@deftai/directive-core 0.103.0 → 0.104.0

package/dist/authz/classify.js

@@ -245,10 +245,27 @@ const DOWNLOADER_DECODER_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual after #3336: nc/7zz/msgfmt peers + plant writers.
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
 ]);
 /**
  * Archive extractors / alt writers that can plant via pathish operands without
- * shell redirects (#3245 / #3288 / #3311 / #3336). Used for pathish authz/kill scans (prefer deny)
+ * shell redirects (#3245 / #3288 / #3311 / #3336 / #3354). Used for pathish authz/kill scans (prefer deny)
  * and write-shape residual under UAT — not bare curl-class URL fetches.
  */
 const ARCHIVE_ALT_WRITE_BINS = new Set([
@@ -304,9 +321,26 @@ const ARCHIVE_ALT_WRITE_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual after #3336.
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
 ]);
 /**
- * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336).
+ * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336 / #3354).
  * Prefer a Set over a long `||` chain so coverage counts one membership check, not N branches.
  */
 const PROTECTED_POSITIONAL_BINS = new Set([
@@ -352,13 +386,35 @@ const PROTECTED_POSITIONAL_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual: positional dest writers (nc/7zz/unrar/ftpget/crane/objcopy/sqlite3).
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
 ]);
 /** wget family (directory-prefix dest flags). */
 const WGET_FAMILY_BINS = new Set(["wget", "wget2"]);
 /** aria2 family (dir dest flags). */
 const ARIA2_FAMILY_BINS = new Set(["aria2c", "aria2"]);
-/** 7z family (attached -oDIR only). */
-const SEVEN_Z_FAMILY_BINS = new Set(["7z", "7za", "7zr"]);
+/** 7z family (attached -oDIR only). Includes 7zz (#3354). */
+const SEVEN_Z_FAMILY_BINS = new Set(["7z", "7za", "7zr", "7zz"]);
+/** aunpack / atool extract-to dest flags (#3354). */
+const ATOOL_FAMILY_BINS = new Set(["aunpack", "atool"]);
+const ATOOL_DIR_DEST_FLAGS = new Set(["-x", "--extract-to"]);
+/** sqlite3 meta-commands that plant a file dest (#3354). */
+const SQLITE3_OUTPUT_META = [".output", ".once"];
 /** tar family (chdir -C / --directory). Includes GNU/Schily aliases (#3311). */
 const TAR_FAMILY_BINS = new Set(["tar", "bsdtar", "gtar", "star", "gnutar"]);
 /** xh / httpie family (download-dir dest flags) (#3311). */
@@ -474,6 +530,8 @@ function isDownloaderDestFlag(flag, bin, rawFlag) {
         return true;
     if (XH_FAMILY_BINS.has(bin) && XH_DIR_DEST_FLAGS.has(flag))
         return true;
+    if (ATOOL_FAMILY_BINS.has(bin) && ATOOL_DIR_DEST_FLAGS.has(flag))
+        return true;
     return false;
 }
 /**
@@ -646,6 +704,12 @@ function downloaderDecoderDestinations(tokens) {
                     i++;
                     continue;
                 }
+                // aunpack / atool attached -XDIR (#3354)
+                if (ATOOL_FAMILY_BINS.has(bin) && n.startsWith("-x") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
                 // tar attached -CDIR (rare; capital C required)
                 if (TAR_FAMILY_BINS.has(bin) && raw.startsWith("-C") && raw.length > 2) {
                     dests.push(pathishToken(raw.slice(2)));
@@ -696,6 +760,18 @@ function downloaderDecoderDestinations(tokens) {
                     }
                 }
             }
+            // sqlite3 `.output` / `.once` dest (separate token or `.output PATH` in one token) (#3354).
+            if (bin === "sqlite3") {
+                const meta = sqlite3MetaDest(raw, tokens[i + 1]);
+                if (meta !== null) {
+                    dests.push(meta.dest);
+                    if (pathishIsAuthzDir(meta.dest) || pathishMentionsKillSwitch(meta.dest)) {
+                        protectedPathish.push(meta.dest);
+                    }
+                    i += meta.consumedNext ? 2 : 1;
+                    continue;
+                }
+            }
             // scp / certutil / rclone / archive extractors: pathish operands (quote-aware glued-op cut).
             // Under UAT: any `.deft/authz` / kill-switch pathish is fail-closed settings
             // (read vs write thrash deferred — prefer deny over dest-parser perfection; #3213 / #3245).
@@ -727,6 +803,10 @@ function downloaderDecoderDestinations(tokens) {
             dests.push(lastPositionalPath);
         }
     }
+    // #3354: fail-closed dest flags on unknown write-shaped bins (not named-peer only).
+    for (const dest of genericProtectedDests(tokens)) {
+        dests.push(dest);
+    }
     return dests;
 }
 function authzSubcommandFromToken(token) {
@@ -805,6 +885,89 @@ function hasPolicyAuthorityMutator(tokens) {
     return false;
 }
 /** True when pathish token names a kill-switch basename (quote-strip resistant). */
+function pathishIsProtectedDest(pathish) {
+    return pathishIsAuthzDir(pathish) || pathishMentionsKillSwitch(pathish);
+}
+/**
+ * Fail-closed dest harvest for write-shaped Shell under UAT (#3354).
+ * Named-bin parsers above are not the only path: any token that looks like
+ * `-o` / `--output` / `--outfile` / `--output-file` (or attached `-oDIR`)
+ * whose dest is authz/kill-switch is collected even when the bin is unknown.
+ * scp `-o` (OpenSSH option) and cpio `-o` (copy-out) stay excluded.
+ */
+function genericProtectedDests(tokens) {
+    const dests = [];
+    // Track the current command bin — scp `-o` is OpenSSH option, cpio `-o` is copy-out.
+    // Skipping only when the current token itself is `scp`/`cpio` missed later `-o` values (#3354).
+    let currentBin = "";
+    for (let i = 0; i < tokens.length; i++) {
+        const raw = tokens[i];
+        const n = normalizeToken(raw);
+        if (isShellSegmentBreak(raw)) {
+            currentBin = "";
+            continue;
+        }
+        if (!n.startsWith("-")) {
+            if (isDownloaderDecoderBin(raw)) {
+                currentBin = binBareName(raw);
+            }
+            else if (currentBin.length === 0 &&
+                !raw.includes("/") &&
+                !raw.includes("\\") &&
+                n.length > 0) {
+                currentBin = binBareName(raw);
+            }
+        }
+        if (currentBin === "scp" || currentBin === "cpio")
+            continue;
+        if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
+            const eq = raw.indexOf("=");
+            const flag = normalizeToken(raw.slice(0, eq));
+            if (DOWNLOADER_FILE_DEST_FLAGS.has(flag)) {
+                const dest = pathishToken(raw.slice(eq + 1));
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+            continue;
+        }
+        if (n.startsWith("-") &&
+            !n.startsWith("--") &&
+            n.startsWith("-o") &&
+            !n.startsWith("-out") &&
+            n.length > 2) {
+            const dest = pathishToken(raw.slice(2));
+            if (pathishIsProtectedDest(dest))
+                dests.push(dest);
+            continue;
+        }
+        if (DOWNLOADER_FILE_DEST_FLAGS.has(n)) {
+            const next = tokens[i + 1];
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                const dest = pathishToken(next);
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+        }
+    }
+    return dests;
+}
+function sqlite3MetaDest(raw, next) {
+    const p = pathishToken(raw);
+    for (const meta of SQLITE3_OUTPUT_META) {
+        if (p === meta) {
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                return { dest: pathishToken(next), consumedNext: true };
+            }
+            return null;
+        }
+        if (p.startsWith(`${meta} `) || p.startsWith(`${meta}\t`)) {
+            const dest = p.slice(meta.length).trim();
+            if (dest.length > 0 && dest !== "|")
+                return { dest, consumedNext: false };
+        }
+    }
+    return null;
+}
 function pathishMentionsKillSwitch(pathish) {
     for (const name of KILL_SWITCH_BASENAMES) {
         if (pathish === name || pathish.endsWith(`/${name}`) || pathish.includes(name)) {

package/dist/check/gate-lists.d.ts

@@ -10,8 +10,9 @@ export type CheckGateSpec = string | {
     readonly args?: readonly string[];
 };
 /**
- * Product-first AC gate (#3284): always first; soft-missing when no active
- * xBRIEF so framework self-check is not deadlocked without a story.
+ * Product-first AC gate (#3284): always first; `--soft-missing-xbrief` skips
+ * only when no story was active this session. A same-session complete targets
+ * xbrief/completed instead of skipping (#3357).
  */
 export declare const PRODUCT_FIRST_AC_GATE: CheckGateSpec;
 export declare function checkGateId(spec: CheckGateSpec): string;

package/dist/check/gate-lists.js

@@ -1,8 +1,9 @@
 /** Gate execution order mirrors Taskfile.yml check targets (#1713 dogfood). */
 import { PRODUCT_AC_GATE_ID } from "../product-first-done-gate/types.js";
 /**
- * Product-first AC gate (#3284): always first; soft-missing when no active
- * xBRIEF so framework self-check is not deadlocked without a story.
+ * Product-first AC gate (#3284): always first; `--soft-missing-xbrief` skips
+ * only when no story was active this session. A same-session complete targets
+ * xbrief/completed instead of skipping (#3357).
  */
 export const PRODUCT_FIRST_AC_GATE = {
     task: PRODUCT_AC_GATE_ID,
@@ -81,6 +82,8 @@ export const FRAMEWORK_CHECK_GATES = [
     "verify:test-boundary",
     "verify:scope-provenance",
     "verify:consumer-check-contract",
+    // #3362: dead-surface detector (warn-only this release; no --enforce)
+    "verify:telemetry-coverage",
     "verify:vbrief-conformance",
     "verify:destructive-gh-verbs",
     "verify:scm-boundary",

package/dist/check/index.d.ts

@@ -6,4 +6,5 @@ export { extractGateCause, formatDegradedSkipReport, formatNamedCauseFailure, ty
 export type { CheckOrchestratorOptions, CheckOrchestratorSeams } from "./orchestrator.js";
 export { dispatchTaskCheck, isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget, } from "./orchestrator.js";
 export { detectTestRunner, type RunnerDetectResult, runnerDetectionTable, type TestRunnerKind, } from "./runner-detect.js";
+export { type ResolveSessionCompletedAcInput, resolveSessionCompletedVerifyAcTarget, SESSION_COMPLETED_AC_REMEDIATION, SESSION_COMPLETED_MARKER_REL, type SessionCompletedAcTarget, type SessionCompletedMarker, sessionCompletedMarkerPath, writeSessionCompletedMarker, } from "./session-completed-ac.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/check/index.js

@@ -5,4 +5,5 @@ export { CONSUMER_CHECK_GATES, checkGateId, checkGateSpawnArgs, FRAMEWORK_CHECK_
 export { extractGateCause, formatDegradedSkipReport, formatNamedCauseFailure, remedyForGate, } from "./named-cause.js";
 export { dispatchTaskCheck, isFrameworkRepoRoot, isFrameworkSourceContext, resolveCheckTarget, } from "./orchestrator.js";
 export { detectTestRunner, runnerDetectionTable, } from "./runner-detect.js";
+export { resolveSessionCompletedVerifyAcTarget, SESSION_COMPLETED_AC_REMEDIATION, SESSION_COMPLETED_MARKER_REL, sessionCompletedMarkerPath, writeSessionCompletedMarker, } from "./session-completed-ac.js";
 //# sourceMappingURL=index.js.map

package/dist/check/session-completed-ac.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Check composition: verify:ac must not soft-skip after a same-session complete (#3357).
+ *
+ * "No story ever active this session" remains a legitimate skip.
+ * "A story completed this session" targets xbrief/completed (most recent).
+ * One remediation string when that target cannot be used.
+ */
+/** One remediation when check cannot target the just-completed brief (#3357). */
+export declare const SESSION_COMPLETED_AC_REMEDIATION = "Run task verify:ac -- xbrief/completed/<just-completed>.xbrief.json (a story completed this session; check must not soft-skip) (#3357)";
+/** Project-relative marker written by scope:complete for this session (#3357). */
+export declare const SESSION_COMPLETED_MARKER_REL: readonly [".deft", "last-completed.json"];
+export interface SessionCompletedMarker {
+    readonly path: string;
+    readonly sessionId: string;
+    readonly completedAt: string;
+}
+export type SessionCompletedAcTarget = {
+    readonly kind: "none";
+} | {
+    readonly kind: "target";
+    readonly path: string;
+} | {
+    readonly kind: "cannot";
+    readonly message: string;
+};
+export interface ResolveSessionCompletedAcInput {
+    readonly projectRoot: string;
+    readonly sessionId?: string | null;
+    readonly sessionStartedAt?: Date | null;
+    readonly env?: NodeJS.ProcessEnv;
+}
+export declare function sessionCompletedMarkerPath(projectRoot: string): string;
+/** Persist the just-completed brief so check can fail closed if that file is unreadable. */
+export declare function writeSessionCompletedMarker(projectRoot: string, marker: SessionCompletedMarker): void;
+/**
+ * Resolve the just-completed brief for this session, if check must target it.
+ */
+export declare function resolveSessionCompletedVerifyAcTarget(input: ResolveSessionCompletedAcInput): SessionCompletedAcTarget;
+//# sourceMappingURL=session-completed-ac.d.ts.map

package/dist/check/session-completed-ac.js

@@ -0,0 +1,198 @@
+/**
+ * Check composition: verify:ac must not soft-skip after a same-session complete (#3357).
+ *
+ * "No story ever active this session" remains a legitimate skip.
+ * "A story completed this session" targets xbrief/completed (most recent).
+ * One remediation string when that target cannot be used.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { readRitualState } from "../session/ritual-sentinel.js";
+import { parseTimestamp } from "../session/time.js";
+/** One remediation when check cannot target the just-completed brief (#3357). */
+export const SESSION_COMPLETED_AC_REMEDIATION = "Run task verify:ac -- xbrief/completed/<just-completed>.xbrief.json (a story completed this session; check must not soft-skip) (#3357)";
+/** Project-relative marker written by scope:complete for this session (#3357). */
+export const SESSION_COMPLETED_MARKER_REL = [".deft", "last-completed.json"];
+function asRecord(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+export function sessionCompletedMarkerPath(projectRoot) {
+    return join(resolve(projectRoot), ...SESSION_COMPLETED_MARKER_REL);
+}
+/** Persist the just-completed brief so check can fail closed if that file is unreadable. */
+export function writeSessionCompletedMarker(projectRoot, marker) {
+    const root = resolve(projectRoot);
+    const target = sessionCompletedMarkerPath(root);
+    containedWrite({
+        root,
+        target,
+        data: `${JSON.stringify(marker, null, 2)}\n`,
+        mode: "replace",
+        mkdir: true,
+    });
+}
+function readSessionCompletedMarker(projectRoot) {
+    const path = sessionCompletedMarkerPath(projectRoot);
+    if (!existsSync(path)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        const rec = asRecord(parsed);
+        const briefPath = typeof rec?.path === "string" ? rec.path.trim() : "";
+        const sessionId = typeof rec?.sessionId === "string" ? rec.sessionId.trim() : "";
+        const completedAt = typeof rec?.completedAt === "string" ? rec.completedAt.trim() : "";
+        if (briefPath.length === 0 || sessionId.length === 0) {
+            return "invalid";
+        }
+        return { path: briefPath, sessionId, completedAt };
+    }
+    catch {
+        return "invalid";
+    }
+}
+function resolveSession(input) {
+    const env = input.env ?? process.env;
+    const injected = input.sessionId?.trim() ?? "";
+    if (injected.length > 0) {
+        return { sessionId: injected, startedAt: input.sessionStartedAt ?? null };
+    }
+    const fromEnv = typeof env.DEFT_SESSION_ID === "string" ? env.DEFT_SESSION_ID.trim() : "";
+    const [state] = readRitualState(resolve(input.projectRoot));
+    const ritualId = state?.sessionId.trim() ?? "";
+    const sessionId = fromEnv.length > 0 ? fromEnv : ritualId;
+    // Do not pair DEFT_SESSION_ID with a different ritual-state startedAt.
+    const ritualStartedAt = ritualId.length > 0 && ritualId === sessionId ? (state?.startedAt ?? null) : null;
+    return {
+        sessionId: sessionId.length > 0 ? sessionId : null,
+        startedAt: input.sessionStartedAt ?? ritualStartedAt,
+    };
+}
+function listCompletedBriefPaths(projectRoot) {
+    const paths = [];
+    for (const dirName of ["xbrief", "vbrief"]) {
+        const completed = join(projectRoot, dirName, "completed");
+        if (!existsSync(completed))
+            continue;
+        let names = [];
+        try {
+            names = readdirSync(completed)
+                .filter((n) => n.endsWith(".xbrief.json") || n.endsWith(".vbrief.json"))
+                .sort();
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            paths.push(join(completed, name));
+        }
+    }
+    return paths;
+}
+function readCompletedCandidate(path) {
+    if (!existsSync(path)) {
+        return "unreadable";
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return "unreadable";
+    }
+    const data = asRecord(parsed);
+    const plan = asRecord(data?.plan);
+    if (plan === null) {
+        return "unreadable";
+    }
+    const meta = asRecord(plan.metadata);
+    if (meta === null) {
+        // Historical completed briefs (pre-#3357) often have no plan.metadata.
+        // That is not an unreadable this-session target (#3375).
+        return { path, completedAtMs: 0, sessionId: null };
+    }
+    const sessionRaw = typeof meta.completedSessionId === "string" ? meta.completedSessionId.trim() : "";
+    const completedAt = parseTimestamp(meta.completedAt);
+    return {
+        path,
+        completedAtMs: completedAt?.getTime() ?? 0,
+        sessionId: sessionRaw.length > 0 ? sessionRaw : null,
+    };
+}
+function isSameSession(candidate, sessionId, startedAt) {
+    if (sessionId !== null && candidate.sessionId === sessionId) {
+        return true;
+    }
+    // Timestamp fallback only for pre-#3357 briefs that never stamped a session id.
+    // A brief stamped for a different session must not replace this session's target.
+    if (candidate.sessionId === null &&
+        startedAt !== null &&
+        candidate.completedAtMs >= startedAt.getTime()) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Resolve the just-completed brief for this session, if check must target it.
+ */
+export function resolveSessionCompletedVerifyAcTarget(input) {
+    const projectRoot = resolve(input.projectRoot);
+    const { sessionId, startedAt } = resolveSession(input);
+    const marker = readSessionCompletedMarker(projectRoot);
+    if (marker === "invalid" && sessionId !== null) {
+        return { kind: "cannot", message: SESSION_COMPLETED_AC_REMEDIATION };
+    }
+    if (marker !== null &&
+        marker !== "invalid" &&
+        sessionId !== null &&
+        marker.sessionId === sessionId) {
+        const candidate = readCompletedCandidate(marker.path);
+        if (candidate === "unreadable") {
+            return { kind: "cannot", message: SESSION_COMPLETED_AC_REMEDIATION };
+        }
+        return { kind: "target", path: candidate.path };
+    }
+    const paths = listCompletedBriefPaths(projectRoot);
+    if (paths.length === 0 || (sessionId === null && startedAt === null)) {
+        return { kind: "none" };
+    }
+    const matched = [];
+    let unreadableCount = 0;
+    for (const path of paths) {
+        const candidate = readCompletedCandidate(path);
+        if (candidate === "unreadable") {
+            unreadableCount += 1;
+            continue;
+        }
+        if (isSameSession(candidate, sessionId, startedAt)) {
+            matched.push(candidate);
+        }
+    }
+    if (matched.length === 0) {
+        // Any unreadable completed brief may be this session's target.
+        if (unreadableCount > 0) {
+            return { kind: "cannot", message: SESSION_COMPLETED_AC_REMEDIATION };
+        }
+        return { kind: "none" };
+    }
+    matched.sort((a, b) => {
+        if (a.completedAtMs !== b.completedAtMs) {
+            return b.completedAtMs - a.completedAtMs;
+        }
+        return a.path < b.path ? 1 : a.path > b.path ? -1 : 0;
+    });
+    const latest = matched[0];
+    if (latest === undefined) {
+        return { kind: "none" };
+    }
+    const verified = readCompletedCandidate(latest.path);
+    if (verified === "unreadable") {
+        return { kind: "cannot", message: SESSION_COMPLETED_AC_REMEDIATION };
+    }
+    return { kind: "target", path: latest.path };
+}
+//# sourceMappingURL=session-completed-ac.js.map

package/dist/doctor/main.js

@@ -701,6 +701,17 @@ function runInstallIntegrityChecks(projectRoot, sink, addFinding, seams) {
                 }
             });
         const result = runChecks(projectRoot, { isDir, isFile, readText });
+        // Exit-exempt check fails stay warnings so lastErrorCount stays 0
+        // (gated ritual / PreToolUse). Keep completed-lifecycle-consistency hard.
+        const warningOnFail = new Set([
+            "legacy-layout",
+            "canonical-vendored-npm-signpost",
+            "manifest-version-reportable",
+            "gitignore-coverage",
+            "stale-xbrief-schema-deposit",
+            "typescript-7-side-by-side",
+            "completed-open-items",
+        ]);
         for (const entry of result.checks ?? []) {
             const name = String(entry.name ?? "install-integrity");
             const status = String(entry.status ?? "");
@@ -718,13 +729,7 @@ function runInstallIntegrityChecks(projectRoot, sink, addFinding, seams) {
                 sink.info(`${name}: skip -- ${detail}`);
                 continue;
             }
-            if ((name === "legacy-layout" ||
-                name === "canonical-vendored-npm-signpost" ||
-                name === "manifest-version-reportable" ||
-                name === "gitignore-coverage" ||
-                name === "stale-xbrief-schema-deposit" ||
-                name === "typescript-7-side-by-side") &&
-                status === "fail") {
+            if (warningOnFail.has(name) && status === "fail") {
                 sink.warn(`${name}: ${detail}`);
                 addFinding({
                     severity: "warning",

package/dist/fs/contained-write.js

@@ -17,7 +17,7 @@
  *
  * Refs #2951.
  */
-import { closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, realpathSync, writeSync, } from "node:fs";
+import { closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, realpathSync, writeSync, } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "./projection-containment.js";
 /** Stable machine-readable error codes for contained-write refusals. */
@@ -144,6 +144,7 @@ function writeNoFollow(targetAbs, buf, flags) {
             }
             offset += n;
         }
+        fsyncSync(fd);
         return offset;
     }
     finally {

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export * as authz from "./authz/index.js";
 export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
+export * as check from "./check/index.js";
 export * as codebase from "./codebase/index.js";
 export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";

package/dist/index.js

@@ -13,6 +13,7 @@ export * as authz from "./authz/index.js";
 export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
+export * as check from "./check/index.js";
 export * as codebase from "./codebase/index.js";
 export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";

package/dist/intake/clause-derivation.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Hand-authored briefs run #3323 clause derivation on activate/promote (#3360).
+ *
+ * issue:ingest already stamps clauses. The dominant consumer path authors the
+ * brief by hand; #3334 only required plan.acceptance to exist. This module is
+ * the missing derive step.
+ */
+import { type AcceptanceClause } from "../verify-ac/clauses.js";
+/** True when activate/promote must run #3323 (absent, empty none_stated, or command-only). */
+export declare function needsClauseDerivation(acceptance: unknown): boolean;
+/** Task-statement text from title, narratives, and item Acceptance fields. */
+export declare function collectTaskStatementFromPlan(plan: Record<string, unknown>): string;
+export interface ClauseDerivationResult {
+    readonly applied: boolean;
+    readonly clauses: readonly AcceptanceClause[];
+    readonly notice: string;
+}
+/**
+ * Stamp derived clauses onto plan.acceptance in place. Headless: records
+ * chosen_reading, never blocks on a question.
+ */
+export declare function applyClauseDerivationToPlan(plan: Record<string, unknown>, options?: {
+    readonly projectRoot?: string;
+    readonly emitStamp?: boolean;
+}): ClauseDerivationResult;
+/** Stable fingerprint of plan.acceptance for first-write / material-change detection (#3355). */
+export declare function acceptanceFingerprint(acceptance: unknown): string | null;
+/** True when next is a first write or a material change versus previous (#3355). */
+export declare function isMaterialAcceptanceChange(previous: unknown, next: unknown): boolean;
+/** Fail-open acceptance_stamp emission (same contract as issue:ingest / #3355). */
+export declare function emitAcceptanceStampFromPlan(projectRoot: string, plan: unknown, env?: NodeJS.ProcessEnv): void;
+/**
+ * Emit acceptance_stamp when plan.acceptance is first written or materially changed.
+ * State-observed: callers pass the before/after blocks from any lifecycle verb (#3355).
+ */
+export declare function maybeEmitAcceptanceStampFromChange(projectRoot: string, previous: unknown, next: unknown, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=clause-derivation.d.ts.map