments, not executable hashes. For Claude, the raw command never leaves the local executor; callbacks expose only bounded hashes and opaque request identities.
 
 ## Troubleshooting
 
-Start with `agent-knock-knock doctor`. It checks the core installation and reports ACPX and tmux readiness separately; either execution mode is enough. It does not authenticate an agent, verify live Gateway/plugin connectivity, or run a real task.
+With the global npm CLI installed, start with `agent-knock-knock doctor`. It checks the core installation and reports ACPX and tmux readiness separately; either execution mode is enough. It does not authenticate an agent, verify live Gateway/plugin connectivity, or run a real task. For a ClawHub-only installation, start with `openclaw plugins inspect agent-knock-knock --runtime`.
 
 | Symptom | Action |
 | --- | --- |
-| Installer or callbacks cannot find a local OpenClaw CLI | Set `openclawBin` and pass `--openclaw-bin` to `install-openclaw`. |
+| The npm installer or callbacks cannot find a local OpenClaw CLI | Set `openclawBin` and pass `--openclaw-bin` to `install-openclaw`. |
 | Source changes do not appear | Build, reinstall from the checkout, and restart the Gateway. |
 | Terminal bridge task is `stalled` | Inspect `status` and the terminal; use `/akk renew <conversation-id> <minutes>` only when more monitoring time is useful. |
 | ACPX task is `stalled` | Inspect `status --trace`; close and redelegate if the executor cannot continue. |
 | Task is `callback_failed` | Run `/akk retry-callback <conversation-id>` in a native-command chat. |
 | Terminal takeover is unavailable | Run Codex or Claude Code inside tmux and check `AKK list` for a `terminal_controlled` entry. |
 | Claude permission is not offered through AKK | Use the managed conversation returned by a background send. If the dialog is not the exact supported one-time Bash prompt, resolve it in the terminal. |
+| Claude request was not auto-approved | Check `autoApprove.enabled`, `agents: ["claude"]`, the canonical workspace, and the exact command vector. The request must also be a current one-time Bash prompt with matching local transcript evidence from a supported Claude `2.1.x` version. |
 | Claude tmux monitor becomes `stalled` | Check the Claude version and `status`, then inspect the terminal. Unknown transcript schemas, background work, identity changes, and ambiguous turns intentionally fail closed. |
 
 For local diagnostics, use:
@@ -240,6 +322,20 @@ npm test                      # build and run the full test suite
 
 See [CONTRIBUTING.md](https://github.com/scotthuang/agent-knock-knock/blob/main/CONTRIBUTING.md) for the development and pull request workflow. For local OpenClaw testing, rebuild, run `node dist/src/cli.js install-openclaw`, and restart the Gateway.
 
+### ClawHub Maintainer Release
+
+The first `0.3.0` beta publish is intentionally manual and must stay on ClawHub's `beta` tag:
+
+```bash
+npm ci
+npm run build
+npm exec clawhub -- login
+npm exec clawhub -- package publish . --family code-plugin --owner scotthuang --tags beta --dry-run --json
+npm exec clawhub -- package publish . --family code-plugin --owner scotthuang --tags beta
+```
+
+After that first release creates the package, configure this repository as its trusted publisher. Future publishes use the manually dispatched `ClawHub Publish` workflow, which defaults to a dry run and derives `beta` versus `latest` from the package version.
+
 ## Storage and Logs
 
 State lives under `~/.agent-knock-knock/`. Directories use mode `0700`; state and log files use `0600`. Runtime logs redact common secrets and default to 14-day retention. Configure storage and logging with `--store-dir`, `AKK_LOG_DIR`, `AKK_LOG_LEVEL`, and `AKK_LOG_RETENTION_DAYS`; use a dedicated custom log directory.

package/dist/src/approval-policy.d.ts

@@ -6,6 +6,8 @@ export interface ApprovalCandidate {
     cwd?: string;
     fingerprint: string;
     terminalTarget?: string;
+    evidenceSource?: "claude_transcript";
+    evidenceFingerprint?: string;
 }
 export interface ApprovalPolicyDecision {
     action: "approve" | "ask";
@@ -21,7 +23,8 @@ export interface SimpleCommandParseResult {
 }
 export interface AutoApprovalAttempt {
     approved: boolean;
-    action: "approved" | "ask";
+    handled: boolean;
+    action: "approved" | "already_approved" | "ask";
     reason: string;
     rule_id?: string;
     policy_fingerprint: string;

package/dist/src/approval-policy.js

@@ -16,6 +16,9 @@ export function approvalCandidateFromMessage(message) {
     const agent = stringValue(candidate?.agent);
     const kind = stringValue(candidate?.kind);
     const fingerprint = stringValue(candidate?.fingerprint);
+    const policyEvidence = isRecord(candidate?.policy_evidence)
+        ? candidate.policy_evidence
+        : undefined;
     if (!agent || !kind || !fingerprint) {
         return undefined;
     }
@@ -28,7 +31,13 @@ export function approvalCandidateFromMessage(message) {
             : {}),
         command: stringValue(candidate?.command),
         cwd: stringValue(candidate?.cwd),
-        terminalTarget: stringValue(candidate?.terminal_target)
+        terminalTarget: stringValue(candidate?.terminal_target),
+        ...(policyEvidence?.source === "claude_transcript"
+            ? { evidenceSource: "claude_transcript" }
+            : {}),
+        ...(stringValue(policyEvidence?.evidence_fingerprint)
+            ? { evidenceFingerprint: stringValue(policyEvidence?.evidence_fingerprint) }
+            : {})
     };
 }
 export function evaluateApprovalPolicy({ policy, candidate }) {
@@ -39,8 +48,11 @@ export function evaluateApprovalPolicy({ policy, candidate }) {
     if (candidate.kind !== "run_command") {
         return ask(`approval kind is not supported: ${candidate.kind}`, policyFingerprint);
     }
-    if (candidate.agent === "claude") {
-        return ask("Claude tmux approval always requires explicit user confirmation", policyFingerprint);
+    if (candidate.agent === "claude" &&
+        (candidate.decisionMode !== "keys" ||
+            candidate.evidenceSource !== "claude_transcript" ||
+            !isSha256Hex(candidate.evidenceFingerprint))) {
+        return ask("Claude auto approval requires verified local transcript evidence for a keys-mode request", policyFingerprint);
     }
     if (!candidate.command) {
         return ask("approval command is unavailable", policyFingerprint);
@@ -107,32 +119,103 @@ export function attemptAutoApproval({ message, policy, statePath, execute }) {
         return undefined;
     }
     const decision = evaluateApprovalPolicy({ policy, candidate });
+    const deferredDecision = deferredClaudeAutoApprovalDecision({
+        policy,
+        candidate,
+        decision
+    });
     const cliArgs = statePath
-        ? autoApprovalCliArgs({ statePath, candidate, decision, policy })
+        ? decision.action === "approve"
+            ? autoApprovalCliArgs({ statePath, candidate, decision, policy })
+            : deferredDecision
+                ? deferredAutoApprovalCliArgs({
+                    statePath,
+                    candidate,
+                    policy,
+                    policyFingerprint: deferredDecision.policyFingerprint
+                })
+                : undefined
         : undefined;
-    if (!cliArgs || !decision.ruleId) {
+    if (!cliArgs) {
         return {
             approved: false,
+            handled: false,
             action: "ask",
-            reason: decision.reason,
+            reason: deferredDecision?.reason ?? decision.reason,
             rule_id: decision.ruleId,
-            policy_fingerprint: decision.policyFingerprint,
+            policy_fingerprint: deferredDecision?.policyFingerprint ?? decision.policyFingerprint,
             approval_fingerprint: candidate.fingerprint
         };
     }
     const result = execute(cliArgs);
+    const effectiveRuleId = stringValue(result.policy_rule_id) ?? decision.ruleId;
+    const effectivePolicyFingerprint = stringValue(result.policy_fingerprint) ??
+        deferredDecision?.policyFingerprint ??
+        decision.policyFingerprint;
+    const approved = result.approved === true;
+    const alreadyApproved = result.already_approved === true;
     return {
-        approved: result.approved === true,
-        action: result.approved === true ? "approved" : "ask",
-        reason: result.approved === true
-            ? decision.reason
+        approved,
+        handled: approved || alreadyApproved,
+        action: approved
+            ? "approved"
+            : alreadyApproved
+                ? "already_approved"
+                : "ask",
+        reason: approved
+            ? stringValue(result.reason) ??
+                (effectiveRuleId
+                    ? `matched auto-approval rule ${effectiveRuleId}`
+                    : "executor approved the verified local Claude request")
             : stringValue(result.reason) ?? "automatic approval was not executed",
-        rule_id: decision.ruleId,
-        policy_fingerprint: decision.policyFingerprint,
+        rule_id: effectiveRuleId,
+        policy_fingerprint: effectivePolicyFingerprint,
         approval_fingerprint: candidate.fingerprint,
         monitor_pid: typeof result.monitor_pid === "number" ? result.monitor_pid : null
     };
 }
+function deferredClaudeAutoApprovalDecision({ policy, candidate, decision }) {
+    if (decision.action === "approve" ||
+        candidate.agent !== "claude" ||
+        candidate.kind !== "run_command" ||
+        candidate.decisionMode !== "keys" ||
+        candidate.evidenceSource !== "claude_transcript" ||
+        !isSha256Hex(candidate.evidenceFingerprint) ||
+        !candidate.cwd) {
+        return undefined;
+    }
+    const policyFingerprint = fingerprintValue(policy);
+    if (!isRecord(policy) || policy.enabled !== true) {
+        return undefined;
+    }
+    const hasEligibleRule = (Array.isArray(policy.rules) ? policy.rules : [])
+        .map(normalizeRule)
+        .filter((rule) => Boolean(rule))
+        .some((rule) => rule.agents.includes("claude") &&
+        rule.workspaces.some((workspace) => isPathWithin(candidate.cwd, workspace)));
+    if (!hasEligibleRule) {
+        return undefined;
+    }
+    return ask("Claude command policy will be evaluated from fresh local transcript evidence by the executor", policyFingerprint);
+}
+function deferredAutoApprovalCliArgs({ statePath, candidate, policy, policyFingerprint }) {
+    const serializedPolicy = JSON.stringify(policy);
+    if (!statePath || typeof serializedPolicy !== "string") {
+        return undefined;
+    }
+    return [
+        "approve",
+        "--state",
+        statePath,
+        "--expected-approval-fingerprint",
+        candidate.fingerprint,
+        "--auto-approved",
+        "--policy-fingerprint",
+        policyFingerprint,
+        "--auto-approval-policy-json",
+        serializedPolicy
+    ];
+}
 export function parseSimpleShellCommand(command) {
     const text = String(command ?? "").trim();
     if (!text) {
@@ -329,6 +412,9 @@ function stringArray(value) {
 function stringValue(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
+function isSha256Hex(value) {
+    return typeof value === "string" && /^[0-9a-f]{64}$/u.test(value);
+}
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/dist/src/approval-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAoC7B,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IACE,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,QAAQ,EAAE,MAAM,KAAK,iBAAiB;QACtC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,WAAW;QACX,GAAG,CAAC,SAAS,EAAE,aAAa,KAAK,YAAY,IAAI,SAAS,EAAE,aAAa,KAAK,MAAM;YAClF,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;QACxC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC;QAChC,cAAc,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,SAAS,EAIV;IACC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,GAAG,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,mCAAmC,SAAS,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,iEAAiE,EAAE,iBAAiB,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,sCAAsC,EAAE,iBAAiB,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAK,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8BAA8B,IAAI,CAAC,EAAE,EAAE;YAC/C,iBAAiB;YACjB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,wCAAwC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,SAAS,EACT,QAAQ,EACR,MAAM,EAMP;IACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IACE,QAAQ,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,QAAQ,CAAC,MAAM;QAChB,CAAC,SAAS;QACV,OAAO,gBAAgB,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,iCAAiC;QACjC,SAAS,CAAC,WAAW;QACrB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ,CAAC,MAAM;QACf,sBAAsB;QACtB,QAAQ,CAAC,iBAAiB;QAC1B,6BAA6B;QAC7B,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EACT,OAAO,EAMR;IACC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;YAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;QAClC,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;QACrD,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;YAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,qCAAqC;QACvE,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;QAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;QAC3C,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAE3C,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzD,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACzD,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,IAAI,IAAI,CAAC;QACd,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IAMnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAuB,EAAE,CAAC,CACxD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAClG,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;IACrF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACzF,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAe;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,iBAAyB,EAAE,IAAe;IACrE,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM;QACN,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAuC7B,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IACE,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,QAAQ,EAAE,MAAM,KAAK,iBAAiB;QACtC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC,eAAe;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,WAAW;QACX,GAAG,CAAC,SAAS,EAAE,aAAa,KAAK,YAAY,IAAI,SAAS,EAAE,aAAa,KAAK,MAAM;YAClF,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;QACxC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC;QAChC,cAAc,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC;QACvD,GAAG,CAAC,cAAc,EAAE,MAAM,KAAK,mBAAmB;YAChD,CAAC,CAAC,EAAE,cAAc,EAAE,mBAA4B,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,oBAAoB,CAAC;YACnD,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,cAAc,EAAE,oBAAoB,CAAC,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,SAAS,EAIV;IACC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,GAAG,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,mCAAmC,SAAS,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACrF,CAAC;IACD,IACE,SAAS,CAAC,KAAK,KAAK,QAAQ;QAC5B,CACE,SAAS,CAAC,YAAY,KAAK,MAAM;YACjC,SAAS,CAAC,cAAc,KAAK,mBAAmB;YAChD,CAAC,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAC5C,EACD,CAAC;QACD,OAAO,GAAG,CACR,0FAA0F,EAC1F,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,sCAAsC,EAAE,iBAAiB,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAK,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8BAA8B,IAAI,CAAC,EAAE,EAAE;YAC/C,iBAAiB;YACjB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,wCAAwC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,SAAS,EACT,QAAQ,EACR,MAAM,EAMP;IACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IACE,QAAQ,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,QAAQ,CAAC,MAAM;QAChB,CAAC,SAAS;QACV,OAAO,gBAAgB,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,iCAAiC;QACjC,SAAS,CAAC,WAAW;QACrB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ,CAAC,MAAM;QACf,sBAAsB;QACtB,QAAQ,CAAC,iBAAiB;QAC1B,6BAA6B;QAC7B,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EACT,OAAO,EAMR;IACC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACjE,CAAC,CAAC,gBAAgB;gBAChB,CAAC,CAAC,2BAA2B,CAAC;oBAC1B,SAAS;oBACT,SAAS;oBACT,MAAM;oBACN,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;iBACtD,CAAC;gBACJ,CAAC,CAAC,SAAS;QACf,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM;YACnD,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,kBAAkB,EAChB,gBAAgB,EAAE,iBAAiB,IAAI,QAAQ,CAAC,iBAAiB;YACnE,oBAAoB,EAAE,SAAS,CAAC,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC9E,MAAM,0BAA0B,GAC9B,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtC,gBAAgB,EAAE,iBAAiB;QACnC,QAAQ,CAAC,iBAAiB,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACzD,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,QAAQ,IAAI,eAAe;QACpC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,eAAe;gBACf,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,KAAK;QACX,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1B,CAAC,eAAe;oBACd,CAAC,CAAC,8BAA8B,eAAe,EAAE;oBACjD,CAAC,CAAC,qDAAqD,CAAC;YAC5D,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,qCAAqC;QACvE,OAAO,EAAE,eAAe;QACxB,kBAAkB,EAAE,0BAA0B;QAC9C,oBAAoB,EAAE,SAAS,CAAC,WAAW;QAC3C,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,EAC1C,MAAM,EACN,SAAS,EACT,QAAQ,EAKT;IACC,IACE,QAAQ,CAAC,MAAM,KAAK,SAAS;QAC7B,SAAS,CAAC,KAAK,KAAK,QAAQ;QAC5B,SAAS,CAAC,IAAI,KAAK,aAAa;QAChC,SAAS,CAAC,YAAY,KAAK,MAAM;QACjC,SAAS,CAAC,cAAc,KAAK,mBAAmB;QAChD,CAAC,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC;QAC3C,CAAC,SAAS,CAAC,GAAG,EACd,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAyD,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtF,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC,CAC7E,CAAC;IACJ,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CACR,8FAA8F,EAC9F,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,EACnC,SAAS,EACT,SAAS,EACT,MAAM,EACN,iBAAiB,EAMlB;IACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,iCAAiC;QACjC,SAAS,CAAC,WAAW;QACrB,iBAAiB;QACjB,sBAAsB;QACtB,iBAAiB;QACjB,6BAA6B;QAC7B,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAE3C,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBACzD,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACzD,CAAC;YACD,KAAK,IAAI,IAAI,CAAC;YACd,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,IAAI,IAAI,CAAC;QACd,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IAMnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAuB,EAAE,CAAC,CACxD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAClG,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;IACrF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACzF,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAe;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,iBAAyB,EAAE,IAAe;IACrE,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM;QACN,iBAAiB;QACjB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/src/claude-local-transcript-provider.d.ts

@@ -26,6 +26,26 @@ export interface DetectClaudeTranscriptCompletionOptions {
     agentRows: readonly ClaudeAgentRow[];
     maxTurnBytes?: number;
 }
+/**
+ * Process-local evidence for one pending, foreground Claude Bash permission.
+ * `command` is intentionally raw so the caller can apply the exact command
+ * policy, but callers must not persist this object or add it to callbacks.
+ */
+export interface ClaudeTranscriptPendingApprovalEvidence {
+    source: "claude_transcript";
+    kind: "run_command";
+    command: string;
+    cwd: string;
+    toolName: "Bash";
+    toolUseId: string;
+    promptUuid: string;
+    assistantUuid: string;
+    claudeVersion: string;
+    transcriptFileId: string;
+    commandSha256: string;
+    evidenceFingerprint: string;
+    observedEndOffsetBytes: number;
+}
 export declare function defaultClaudeHome(): string;
 /**
  * Records the immutable file boundary immediately before AKK submits a turn.
@@ -38,3 +58,10 @@ export declare function captureClaudeTranscriptAnchor(options: CaptureClaudeTran
  * background-work, and chain ambiguity.
  */
 export declare function detectClaudeTranscriptCompletion(request: TerminalDurableCompletionRequest, options: DetectClaudeTranscriptCompletionOptions): TerminalCompletionEvidence | undefined;
+/**
+ * Detects exactly one unresolved foreground Bash tool use for the current
+ * AKK-managed Claude turn. It uses the same anchored, owner-private,
+ * no-follow, bounded, stable transcript read as durable completion and fails
+ * closed on identity changes, completed turns, background work, or ambiguity.
+ */
+export declare function detectClaudeTranscriptPendingApproval(request: TerminalDurableCompletionRequest, options: DetectClaudeTranscriptCompletionOptions): ClaudeTranscriptPendingApprovalEvidence | undefined;