@deftai/directive-content 0.87.0 → 0.88.0

package/tasks/engine-invoke.test.cjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const { describe, it } = require("node:test");
+const {
+  shellSplit,
+  quoteWin32Arg,
+  buildSpawnPlan,
+  WIN32_CMD_METACHAR_RE,
+} = require("./engine-invoke.cjs");
+
+const WIN32 = { platform: "win32", nodePath: "/node" };
+const POSIX = { platform: "linux", nodePath: "/node" };
+
+/**
+ * Split a `cmd.exe`-quoted command line into top-level tokens, honouring
+ * double-quote grouping and the `""` escaped-quote convention. Used to assert
+ * that a metacharacter-bearing arg survives as exactly one argv token and is
+ * never seen by cmd.exe as a command separator.
+ * @param {string} line
+ */
+function splitCmdTokens(line) {
+  const tokens = [];
+  let cur = "";
+  let inQuote = false;
+  let started = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (inQuote) {
+      if (c === '"') {
+        if (line[i + 1] === '"') {
+          cur += '"';
+          i++;
+          continue;
+        }
+        inQuote = false;
+        continue;
+      }
+      cur += c;
+      continue;
+    }
+    if (c === '"') {
+      inQuote = true;
+      started = true;
+      continue;
+    }
+    if (c === " ") {
+      if (started) {
+        tokens.push(cur);
+        cur = "";
+        started = false;
+      }
+      continue;
+    }
+    started = true;
+    cur += c;
+  }
+  if (started) {
+    tokens.push(cur);
+  }
+  return tokens;
+}
+
+describe("shellSplit", () => {
+  it("keeps quoted free-text (apostrophes, spaces, metachars) as one token", () => {
+    assert.deepEqual(shellSplit(`release --summary "It's a & test"`), [
+      "release",
+      "--summary",
+      "It's a & test",
+    ]);
+  });
+});
+
+describe("quoteWin32Arg", () => {
+  it("passes safe tokens through unquoted", () => {
+    assert.equal(quoteWin32Arg("release"), "release");
+    assert.equal(quoteWin32Arg("--summary=fixed"), "--summary=fixed");
+  });
+
+  it("double-quotes whitespace, quotes, and cmd.exe metacharacters", () => {
+    assert.equal(quoteWin32Arg("a b"), '"a b"');
+    assert.equal(quoteWin32Arg("a&b"), '"a&b"');
+    assert.equal(quoteWin32Arg("a|b"), '"a|b"');
+    assert.equal(quoteWin32Arg("a>b"), '"a>b"');
+    assert.equal(quoteWin32Arg("a<b"), '"a<b"');
+    assert.equal(quoteWin32Arg("(a)"), '"(a)"');
+    assert.equal(quoteWin32Arg("%PATH%"), '"%PATH%"');
+    assert.equal(quoteWin32Arg("a^b"), '"a^b"');
+    assert.equal(quoteWin32Arg("a!b"), '"a!b"');
+  });
+
+  it("escapes embedded double quotes by doubling", () => {
+    assert.equal(quoteWin32Arg('a"b'), '"a""b"');
+  });
+
+  it("regex flags every cmd.exe separator", () => {
+    for (const meta of [" ", '"', "&", "|", "<", ">", "^", "(", ")", "%", "!"]) {
+      assert.ok(WIN32_CMD_METACHAR_RE.test(`x${meta}y`), meta);
+    }
+  });
+});
+
+describe("buildSpawnPlan — win32 global (subprocess-scm-01 / #2911)", () => {
+  it("never uses shell:true and routes through cmd.exe /d /s /c", () => {
+    const plan = buildSpawnPlan("global", "deft", ["release"], WIN32);
+    assert.equal(plan.shell, false);
+    assert.equal(plan.command, "cmd.exe");
+    assert.deepEqual(plan.args.slice(0, 3), ["/d", "/s", "/c"]);
+    assert.equal(plan.args[3], "deft release");
+  });
+
+  it("keeps injection-shaped free-text args as a single quoted token", () => {
+    const injections = [
+      "& calc.exe",
+      "&calc",
+      "| whoami",
+      "&& shutdown /s",
+      "; rm -rf /",
+      "$(reboot)",
+      "`reboot`",
+      "> C:\\pwn.txt",
+      "< C:\\secret",
+      "(malicious)",
+      "%USERPROFILE%",
+      "^escaped",
+      "!DELAYED!",
+    ];
+    for (const evil of injections) {
+      const plan = buildSpawnPlan("global", "deft", ["release", "--summary", evil], WIN32);
+      assert.equal(plan.shell, false, evil);
+      const commandLine = plan.args[3];
+      const tokens = splitCmdTokens(commandLine);
+      // deft + release + --summary + evil == 4 top-level tokens, evil intact.
+      assert.deepEqual(tokens, ["deft", "release", "--summary", evil], `injection ${evil}`);
+      // Any cmd.exe metacharacter must be neutralised inside a quoted span so it
+      // can never act as a bare command separator (POSIX-only chars like the
+      // backtick are literal to cmd.exe and need no quoting).
+      if (WIN32_CMD_METACHAR_RE.test(evil)) {
+        assert.ok(commandLine.includes(`"${evil.replace(/"/g, '""')}"`), `quoted ${evil}`);
+      }
+    }
+  });
+
+  it("routes end-to-end from a quoted DEFT_ENGINE_CMD string", () => {
+    const argv = shellSplit('release --summary "pwn & calc | whoami"');
+    const plan = buildSpawnPlan("global", "directive", argv, WIN32);
+    assert.equal(plan.shell, false);
+    assert.deepEqual(splitCmdTokens(plan.args[3]), [
+      "directive",
+      "release",
+      "--summary",
+      "pwn & calc | whoami",
+    ]);
+  });
+
+  it("leaves safe args unquoted for readability", () => {
+    const plan = buildSpawnPlan("global", "deft", ["session:start", "--json"], WIN32);
+    assert.equal(plan.args[3], "deft session:start --json");
+  });
+});
+
+describe("buildSpawnPlan — other paths keep shell:false", () => {
+  it("win32 vendored spawns node directly (no cmd.exe, no shell)", () => {
+    const plan = buildSpawnPlan("vendored", "/bin.js", ["release", "a&b"], WIN32);
+    assert.equal(plan.shell, false);
+    assert.equal(plan.command, "/node");
+    assert.deepEqual(plan.args, ["/bin.js", "release", "a&b"]);
+  });
+
+  it("posix global spawns the shim directly with shell:false", () => {
+    const plan = buildSpawnPlan("global", "deft", ["release", "a&b"], POSIX);
+    assert.equal(plan.shell, false);
+    assert.equal(plan.command, "deft");
+    assert.deepEqual(plan.args, ["release", "a&b"]);
+  });
+
+  it("posix vendored spawns node with shell:false", () => {
+    const plan = buildSpawnPlan("vendored", "/bin.js", ["release"], POSIX);
+    assert.equal(plan.shell, false);
+    assert.equal(plan.command, "/node");
+    assert.deepEqual(plan.args, ["/bin.js", "release"]);
+  });
+
+  it("returns null for unknown modes (caller exits 2)", () => {
+    assert.equal(buildSpawnPlan("bogus", "deft", ["release"], WIN32), null);
+  });
+});

package/tasks/verify.yml

@@ -59,6 +59,13 @@ tasks:
         vars:
           ENGINE_CMD: 'verify-content-manifest --project-root "{{.DEFT_ROOT}}"'
 
+  license-sync:
+    desc: "Drift guard for root LICENSE ↔ content/LICENSE.md and published package.json license fields (#2902). Three-state exit (0 clean / 1 drift / 2 config). Framework-source only."
+    # Framework-source-only gate: reads THIS repo's LICENSE + package manifests.
+    # Plain node script (no engine build required).
+    cmds:
+      - node "{{.DEFT_ROOT}}/scripts/verify-license-sync.mjs" --project-root "{{.DEFT_ROOT}}"
+
   skill-external-fetch-gate:
     desc: "Verify shipped skills do not pair external fetch/follow-through with execute/install without Security context mitigation (#1936 / #1532)."
     deps:

package/templates/agent-prompt-preamble.md

@@ -529,6 +529,12 @@ Every worker MUST send a final status message before exiting its tool loop, rega
 
 ⊗ Emit `DONE` from a `drive-to: merge-ready` worker while merge-ready is false — a false-terminal `DONE` pulls the cohort monitor into inline Greptile fixes and violates Gap D (#2843 monitor-as-implementer recurrence).
 
+! **Thin DONE is not success (#2943):** A terminal message that lacks PR URL / merge evidence (no `PR #N`, no PR URL, no merge confirmation) is a **thin DONE** / failed-leaf signal for the parent monitor — re-dispatch or take over after ground truth. Prefer structured completion fields when the host supplies them (`prUrl`, `mergeStatus`, `emptyDiff`). Workers MUST NOT exit with mid-edit prose and call it `DONE` when the envelope required a PR or merge-ready outcome.
+
+! **Parent tool-first after leaf completion (#2943):** When a parent / monitor receives a leaf completion event (`subagent_announce`, parent-push, or host completion notify), its **first response** MUST be a **tool-first** ground-truth batch (`gh` / `git` / worktree or file status) **or** a host **yield** (`sessions_yield` on OpenClaw, or equivalent). ⊗ Multi-sentence progress-only first response with zero tools / yield — the OpenClaw text-repetition hang class (#2943).
+
+⊗ Treat thin DONE (no PR URL / merge evidence) as success (#2943).
+
 Per-step acks during the run are noise. ONE start message, ONE final message; intermediate messages only on `BLOCKED` / `FAILED`. The final message lets the dispatcher distinguish a clean exit from a silent timeout when the lifecycle event arrives.
 
 ## 12. Session ritual + `task verify:cache-fresh` gates before `start_agent` (#1348 / #1127)

package/vbrief/vbrief.md

@@ -1,10 +1,12 @@
 # vBRIEF Usage in Deft
 
-Canonical reference for vBRIEF file conventions within Deft-managed projects.
+> **Public name (#2907):** The sole current work-state name is **xBRIEF** under `xbrief/` (`.xbrief.json`). **vBRIEF** / `vbrief/` / `.vbrief.json` in this document are **legacy / schema-lineage** names (this path still hosts core schemas). Prefer xbrief in product docs and new guidance. Authoritative rename/history: [UPGRADING.md — xBRIEF rename](../UPGRADING.md#xbrief-rename-2034--2110--2907). Migrate on-disk layouts with `deft migrate:xbrief`.
+
+Canonical **schema and convention** reference for durable work-state files within Deft-managed projects (historical filename: vBRIEF).
 
 Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
-**⚠️ See also**: [context/working-memory.md](../context/working-memory.md) | [resilience/continue-here.md](../resilience/continue-here.md) | [context/long-horizon.md](../context/long-horizon.md) | [glossary.md](../glossary.md)
+**⚠️ See also**: [glossary.md](../glossary.md) | [UPGRADING.md — xBRIEF rename](../UPGRADING.md#xbrief-rename-2034--2110--2907) | [context/working-memory.md](../context/working-memory.md) | [resilience/continue-here.md](../resilience/continue-here.md)
 
 ---