mainflow 0.21.0 → 0.23.0

package/dist/hooks.js

@@ -1,4 +1,6 @@
-import { G as mayDecorate, H as decorateReply, I as setSessionInfo, L as setSessionStatus, O as sessionBriefing, P as readSession, R as settleSession, U as endsWithMarker, W as headerLine, dt as DATA_DIR, ft as currentBranch, i as hostName, j as ensureSession, k as turnReminder, mt as worktreesOf, nt as loadHub, pt as findHubRoot, tt as HubError } from "./host-BsLqiI0_.js";
+import { G as endsWithMarker, H as grantScope, I as setSessionInfo, J as appendOps, K as headerLine, L as setSessionStatus, O as sessionBriefing, P as readSession, R as settleSession, U as matchGrants, W as decorateReply, _t as worktreesOf, gt as findHubRoot, ht as currentBranch, i as hostName, it as loadHub, j as ensureSession, k as turnReminder, mt as DATA_DIR, pt as readYaml, q as mayDecorate, rt as HubError } from "./host-DkaCYnnc.js";
+import { G as describeRequest, O as configSchema } from "./dist-Dy45myuN.js";
+import { resolveFixed, scanCommand, scopedCwd } from "./grant-commands.js";
 import { appendFileSync, existsSync, readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 //#region src/hooks.ts
@@ -20,6 +22,46 @@ const brief = (text) => {
 	const flat = (text ?? "").replace(/\s+/g, " ").trim();
 	return flat.length > SUMMARY_LIMIT ? `${flat.slice(0, 279)}…` : flat;
 };
+/**
+* Read a hook's stdin: one JSON object, as Claude Code sends it. Anything else is null, including arrays,
+* scalars, empty input, and an object with a key written twice, since which value the host acted on is unknown.
+*/
+function parsePayload(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || hasDuplicateKeys(text)) return null;
+	return parsed;
+}
+/** Whether any object in valid JSON text names a key twice; JSON.parse keeps only the last one. */
+function hasDuplicateKeys(text) {
+	const stack = [];
+	for (let i = 0; i < text.length; i++) {
+		const c = text[i];
+		const top = stack.at(-1);
+		if (c === "{") stack.push({
+			keys: /* @__PURE__ */ new Set(),
+			expectKey: true
+		});
+		else if (c === "[") stack.push(null);
+		else if (c === "}" || c === "]") stack.pop();
+		else if (c === "," && top) top.expectKey = true;
+		else if (c === "\"") {
+			const start = i;
+			for (i++; text[i] !== "\""; i++) if (text[i] === "\\") i++;
+			if (top?.expectKey) {
+				const key = JSON.parse(text.slice(start, i + 1));
+				if (top.keys.has(key)) return true;
+				top.keys.add(key);
+				top.expectKey = false;
+			}
+		}
+	}
+	return false;
+}
 const shortId = (raw) => raw.replace(/[^a-z0-9]/gi, "").toLowerCase().slice(0, 8);
 const claudeCodeSessionId = (raw) => `claude-code-${shortId(raw)}`;
 /**
@@ -158,9 +200,92 @@ const CLAUDE_CODE_EVENTS = {
 		setSessionStatus(root, id, "ended");
 		return null;
 	},
+	"pre-tool-use": decideByGrants,
 	"post-tool-use": checkAfterWrite,
 	"message-display": displayReply
 };
+/**
+* Events that must not stay silent when they cannot decide, because silence would let through what they
+* guard; each says what to print instead. Every other event stays silent on failure.
+*/
+const CLAUDE_CODE_FALLBACKS = { "pre-tool-use": askWhenGrantable };
+/** The PreToolUse answer; `ask` hands the call to the usual permission prompt, with the reason shown. */
+const permission = (decision, reason) => JSON.stringify({ hookSpecificOutput: {
+	hookEventName: "PreToolUse",
+	permissionDecision: decision,
+	permissionDecisionReason: `[mainflow] ${reason}`
+} });
+const askBecause = (reason) => permission("ask", `${reason}，所以照常詢問`);
+/**
+* Scan a Bash call; null when it mentions no grantable command, so the hook stays silent. A Bash call whose
+* command is not a string cannot be judged, so it is refused.
+*/
+function grantableCall(payload) {
+	if (typeof payload.tool_name !== "string" || payload.tool_name.toLowerCase() !== "bash") return null;
+	const command = payload.tool_input?.command;
+	if (typeof command !== "string") return {
+		kind: "refused",
+		reason: "tool_input.command 不是字串"
+	};
+	const scan = scanCommand(command);
+	return scan.kind === "none" ? null : scan;
+}
+/** Outside a hub, or when deciding failed: ask for a grantable call, stay silent for any other. */
+function askWhenGrantable({ payload }, failure) {
+	const reason = failure.kind === "outside-hub" ? "不在 mainflow hub 裡，沒有主脈絡授權可用" : failure.kind === "error" ? `判斷授權時出錯：${failure.message}` : "hook 讀不到 PreToolUse 的輸入";
+	if (failure.kind === "unreadable-input") return askBecause(reason);
+	try {
+		return grantableCall(payload) ? askBecause(reason) : null;
+	} catch {
+		return askBecause(reason);
+	}
+}
+/** The ops log's fields cannot hold its separator, so notes that contain one are written with a broken bar. */
+const opsText = (text) => text.replace(/\s\|\s/g, " ¦ ").replace(/\s+/g, " ").slice(0, 200);
+/** Log the allowed operation with the grant that covered it; a failure only warns, the call stays allowed. */
+function logGranted(root, scope, call, request, grant, warn) {
+	try {
+		appendOps(root, {
+			target: request.action === "publish" ? `npm ${request.name}` : `github release ${request.repos.join("/")}`,
+			operation: opsText(call.text),
+			result: `授權放行 ${grant.ref}（${describeRequest(request)}）`,
+			ref: scope.served[grant.mainline]
+		});
+	} catch (error) {
+		warn?.(`mainflow hook claude-code pre-tool-use: allowed by ${grant.ref} but could not write the ops log: ${error.message}`);
+	}
+}
+/**
+* PreToolUse: allow a publish or release that a grant covers, ask for every other one. `allow` lets the whole
+* call run, so only the two fixed forms in grant-commands.ts can be allowed. A grant counts only when the
+* session's one action in progress serves its mainline and the mainline is open; the package comes from
+* package.json in the payload's cwd and the repository from config.yaml. Calls that mention no grantable command
+* print nothing, so other hooks and the usual permission rules decide them. Any failure asks: the caller turns a
+* throw into the fallback above.
+*/
+function decideByGrants(root, { payload, warn }) {
+	const scan = grantableCall(payload);
+	if (!scan) return null;
+	if (scan.kind === "refused") return askBecause(scan.reason);
+	const sessionId = payload.session_id;
+	if (typeof sessionId !== "string" || !sessionId) return askBecause("payload 沒有字串的 session_id");
+	const scoped = grantScope(root, readSession(root, claudeCodeSessionId(sessionId)));
+	if (!scoped.ok) return askBecause(scoped.reason);
+	const config = readYaml(join(root, DATA_DIR, "config.yaml"), configSchema).data;
+	const place = scopedCwd(payload.cwd, root, config.repos);
+	if (!place.ok) return askBecause(place.reason);
+	const resolved = resolveFixed(scan.call, {
+		cwd: place.dir,
+		root,
+		repos: config.repos
+	});
+	if (!resolved.ok) return askBecause(resolved.reason);
+	const match = matchGrants(scoped.scope, [resolved.request]);
+	if (!match.ok) return askBecause(match.reason);
+	const { grant } = match.matches[0];
+	logGranted(root, scoped.scope, scan.call, resolved.request, grant, warn);
+	return permission("allow", `主脈絡授權 ${grant.ref} 涵蓋 ${describeRequest(resolved.request)}`);
+}
 /** How many problems outside the written file the reminder lists before it only gives the count. */
 const OTHER_PROBLEMS_SHOWN = 5;
 const problemLine = (p) => `- ${p.file}${p.field ? ` › ${p.field}` : ""}：${p.message}`;
@@ -222,9 +347,29 @@ function checkAfterWrite(root, { payload, cli }) {
 	} });
 }
 const HOOK_PLATFORMS = { "claude-code": CLAUDE_CODE_EVENTS };
+const HOOK_FALLBACKS = { "claude-code": CLAUDE_CODE_FALLBACKS };
+/**
+* Events that find the hub from $CLAUDE_PROJECT_DIR before the payload's cwd. A publish runs in the package's own
+* repository, which config.yaml may list outside the hub directory (../mainflow), so its cwd leads to no hub.
+*/
+const PROJECT_HUB_EVENTS = /* @__PURE__ */ new Set(["pre-tool-use"]);
+function hubRootFor(event, ctx) {
+	return (PROJECT_HUB_EVENTS.has(event) && ctx.projectDir && isAbsolute(ctx.projectDir) ? findHubRoot(ctx.projectDir) : null) ?? findHubRoot(typeof ctx.payload.cwd === "string" ? ctx.payload.cwd : process.cwd());
+}
+/** What an event prints when it cannot run its handler; null for the events that stay silent. */
+function hookFallback(platform, event, ctx, failure) {
+	const fallback = HOOK_FALLBACKS[platform]?.[event];
+	if (!fallback) return null;
+	try {
+		return fallback(ctx, failure);
+	} catch {
+		return null;
+	}
+}
 /**
 * Run a hook handler. A hook must never break the host session, so outside a hub it stays silent and any
-* failure is reported on stderr while the caller still exits 0.
+* failure is reported on stderr while the caller still exits 0. Events listed in the fallbacks print their
+* fallback instead of staying silent.
 */
 function runHook(platform, event, ctx) {
 	const handler = HOOK_PLATFORMS[platform]?.[event];
@@ -232,22 +377,31 @@ function runHook(platform, event, ctx) {
 		stdout: null,
 		error: `unknown hook ${platform} ${event}; known: ${Object.entries(HOOK_PLATFORMS).flatMap(([p, e]) => Object.keys(e).map((k) => `${p} ${k}`)).join(", ")}`
 	};
-	const root = findHubRoot(ctx.payload.cwd ?? process.cwd());
-	if (!root) return {
-		stdout: null,
-		error: null
-	};
+	const warnings = [];
+	const errorText = (message) => [...warnings, ...message ? [message] : []].join("\n") || null;
 	try {
-		return {
-			stdout: handler(root, ctx),
+		const root = hubRootFor(event, ctx);
+		if (!root) return {
+			stdout: hookFallback(platform, event, ctx, { kind: "outside-hub" }),
 			error: null
 		};
+		return {
+			stdout: handler(root, {
+				...ctx,
+				warn: (message) => warnings.push(message)
+			}),
+			error: errorText()
+		};
 	} catch (error) {
+		const message = error.message;
 		return {
-			stdout: null,
-			error: `mainflow hook ${platform} ${event}: ${error.message}`
+			stdout: hookFallback(platform, event, ctx, {
+				kind: "error",
+				message
+			}),
+			error: errorText(`mainflow hook ${platform} ${event}: ${message}`)
 		};
 	}
 }
 //#endregion
-export { HOOK_PLATFORMS, claudeCodeSessionId, openLink, runHook, subagentTranscript };
+export { HOOK_PLATFORMS, claudeCodeSessionId, hookFallback, openLink, parsePayload, runHook, subagentTranscript };

package/dist/{host-BsLqiI0_.js → host-DkaCYnnc.js}

@@ -1,9 +1,9 @@
-import { A as formatOpsEntry, B as waitingForRef, C as SURVEY_SECTION, D as configSchema, E as WORK_STATUS, F as parseRef, I as refExample, L as refMainline, M as mainlineSchema, N as opsEntrySchema, O as decisionSchema, P as parseOpsLine, R as sessionSchema, S as SURVEY_LINES, T as TASK_SECTIONS, b as SESSION_STATUS, c as FINDING_STATUS, d as ISSUE_SECTIONS, g as MERGE_STATES, h as MAINLINE_STATUS, i as DECISION_SECTIONS, j as issueSchema, k as findingSchema, m as MAINLINE_SECTIONS, n as CLOSED_STATUS, o as DEFAULT_CATEGORIES, r as DECIDERS, s as FINDING_SECTIONS, t as CHECKLIST_REF, v as REF_EXAMPLES, w as TASK_REQUIRED_SECTIONS, x as SLUG, y as RESERVED_HUB_NAMES, z as taskSchema } from "./dist-BrotcvKi.js";
+import { A as findingSchema, B as taskSchema, C as SURVEY_LINES, D as WORK_STATUS, E as TASK_SECTIONS, F as parseOpsLine, G as describeRequest, I as parseRef, J as grantRepo, K as grantCovers, L as refExample, M as issueSchema, N as mainlineSchema, O as configSchema, P as opsEntrySchema, R as refMainline, S as SLUG, T as TASK_REQUIRED_SECTIONS, V as waitingForRef, Y as parseGrantTarget, _ as MERGE_STATES, a as DECISION_SECTIONS, b as RESERVED_HUB_NAMES, c as FINDING_SECTIONS, f as ISSUE_SECTIONS, g as MAINLINE_STATUS, h as MAINLINE_SECTIONS, i as DECISION_BASES, j as formatOpsEntry, k as decisionSchema, l as FINDING_STATUS, n as CLOSED_STATUS, q as grantForm, r as DECIDERS, s as DEFAULT_CATEGORIES, t as CHECKLIST_REF, w as SURVEY_SECTION, x as SESSION_STATUS, y as REF_EXAMPLES, z as sessionSchema } from "./dist-Dy45myuN.js";
 import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { parse, stringify } from "yaml";
+import { parse as parse$1, stringify } from "yaml";
 //#region ../core/dist/paths.js
 const DATA_DIR = ".mainflow";
 const ENTRY_DIR = /^([mtdif]\d{3})-(.+)$/;
@@ -64,7 +64,7 @@ function splitFrontMatter(source) {
 		body: source
 	};
 	return {
-		data: parse(match[1] ?? ""),
+		data: parse$1(match[1] ?? ""),
 		body: source.slice(match[0].length)
 	};
 }
@@ -145,7 +145,7 @@ const toYaml = (data) => stringify(data, { lineWidth: 0 });
 function readYaml(file, schema) {
 	const text = readFileSync(file, "utf8");
 	return {
-		data: validate(schema, parse(text), file),
+		data: validate(schema, parse$1(text), file),
 		version: contentHash(text)
 	};
 }
@@ -154,7 +154,7 @@ function mutateYaml(root, file, schema, mutate, expectedVersion) {
 	return withLock(root, () => {
 		const text = readFileSync(file, "utf8");
 		if (expectedVersion && contentHash(text) !== expectedVersion) throw new ConflictError(`${file} changed since it was read; reload and retry`);
-		const data = validate(schema, parse(text), file);
+		const data = validate(schema, parse$1(text), file);
 		mutate(data);
 		const next = validate(schema, data, file);
 		writeAtomic(file, toYaml(next));
@@ -491,7 +491,7 @@ function loadHub(root, options = {}) {
 	const read = (file, schema, raw) => {
 		let data = raw;
 		if (data === void 0) try {
-			data = parse(readText(file) ?? "");
+			data = parse$1(readText(file) ?? "");
 		} catch (error) {
 			problems.push({
 				file: rel(file),
@@ -520,6 +520,7 @@ function loadHub(root, options = {}) {
 	const config = read(join(dataDir, "config.yaml"), configSchema);
 	if (!config) throw new HubError("invalid config.yaml", problems);
 	if (config.formatVersion !== 2) throw new HubError(config.formatVersion < 2 ? `data format version ${config.formatVersion} is older than this CLI's (2); run "mainflow migrate --dry-run" to preview the conversion, then "mainflow migrate"` : `data format version ${config.formatVersion} is newer than this CLI supports (2); install the matching mainflow version in this hub`, problems);
+	problems.push(...repoPathProblems(root, config));
 	const categories = /* @__PURE__ */ new Set([...DEFAULT_CATEGORIES, ...config.categories ?? []]);
 	/** Read a Markdown document's front matter against `schema`, with the attributes every document shares. */
 	const readDocument = (file, schema) => {
@@ -568,6 +569,7 @@ function loadHub(root, options = {}) {
 			continue;
 		}
 		checkDirName(mainlineDir, mainline.id);
+		problems.push(...grantProblems(mainline, config));
 		const decisions = [];
 		const decisionsDir = join(mainlineDir, "decisions");
 		for (const name of existsSync(decisionsDir) ? readdirSync(decisionsDir).filter((n) => n.endsWith(".md")).sort() : []) {
@@ -873,6 +875,57 @@ function checkReferences(input) {
 		});
 	}
 }
+/**
+* A listed repository counts as part of the hub, so the PreToolUse hook lets grants act inside it. A path that
+* resolves to / or to a directory above the hub would put everything under it in scope. A path that does not
+* exist is fine: another machine may not have cloned that repository yet.
+*/
+function repoPathProblems(root, config) {
+	const real = (path) => {
+		try {
+			return realpathSync(path);
+		} catch {
+			return null;
+		}
+	};
+	const hub = real(root) ?? root;
+	return Object.entries(config.repos).flatMap(([name, path]) => {
+		const dir = real(resolve(root, path));
+		if (dir === null) return [];
+		const problem = (message) => [{
+			file: `${DATA_DIR}/config.yaml`,
+			field: `repos.${name}`,
+			message
+		}];
+		if (dir === parse(dir).root) return problem(`"${path}" resolves to the file system root; list the repository's own directory`);
+		if (hub.startsWith(dir.endsWith(sep) ? dir : dir + sep)) return problem(`"${path}" resolves to ${dir}, above the hub; list the repository's own directory`);
+		return [];
+	});
+}
+/**
+* What the schema cannot see about a mainline's grants: ids must be unique, since the file is edited directly,
+* and a target that names a repository must name one listed in config.yaml.
+*/
+function grantProblems(mainline, config) {
+	const problems = [];
+	const seen = /* @__PURE__ */ new Set();
+	mainline.grants?.forEach((grant, i) => {
+		if (seen.has(grant.id)) problems.push({
+			file: mainline.file,
+			field: `grants.${i}.id`,
+			message: `${grant.id} is used twice; give it the next free id`
+		});
+		seen.add(grant.id);
+		const parsed = parseGrantTarget(grant.action, grant.target);
+		const repo = parsed.ok ? grantRepo(parsed.target) : void 0;
+		if (repo !== void 0 && !(repo in config.repos)) problems.push({
+			file: mainline.file,
+			field: `grants.${i}.target`,
+			message: `repo "${repo}" is not listed in config.yaml; use one of ${Object.keys(config.repos).join(", ") || "(none registered)"}`
+		});
+	});
+	return problems;
+}
 const isOpen$2 = (kind, status) => !CLOSED_STATUS[kind].includes(status);
 /**
 * What a reader without the conversation needs to pick the work up: an open mainline with tasks says what
@@ -1171,6 +1224,107 @@ function decorateReply(text, context) {
 /** Cheap test for text that decorateReply could change, so a display hook can skip loading the hub. */
 const mayDecorate = (text) => /m\d{3}|[if]\d{3}|\.mainflow\/mainlines/.test(text) || endsWithMarker(text);
 //#endregion
+//#region ../core/dist/grants.js
+/** Mainline statuses whose grants apply. */
+const GRANTING_STATUS = ["active", "planning"];
+/**
+* The grants in effect for a session. Reading a mainline that is missing or invalid throws, so a caller that
+* must fail closed catches it and asks.
+*/
+function grantScope(root, session) {
+	if (!session) return {
+		ok: false,
+		reason: "這場會話沒有 mainflow 紀錄"
+	};
+	const doing = session.actions.filter((a) => a.status === "doing");
+	if (doing.length === 0) return {
+		ok: false,
+		reason: `${session.id} 沒有進行中的行動`
+	};
+	if (doing.length > 1) return {
+		ok: false,
+		reason: `${session.id} 同時有 ${doing.length} 個進行中的行動（${doing.map((a) => a.id).join("、")}），分不出授權範圍`
+	};
+	const action = doing[0];
+	const mainlines = [...new Set(action.serves.flatMap((ref) => {
+		const parsed = parseRef(ref);
+		const mainline = parsed ? refMainline(parsed) : void 0;
+		return mainline ? [mainline] : [];
+	}))];
+	if (mainlines.length === 0) return {
+		ok: false,
+		reason: `${action.id} 沒有服務任何 checklist 項目`
+	};
+	const grants = [];
+	const served = {};
+	const closed = [];
+	for (const id of mainlines) {
+		const mainline = readFrontMatter(mainlineFile(root, id), mainlineSchema).data;
+		if (!GRANTING_STATUS.includes(mainline.status)) {
+			closed.push(`${id} 是 ${mainline.status}`);
+			continue;
+		}
+		served[id] = action.serves.find((ref) => ref.startsWith(`${id}/`));
+		for (const grant of mainline.grants ?? []) grants.push({
+			mainline: id,
+			grant,
+			ref: `${id}#${grant.id}`
+		});
+	}
+	if (Object.keys(served).length === 0) return {
+		ok: false,
+		reason: `${action.id} 服務的主脈絡已不在進行中（${closed.join("、")}），授權不再生效`
+	};
+	return {
+		ok: true,
+		scope: {
+			action,
+			grants,
+			served
+		}
+	};
+}
+/** Every request must be covered by some grant in scope; the first one that is not is named in the reason. */
+function matchGrants(scope, requests) {
+	const matches = [];
+	for (const request of requests) {
+		const grant = scope.grants.find((g) => {
+			const parsed = parseGrantTarget(g.grant.action, g.grant.target);
+			return parsed.ok && grantCovers(parsed.target, request);
+		});
+		if (!grant) return {
+			ok: false,
+			reason: `${Object.keys(scope.served).join("、")} 沒有涵蓋 ${describeRequest(request)} 的授權`
+		};
+		matches.push({
+			request,
+			grant
+		});
+	}
+	return {
+		ok: true,
+		matches
+	};
+}
+/**
+* One line per grant in effect for the session, for the briefing and the per-turn reminder, with the fixed form
+* the hook allows for it; empty when the session has none or they cannot be read, since a briefing must not fail
+* on them.
+*/
+function grantLines(root, session) {
+	try {
+		const result = grantScope(root, session);
+		if (!result.ok) return [];
+		return result.scope.grants.map((g) => {
+			const parsed = parseGrantTarget(g.grant.action, g.grant.target);
+			const form = parsed.ok ? grantForm(parsed.target) : void 0;
+			return `- ${g.ref} ${g.grant.action} ${g.grant.target}${form ? `：${form}` : ""}`;
+		});
+	} catch {
+		return [];
+	}
+}
+//#endregion
 //#region ../core/dist/sessions.js
 const sessionsDir = (root) => join(root, DATA_DIR, "local", "sessions");
 const sessionFile = (root, id) => join(sessionsDir(root), `${id}.yaml`);
@@ -1192,7 +1346,7 @@ function loadSessions(root) {
 		const file = join(dir, name);
 		let data;
 		try {
-			data = parse(readText(file) ?? "");
+			data = parse$1(readText(file) ?? "");
 		} catch (error) {
 			problems.push({
 				file: relative(root, file),
@@ -1544,6 +1698,8 @@ function sessionBriefing(root, session, options) {
 	} else {
 		lines.push(doing ? `目前行動：${doing.id} ${doing.do}` : "目前沒有進行中的行動。");
 		if (doing) lines.push(`服務：${servedLine(root, doing)}`);
+		const grants = grantLines(root, session);
+		if (grants.length > 0) lines.push("目前行動服務的主脈絡預先授權了這些動作：", ...grants);
 		if (upcoming.length > 0) lines.push(`接下來：${upcoming.map((a) => `${a.id} ${a.do}`).join("、")}`);
 		const blocked = session.actions.filter((a) => a.status === "blocked");
 		if (blocked.length > 0) lines.push(`等外部條件：${blocked.map(waitingLine).join("；")}`);
@@ -1562,9 +1718,12 @@ function turnReminder(root, session, options) {
 	const blocked = session.actions.filter((a) => a.status === "blocked");
 	const head = doing ? `[mainflow] 目前行動 ${doing.id} ${doing.do}，服務 ${doing.serves.join("、") || "（未指定）"}。這一輪的工作若不屬於它，先調整佇列再做。` : open.length > 0 ? `[mainflow] ${session.id} 目前沒有進行中的行動。` : blocked.length > 0 ? `[mainflow] ${session.id} 的行動在等外部條件：${blocked.map(waitingLine).join("；")}。條件出現後用 ${options.cli} action set <a編號> --status doing 繼續；要先做別的事，用 ${options.cli} action add 列出行動。` : `[mainflow] ${session.id} 的行動都已結束。繼續工作前先用 ${options.cli} action add 列出下一個行動。`;
 	const header = headerLine(session);
+	const marker = header ? [`- 這一輪最後一則回覆的最後一行寫「${header}」，回覆範例等其他內容都放在它前面。有顯示 hook 時，它會換成標題與連結。`] : [];
+	const grants = grantLines(root, session);
 	return [
 		head,
-		...header ? [`- 這一輪最後一則回覆的最後一行寫「${header}」，回覆範例等其他內容都放在它前面。有顯示 hook 時，它會換成標題與連結。`] : [],
+		...grants.length > 0 ? ["- 目前行動服務的主脈絡預先授權了這些動作：", ...grants.map((g) => `  ${g}`)] : [],
+		...marker,
 		...queueWarnings(root, session, options.cli).map((w) => `- ${w}`)
 	].join("\n");
 }
@@ -1810,6 +1969,7 @@ function createDecision(root, mainline, input) {
 	requireSlug(input.slug);
 	const status = requireOneOf(input.status ?? "accepted", ["proposed", "accepted"], "new decision status");
 	const by = input.by === void 0 ? void 0 : requireOneOf(input.by, DECIDERS, "decided by");
+	const basis = input.basis === void 0 ? void 0 : requireOneOf(input.basis, DECISION_BASES, "decision basis");
 	for (const ref of input.affects ?? []) requireAffected(root, mainline, ref);
 	return withLock(root, () => {
 		const dir = join(mainlineDir(root, mainline), "decisions");
@@ -1823,6 +1983,7 @@ function createDecision(root, mainline, input) {
 			status,
 			...status === "accepted" ? { decidedAt: at } : {},
 			...by ? { by } : {},
+			...basis ? { basis } : {},
 			...input.affects?.length ? { affects: input.affects } : {}
 		}, "decision");
 		const file = join(dir, `${id}-${input.slug}.md`);
@@ -1846,15 +2007,17 @@ const parseRefIn = (input) => {
 		task: task[2]
 	} : null;
 };
-/** Settle a proposed decision: record who decided and when; the items it affects stop waiting for it. */
-function acceptDecision(root, refInput, by, expectedVersion) {
+/** Settle a proposed decision: record who decided, how and when; the items it affects stop waiting for it. */
+function acceptDecision(root, refInput, settlement = {}, expectedVersion) {
 	const ref = requireRef(refInput, "decision");
-	const decider = by === void 0 ? void 0 : requireOneOf(by, DECIDERS, "decided by");
+	const decider = settlement.by === void 0 ? void 0 : requireOneOf(settlement.by, DECIDERS, "decided by");
+	const basis = settlement.basis === void 0 ? void 0 : requireOneOf(settlement.basis, DECISION_BASES, "decision basis");
 	return mutateFrontMatter(root, decisionFile(root, ref.mainline, ref.decision), decisionSchema, (d) => {
 		if (d.status !== "proposed") throw new WriteError(`${refInput} is ${d.status}; only a proposed decision can be accepted`);
 		d.status = "accepted";
 		d.decidedAt = nowMinute();
 		if (decider) d.by = decider;
+		if (basis) d.basis = basis;
 	}, expectedVersion);
 }
 function supersedeDecision(root, refInput, by, expectedVersion) {
@@ -1968,7 +2131,7 @@ function migrateHub(root, options = {}) {
 	if (!existsSync(configFile)) throw new WriteError(`no hub at ${root}; run mainflow init first`);
 	const rel = (path) => relative(root, path);
 	return withLock(root, () => {
-		const config = parse(readFileSync(configFile, "utf8"));
+		const config = parse$1(readFileSync(configFile, "utf8"));
 		const from = Number(config.formatVersion);
 		if (from === 2) throw new WriteError(`${rel(configFile)} is already format 2; nothing to migrate`);
 		if (from !== 1) throw new WriteError(`cannot migrate from format ${String(config.formatVersion)}; this CLI migrates format 1 to 2`);
@@ -1981,7 +2144,7 @@ function migrateHub(root, options = {}) {
 		for (const mainlineDir of subdirs(join(dataDir, "mainlines"))) {
 			const yamlFile = join(mainlineDir, "mainline.yaml");
 			if (!existsSync(yamlFile)) continue;
-			const m = parse(readFileSync(yamlFile, "utf8"));
+			const m = parse$1(readFileSync(yamlFile, "utf8"));
 			dropNull(m, "archivedAt");
 			if (isClosed("mainline", m.status) && m.archivedAt) m.closedAt = m.archivedAt;
 			const criteria = (m.criteria ?? []).map(migrateListItem);
@@ -1998,7 +2161,7 @@ function migrateHub(root, options = {}) {
 			for (const taskDir of subdirs(join(mainlineDir, "tasks"))) {
 				const taskYaml = join(taskDir, "task.yaml");
 				if (!existsSync(taskYaml)) continue;
-				const t = parse(readFileSync(taskYaml, "utf8"));
+				const t = parse$1(readFileSync(taskYaml, "utf8"));
 				const content = typeof t.content === "string" ? t.content.trim() : "";
 				drop(t, "content");
 				dropNull(t, "parent", "repo");
@@ -2191,4 +2354,4 @@ function openInApp(hub, target, closeAfterMs = 150) {
 	return true;
 }
 //#endregion
-export { setFindingStatus as $, addAction as A, transcriptPath as B, setCriterionText as C, updateTask as D, supersedeDecision as E, setSessionArchived as F, mayDecorate as G, decorateReply as H, setSessionInfo as I, createFinding as J, appendOps as K, setSessionStatus as L, handoffSession as M, loadSessions as N, sessionBriefing as O, readSession as P, setFindingArchived as Q, settleSession as R, setCriterion as S, setMainlineTitle as T, endsWithMarker as U, updateAction as V, headerLine as W, planIssue as X, createIssue as Y, reopenIssue as Z, createTask as _, openInApp as a, linksInto as at, setArchived as b, syncHost as c, TASK_FILE as ct, setArchivedMany as d, DATA_DIR as dt, setIssueArchived as et, acceptDecision as f, currentBranch as ft, createMainline as g, createDecision as h, hostName as i, mainlineEdges as it, ensureSession as j, turnReminder as k, migrateHub as l, ConflictError as lt, addRepo as m, worktreesOf as mt, DEFAULT_UI_PORT as n, loadHub as nt, removeHostLink as o, refIndex as ot, addHub as p, findHubRoot as pt, closeIssue as q, caddySites as r, dependencyGraph as rt, siteBlock as s, MAINLINE_FILE as st, APP_BUNDLE_ID as t, HubError as tt, ARCHIVE_KINDS as u, WriteError as ut, dropChecklistItem as v, setMainlineStatus as w, setChecklistItem as x, initHub as y, startSession as z };
+export { reopenIssue as $, addAction as A, transcriptPath as B, setCriterionText as C, updateTask as D, supersedeDecision as E, setSessionArchived as F, endsWithMarker as G, grantScope as H, setSessionInfo as I, appendOps as J, headerLine as K, setSessionStatus as L, handoffSession as M, loadSessions as N, sessionBriefing as O, readSession as P, planIssue as Q, settleSession as R, setCriterion as S, setMainlineTitle as T, matchGrants as U, updateAction as V, decorateReply as W, createFinding as X, closeIssue as Y, createIssue as Z, createTask as _, worktreesOf as _t, openInApp as a, dependencyGraph as at, setArchived as b, syncHost as c, refIndex as ct, setArchivedMany as d, ConflictError as dt, setFindingArchived as et, acceptDecision as f, WriteError as ft, createMainline as g, findHubRoot as gt, createDecision as h, currentBranch as ht, hostName as i, loadHub as it, ensureSession as j, turnReminder as k, migrateHub as l, MAINLINE_FILE as lt, addRepo as m, DATA_DIR as mt, DEFAULT_UI_PORT as n, setIssueArchived as nt, removeHostLink as o, mainlineEdges as ot, addHub as p, readYaml as pt, mayDecorate as q, caddySites as r, HubError as rt, siteBlock as s, linksInto as st, APP_BUNDLE_ID as t, setFindingStatus as tt, ARCHIVE_KINDS as u, TASK_FILE as ut, dropChecklistItem as v, setMainlineStatus as w, setChecklistItem as x, initHub as y, startSession as z };

package/dist/host.js

@@ -1,2 +1,2 @@
-import { a as openInApp, c as syncHost, i as hostName, n as DEFAULT_UI_PORT, o as removeHostLink, r as caddySites, s as siteBlock, t as APP_BUNDLE_ID } from "./host-BsLqiI0_.js";
+import { a as openInApp, c as syncHost, i as hostName, n as DEFAULT_UI_PORT, o as removeHostLink, r as caddySites, s as siteBlock, t as APP_BUNDLE_ID } from "./host-DkaCYnnc.js";
 export { APP_BUNDLE_ID, DEFAULT_UI_PORT, caddySites, hostName, openInApp, removeHostLink, siteBlock, syncHost };

package/dist/index-CV30LkNZ.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+//#region ../schema/dist/index.d.ts
+declare const FORMAT_VERSION = 2;
+declare const ID_PATTERNS: {
+  readonly mainline: RegExp;
+  readonly task: RegExp;
+  readonly checklistItem: RegExp;
+  readonly criterion: RegExp;
+  readonly decision: RegExp;
+  readonly action: RegExp;
+  readonly issue: RegExp;
+  readonly finding: RegExp;
+  readonly grant: RegExp;
+};
+declare const CHECKLIST_REF: RegExp;
+declare const SLUG: RegExp;
+/** One source the survey checks: the line's label, what it holds, and how it may be left unchecked. */
+interface SurveyLine {
+  label: string;
+  holds: string;
+  /** The word that marks the source as not checked, followed by the reason, e.g. 不適用：{理由}. Absent when the source is always checked. */
+  skip?: string;
+  /** Text a checked line must contain, e.g. the environment a spike ran in. */
+  requires?: string;
+}
+//#endregion
+export { SurveyLine as a, SLUG as i, FORMAT_VERSION as n, ID_PATTERNS as r, CHECKLIST_REF as t };

package/dist/{launch-CBXoFsFC.js → launch-DOX1TTGx.js}

@@ -1,4 +1,4 @@
-import { c as syncHost, dt as DATA_DIR, i as hostName, n as DEFAULT_UI_PORT, o as removeHostLink, ut as WriteError } from "./host-BsLqiI0_.js";
+import { c as syncHost, ft as WriteError, i as hostName, mt as DATA_DIR, n as DEFAULT_UI_PORT, o as removeHostLink } from "./host-DkaCYnnc.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
@@ -176,7 +176,7 @@ async function launchUi(root, hub, configured, options) {
 	}
 	let server;
 	if (!reuse) {
-		const { serveUi } = await import("./ui-ngIAww3a.js");
+		const { serveUi } = await import("./ui-Do7fLlUC.js");
 		server = await serveUi(root, choice.port);
 		writeUiRecord(root, {
 			port: choice.port,

package/dist/launch.js

@@ -1,2 +1,2 @@
-import { a as portCandidates, c as watchHubGone, i as networkProbe, n as choosePort, o as readUiRecord, r as launchUi, s as startUiInBackground, t as PORT_SPAN } from "./launch-CBXoFsFC.js";
+import { a as portCandidates, c as watchHubGone, i as networkProbe, n as choosePort, o as readUiRecord, r as launchUi, s as startUiInBackground, t as PORT_SPAN } from "./launch-DOX1TTGx.js";
 export { PORT_SPAN, choosePort, launchUi, networkProbe, portCandidates, readUiRecord, startUiInBackground, watchHubGone };

package/dist/{ui-ngIAww3a.js → ui-Do7fLlUC.js}

@@ -1,6 +1,6 @@
-import { B as transcriptPath, D as updateTask, F as setSessionArchived, N as loadSessions, P as readSession, Q as setFindingArchived, S as setCriterion, T as setMainlineTitle, a as openInApp, at as linksInto, b as setArchived, d as setArchivedMany, dt as DATA_DIR, et as setIssueArchived, it as mainlineEdges, lt as ConflictError, nt as loadHub, ot as refIndex, rt as dependencyGraph, u as ARCHIVE_KINDS, ut as WriteError, w as setMainlineStatus, x as setChecklistItem } from "./host-BsLqiI0_.js";
+import { B as transcriptPath, D as updateTask, F as setSessionArchived, N as loadSessions, P as readSession, S as setCriterion, T as setMainlineTitle, a as openInApp, at as dependencyGraph, b as setArchived, ct as refIndex, d as setArchivedMany, dt as ConflictError, et as setFindingArchived, ft as WriteError, it as loadHub, mt as DATA_DIR, nt as setIssueArchived, ot as mainlineEdges, st as linksInto, u as ARCHIVE_KINDS, w as setMainlineStatus, x as setChecklistItem } from "./host-DkaCYnnc.js";
 import { t as listProgress } from "./progress-1BfPg2zN.js";
-import { l as CLI_VERSION } from "./launch-CBXoFsFC.js";
+import { l as CLI_VERSION } from "./launch-DOX1TTGx.js";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, watch } from "node:fs";
 import { basename, dirname, extname, join, normalize, relative, sep } from "node:path";