harnery 0.45.2 → 0.46.1

package/dist/core/hooks/cli.js

@@ -32,12 +32,13 @@ import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.
 import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.js";
 import { assignName, readForkParent, readForkState, recordForkDetection, resolveName, } from "../agents/state/names.js";
 import { writePidmapRow } from "../agents/state/pidmap.js";
-import { agentsRequireGitFinalization, coordFreshnessSeconds, hostPromptContextConfig, resolveBinName, } from "../config.js";
+import { agentsRequireGitFinalization, coordFreshnessSeconds, hostPromptContextConfig, readAdmissionConfig, resolveBinName, } from "../config.js";
 import { checkpointContext, completeContextRecovery, extractContextSample, markContextCompactionCompleted, prepareContextRecovery, readContextState, recordContextSample, } from "../context/index.js";
 import { tryWriteLiveDisplayV3 } from "../events/v3/live-feed.js";
 import { liveHookSignalDefersDrainV3, reconcileLivePendingRuntimeContextV3, recordLiveDelegatedChildSessionV3, recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
 import { captureSpanClockV3 } from "../events/v3/span-state.js";
 import { ensureRelayDaemon, fetchPresence, publishPresence } from "../presence/index.js";
+import { importMail, publishMail } from "../presence/mail.js";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.js";
 import { stableScopeId } from "../workflow/scope-id.js";
 import { adapterBehavior } from "./adapter/behaviors/index.js";
@@ -54,9 +55,10 @@ import { beginHookHealth, observeHookDebug, observeHookError, writeHookHealthCom
 import { adapterPidFromEnv, parsePsChainLine, selectAnchorPid } from "./resolve/anchor.js";
 import { extractIntentComment, resolveIntent } from "./resolve/intent.js";
 import { resolveOwner } from "./resolve/owner.js";
-import { inspectSessionNameDisplayImmediately, scanAssistantStatusBoxPresent, scanStatusBoxPresent, scanTranscriptRuntime, } from "./resolve/transcript.js";
+import { inspectSessionNameDisplayImmediately, scanAssistantStatusBoxPresent, scanPendingBackgroundHandoffs, scanStatusBoxPresent, scanTranscriptRuntime, } from "./resolve/transcript.js";
 import { clearHookRunMarker, writeHookRunMarker } from "./run-markers.js";
 import { sessionNamePresence } from "./session-name-presence.js";
+import { shellCommitTreeReason } from "./shell-commit-tree.js";
 import { shellRmReason } from "./shell-rm.js";
 import { shellWaiterReason } from "./shell-waiter.js";
 let hookHealthState;
@@ -227,7 +229,18 @@ function healForkLineage(coordRoot, instanceId, payload) {
 function ensureSessionDisplayName(coordRoot, instanceId, sessionId, adapter, payload) {
     if (coordEnv("WORKFLOW_CHILD") === "1")
         return;
-    const row = readLiveCoordinationRow(coordRoot, instanceId) ?? readHeartbeat(coordRoot, instanceId);
+    // This runs on every tool call. The heartbeat cache is the surface this
+    // function stamps, so a cache that already carries a name, or marks a
+    // session that never takes one, means there is nothing to do. Only a cache
+    // that cannot answer pays for the authoritative read, which re-validates the
+    // whole active ledger and cost about half a second per call at 22 MB.
+    const cached = readHeartbeat(coordRoot, instanceId);
+    if (cached?.kind === "subagent" || cached?.kind === "transient" || cached?.workflow_run_id) {
+        return;
+    }
+    if (cached?.name?.trim())
+        return;
+    const row = readLiveCoordinationRow(coordRoot, instanceId) ?? cached;
     if (row?.kind === "subagent" || row?.kind === "transient" || row?.workflow_run_id)
         return;
     if (row?.name?.trim())
@@ -1009,8 +1022,23 @@ function recordContextTelemetry(run) {
         }
     }
 }
+/** Cross-machine peer messages (ADR 0222) ride the presence fetch: import
+ * whatever mail refs are already local. Reads local refs only, at most once
+ * per import interval; never blocks on the network. */
+async function receiveRemoteMail(coordRoot) {
+    const { peerInbox } = await import("../inbox/peer-messages.js");
+    importMail(coordRoot, peerInbox(coordRoot), { throttle: true });
+}
 async function handleSessionStarted(run) {
     const { coordRoot, adapter, payload, owner, sessionId, data } = run;
+    // Import mail from refs fetched earlier, so a message sent from another
+    // machine while this task was away is in the inbox this context renders.
+    try {
+        await receiveRemoteMail(coordRoot);
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "session-start-mail" });
+    }
     // A configured backup runs out of process and is freshness-gated per host.
     // Startup never waits for restic or a remote provider; the child owns no
     // hook stdio, so the harness is not held open until it finishes. A failed
@@ -1124,6 +1152,7 @@ async function handleTurnStarted(run) {
     // interval; the systemMessage below reads whatever is locally known).
     try {
         fetchPresence(coordRoot);
+        await receiveRemoteMail(coordRoot);
     }
     catch (err) {
         logError(coordRoot, err, { phase: "user-prompt-submit-presence" });
@@ -1187,11 +1216,20 @@ async function handleStop(run) {
     // its daemon intentionally exits when a machine has no live sessions.
     try {
         publishPresence(coordRoot);
+        publishMail(coordRoot);
         ensureRelayDaemon(coordRoot);
     }
     catch (err) {
         logError(coordRoot, err, { phase: "stop-presence" });
     }
+    // Claude Code may move a running foreground command (often the agent's own
+    // commit and push) into the background to deliver a user message. Until it
+    // reports back, finalization cannot pass, so the verdict defers the status
+    // demands instead of bouncing the agent in a loop.
+    const pendingBackgroundHandoffs = adapter === "claude-code"
+        ? scanPendingBackgroundHandoffs(payload?.transcript_path ??
+            behavior.discoverTranscript?.(payload?.session_id ?? sessionId))
+        : [];
     // Stop verdict (V3 ritual + task/status gate). Direct in-process call: the
     // rule lives in Harnery. agent-hook already emitted this turn.completed
     // with privacy-safe ritual observations, so the evidence is in the stream.
@@ -1205,7 +1243,15 @@ async function handleStop(run) {
         session_name_observation_unavailable: typeof data.session_name_unavailable_reason === "string",
         bypass: coordEnv("AGENT_COORD_BYPASS_STOP") === "1",
         workflow_child: coordEnv("WORKFLOW_CHILD") === "1",
+        pending_background_handoff: pendingBackgroundHandoffs.length > 0,
     });
+    if (verdict.rule === "stop-hook.background_handoff_deferred") {
+        appendDebug(coordRoot, {
+            ...debugBase,
+            effect: "stop-deferred-background-handoff",
+            background_task_ids: pendingBackgroundHandoffs,
+        });
+    }
     if (!verdict.allow) {
         // Backstop for sessions whose evidence can never land (e.g. a headless
         // child whose status command resolves to a different owner): after
@@ -1240,6 +1286,13 @@ async function handleStop(run) {
     // until the adapter has committed turn.completed above. Reconcile only
     // when such a request exists; any later real work cancels it in the
     // finalizer instead of being terminated underneath the agent.
+    // A deferred stop proves nothing about finalization; an explicit end must
+    // wait for the turn that reports the background task's result.
+    if (verdict.rule === "stop-hook.background_handoff_deferred") {
+        if (behavior.runtimeContextRetry)
+            scheduleRuntimeContextRetry(coordRoot, adapter, sessionId);
+        return undefined;
+    }
     try {
         const { hasPendingExplicitSessionEndV3, reconcileSessionFinalizationV3 } = await import("../agents/session-finalizer-v3.js");
         if (hasPendingExplicitSessionEndV3(coordRoot)) {
@@ -1310,6 +1363,12 @@ async function handleToolRequested(run) {
         emitDeny(adapter, rmReason);
         return 0;
     }
+    const commitTreeReason = shellCommitTreeReason(payload?.tool_name, payload?.tool_input, resolveBinName(coordRoot));
+    if (commitTreeReason) {
+        const { emitDeny } = await import("./adapter/output.js");
+        emitDeny(adapter, commitTreeReason);
+        return 0;
+    }
     // G-guard for ALL adapters. Claude Code previously ran this via a
     // pre-tool-use bash adapter (which called `agent-coord verdict --rule=claim`);
     // that adapter is now deleted, so agent-hook owns the deny for every adapter.
@@ -1327,8 +1386,38 @@ async function handleToolRequested(run) {
     }
     if (!guardAllowed)
         return 0;
+    // Heavy shell checks queue for a machine-wide admission slot when the
+    // project configures one. Fails open: any error runs the command as written.
+    try {
+        if (await emitAdmissionRewrite(coordRoot, adapter, payload))
+            return 0;
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "pre-tool-use-admission" });
+    }
     return undefined;
 }
+async function emitAdmissionRewrite(coordRoot, adapter, payload) {
+    const resource = readAdmissionConfig(coordRoot)?.guard?.resource;
+    if (!resource)
+        return false;
+    const { admissionHookOutput } = await import("./shell-admission.js");
+    const output = admissionHookOutput({
+        adapter,
+        resource,
+        bin: resolveBinName(coordRoot),
+        projectRoot: coordRoot,
+        toolName: payload?.tool_name,
+        toolInput: payload?.tool_input,
+        cwd: payload?.cwd,
+        skip: coordEnv("ADMISSION_SKIP") === "1" || Boolean(coordEnv("ADMISSION_HELD")),
+        platform: process.platform,
+    });
+    if (!output)
+        return false;
+    process.stdout.write(`${JSON.stringify(output)}\n`);
+    return true;
+}
 async function handlePostToolUse(run) {
     const { coordRoot, adapter, eventName, payload, owner } = run;
     // Inject the full instruction only at the successful tool boundary that
@@ -1348,9 +1437,18 @@ async function handlePostToolUse(run) {
     // retry response already carries the full instruction and an end-turn
     // status is the wrong place to ask.
     try {
-        const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
         // A workflow child has no user-visible title to set.
-        const name = coordEnv("WORKFLOW_CHILD") === "1" ? undefined : sessionNameDisplayPending(row);
+        if (coordEnv("WORKFLOW_CHILD") === "1")
+            return;
+        // The live row copies every name-display field from a current heartbeat
+        // cache and leaves them unset otherwise, so a raw cache with nothing
+        // pending proves the row has nothing pending either. That skips a full
+        // ledger read on almost every tool call; only a pending title pays for
+        // the authoritative check below.
+        if (!sessionNameDisplayPending(readHeartbeat(coordRoot, owner.instance_id)))
+            return;
+        const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
+        const name = sessionNameDisplayPending(row);
         if (name && toolResponseMintedSessionName(payload?.tool_response, name)) {
             // Record the title before asking for it. The suggestion can still
             // change afterwards (an assigned-name rewrite, a lifecycle re-mint, a

package/dist/core/hooks/resolve/owner.d.ts

@@ -30,17 +30,6 @@ export declare function resolveOwner(opts: {
     instance_id: string;
     source: "env" | "payload" | "session_env" | "pidmap-self" | "pidmap-ancestor";
 } | null;
-/**
- * Find the parent owner for a subagent invocation. The per-shell marker at
- * `.harnery/shells/<pid>` is set by `sub-agent-start` and removed by
- * `sub-agent-stop`.
- *
- * Phase 2 stub: the marker file isn't written yet, so we return null in most
- * cases. Phase 2 callers can pass through.
- */
-export declare function readShellMarker(coordRoot: string, pid: number): string | null;
-/** Read the V3-projected `agent_id` for an owner if it exists. */
-export declare function readAgentIdForOwner(coordRoot: string, instanceId: string): string | null;
 /** Diagnostic: list of pid-map entries (for debugging). */
 export declare function listPidmap(coordRoot: string): Array<{
     pid: number;

package/dist/core/hooks/resolve/owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/owner.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,iBAAiB,CAAC;CAC/E,GAAG,IAAI,CAgFP;AA2BD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExF;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnF"}
+{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/owner.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,iBAAiB,CAAC;CAC/E,GAAG,IAAI,CAgFP;AA2BD,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnF"}

package/dist/core/hooks/resolve/owner.js

@@ -140,29 +140,6 @@ function readPpid(pid) {
     }
     return null;
 }
-/**
- * Find the parent owner for a subagent invocation. The per-shell marker at
- * `.harnery/shells/<pid>` is set by `sub-agent-start` and removed by
- * `sub-agent-stop`.
- *
- * Phase 2 stub: the marker file isn't written yet, so we return null in most
- * cases. Phase 2 callers can pass through.
- */
-export function readShellMarker(coordRoot, pid) {
-    const path = join(coordRoot, ".harnery", "shells", String(pid));
-    if (!existsSync(path))
-        return null;
-    try {
-        return readFileSync(path, "utf8").trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read the V3-projected `agent_id` for an owner if it exists. */
-export function readAgentIdForOwner(coordRoot, instanceId) {
-    return readLiveCoordinationRow(coordRoot, instanceId)?.agent_id ?? null;
-}
 /** Diagnostic: list of pid-map entries (for debugging). */
 export function listPidmap(coordRoot) {
     const dir = join(coordRoot, ".harnery", "pid-map");

package/dist/core/hooks/resolve/transcript.d.ts

@@ -33,6 +33,18 @@ export declare function scanAssistantTextIncludes(transcriptPath: string | undef
  * from the adapter's completed assistant response.
  */
 export declare function scanAssistantStatusBoxPresent(transcriptPath: string | undefined, lastAssistantMessage: string | undefined): boolean;
+/** A handoff older than this no longer defers Stop, so a lost notification cannot disable the ritual. */
+export declare const BACKGROUND_HANDOFF_MAX_AGE_MS: number;
+/**
+ * Claude Code background tasks it moved off the foreground on its own (to
+ * deliver a mid-command user message) that have not yet posted a
+ * `<task-notification>`. Only the structured `toolUseResult` fields written by
+ * Claude Code open a handoff; the agent cannot forge them through tool output.
+ * Any later notification text naming the task closes it, so a spoofed
+ * notification can only make Stop stricter. A command the agent chose to
+ * background (`run_in_background`) or a Monitor opens nothing.
+ */
+export declare function scanPendingBackgroundHandoffs(transcriptPath: string | undefined, nowMs?: number): string[];
 /** Most recent user-visible assistant text across Claude Code and Codex JSONL. */
 export declare function scanLatestAssistantText(transcriptPath: string | undefined): string | undefined;
 /**

package/dist/core/hooks/resolve/transcript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transcript.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/transcript.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,2BAA2B,wBAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAiCT;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,OAAO,CAIT;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IACE,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;CAClF,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,4BAA4B,CAqD9B;AAgBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAUrF;AAwDD;4CAC4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;+EAC2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,qBAAqB,GAAG,SAAS,CA8BnC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAiBpB;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAkDpB"}
+{"version":3,"file":"transcript.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/transcript.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,2BAA2B,wBAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAiCT;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,yGAAyG;AACzG,eAAO,MAAM,6BAA6B,QAAiB,CAAC;AAQ5D;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,EAAE,CAsCV;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,OAAO,CAIT;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IACE,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;CAClF,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,4BAA4B,CAqD9B;AAgBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAUrF;AAwDD;4CAC4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;+EAC2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,qBAAqB,GAAG,SAAS,CA8BnC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAiBpB;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAkDpB"}

package/dist/core/hooks/resolve/transcript.js

@@ -88,6 +88,60 @@ export function scanAssistantStatusBoxPresent(transcriptPath, lastAssistantMessa
     return (scanAssistantTextIncludes(transcriptPath, ASSISTANT_STATUS_BOX_PREFIX) ||
         lastAssistantMessage?.includes(ASSISTANT_STATUS_BOX_PREFIX) === true);
 }
+/** A handoff older than this no longer defers Stop, so a lost notification cannot disable the ritual. */
+export const BACKGROUND_HANDOFF_MAX_AGE_MS = 30 * 60 * 1000;
+/**
+ * Claude Code interleaves request-capture rows of several hundred KB each, so
+ * the 256KB status-box window can lose a handoff written a minute earlier.
+ */
+const BACKGROUND_HANDOFF_TAIL_BYTES = 8 * 1024 * 1024;
+/**
+ * Claude Code background tasks it moved off the foreground on its own (to
+ * deliver a mid-command user message) that have not yet posted a
+ * `<task-notification>`. Only the structured `toolUseResult` fields written by
+ * Claude Code open a handoff; the agent cannot forge them through tool output.
+ * Any later notification text naming the task closes it, so a spoofed
+ * notification can only make Stop stricter. A command the agent chose to
+ * background (`run_in_background`) or a Monitor opens nothing.
+ */
+export function scanPendingBackgroundHandoffs(transcriptPath, nowMs = Date.now()) {
+    const readablePath = resolveTranscriptPath(transcriptPath);
+    if (!readablePath)
+        return [];
+    let size;
+    try {
+        size = statSync(readablePath).size;
+    }
+    catch {
+        return [];
+    }
+    const text = readRange(readablePath, Math.max(0, size - BACKGROUND_HANDOFF_TAIL_BYTES), size);
+    if (!text)
+        return [];
+    const opened = new Map();
+    for (const line of text.split("\n")) {
+        // Request-capture rows echo the same text; the row-type check below keeps
+        // only Claude Code's own top-level tool-result rows.
+        if (line.includes("backgroundedToDeliverMessage")) {
+            const row = parseTranscriptRow(line);
+            const result = row?.toolUseResult;
+            if (row?.type === "user" &&
+                result?.backgroundedToDeliverMessage === true &&
+                typeof result.backgroundTaskId === "string" &&
+                result.backgroundTaskId) {
+                opened.set(result.backgroundTaskId, Date.parse(String(row.timestamp)));
+            }
+        }
+        if (line.includes("task-notification")) {
+            for (const match of line.matchAll(/<task-id>([^<]+)<\/task-id>/g)) {
+                opened.delete(match[1]);
+            }
+        }
+    }
+    return [...opened]
+        .filter(([, at]) => Number.isFinite(at) && nowMs - at <= BACKGROUND_HANDOFF_MAX_AGE_MS)
+        .map(([id]) => id);
+}
 /** Most recent user-visible assistant text across Claude Code and Codex JSONL. */
 export function scanLatestAssistantText(transcriptPath) {
     const readablePath = resolveTranscriptPath(transcriptPath);

package/dist/core/hooks/shell-admission.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Admission guard for heavy shell checks. A whole-project typecheck, a full
+ * test suite, or a production build can each take gigabytes of memory, and
+ * several agents starting them at once on one machine can exhaust it. Asking
+ * agents in prose to wrap those commands in `admission run` does not work: the
+ * rule has to be read and remembered on every call. This guard rewrites the
+ * agent's shell command at PreToolUse instead, so each heavy check waits for a
+ * slot on a machine-wide admission resource.
+ *
+ * Enabled only when the project config names a resource
+ * (`admission.guard.resource`). It finds each simple command that is a heavy
+ * check and inserts `<bin> admission run --resource <name> --label 'agent:
+ * ...' --` in front of it, after any leading VAR=value assignments. The rest
+ * of the command (cd, pipes, redirects, && chains) is left byte for byte.
+ * Heavy means:
+ *   - tsc, however launched (tsc, npx/bunx/bun x/pnpm exec/yarn tsc,
+ *     node_modules/.bin/tsc, node .../typescript/bin/tsc)
+ *   - next build
+ *   - bun test with no file or directory named (a full suite)
+ *   - the package scripts test / test:* (with no further positional
+ *     argument), build, typecheck, type-check, typecheck:*, check-types, tsc,
+ *     run through bun run, npm, pnpm, or yarn
+ *   - bash/sh -c '<script>' whose script contains one of the above
+ * Watch modes, --help/--version, and named-file test runs are left alone.
+ *
+ * Passes through untouched: non-shell tools; a command that already runs
+ * `admission run` or `heavy-slot`; HARNERY_ADMISSION_SKIP=1 in the command or
+ * the hook's environment; HARNERY_ADMISSION_HELD in the hook's environment
+ * (the session already holds a slot); text inside quotes, heredocs, and
+ * comments. Any parse failure means no rewrite.
+ */
+export declare const ADMISSION_SKIP_PREFIX = "HARNERY_ADMISSION_SKIP=1";
+/** Claude Code's maximum Bash timeout; a queued wait counts against it. */
+export declare const BASH_TIMEOUT_MAX_MS = 600000;
+/** POSIX single-quote a word when it needs quoting (shlex.quote semantics). */
+export declare function shellQuote(value: string): string;
+/**
+ * Return the command with each heavy simple command wrapped in `wrapper`
+ * (a shell-ready prefix such as `harn admission run --resource build`), or
+ * null when nothing changes.
+ */
+export declare function rewriteHeavyCommand(command: string, wrapper: string): string | null;
+/** Normalized shell-tool name, or null for any other tool. */
+export declare function shellToolName(toolName: unknown): string | null;
+export interface AdmissionRewrite {
+    updatedInput: Record<string, unknown>;
+}
+/**
+ * Rewrite a shell tool's input so its heavy checks queue for admission.
+ * Handles `command` or `cmd` as a string, or as an argv such as
+ * ["bash", "-lc", "<script>"]. Returns null when nothing changes.
+ */
+export declare function admissionRewriteForTool(toolName: unknown, toolInput: unknown, wrapper: string): AdmissionRewrite | null;
+export interface AdmissionHookInput {
+    adapter: string;
+    /** Admission resource the project's guard queues on. */
+    resource: string;
+    /** Host bin name used in the wrapper and the agent-facing note. */
+    bin: string;
+    /**
+     * Project whose admission config `admission run` should read. A nested
+     * checkout with its own `.harnery/` would otherwise shadow the host's
+     * resource settings for a shell started inside it.
+     */
+    projectRoot?: string;
+    toolName: unknown;
+    toolInput: unknown;
+    cwd?: unknown;
+    /** True when HARNERY_ADMISSION_SKIP=1 or HARNERY_ADMISSION_HELD is set for the hook. */
+    skip?: boolean;
+    platform?: string;
+}
+/**
+ * The PreToolUse output that queues a shell command's heavy checks, or null
+ * to let the command run as written. Claude Code applies `updatedInput`
+ * under the session's own permission rules, so no decision is sent, and its
+ * Bash timeout is raised to the maximum because a queued wait counts against
+ * it. Codex applies a rewrite only beside `permissionDecision: "allow"`.
+ * Cursor and OpenCode have no rewrite channel. Windows-native shells (a
+ * drive-letter or UNC workspace) are outside the machine whose queue this
+ * guards.
+ */
+export declare function admissionHookOutput(input: AdmissionHookInput): Record<string, unknown> | null;
+//# sourceMappingURL=shell-admission.d.ts.map

package/dist/core/hooks/shell-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-admission.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAuGH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAgV3C,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIhD;AAWD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBnF;AAID,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,GAAG,IAAI,CAmCzB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4B7F"}