@deftai/directive-core 0.104.0 → 0.105.0

package/dist/verify-ac/index.js

@@ -5,6 +5,6 @@
  * by editing the comparison. Deterministic surface is the flagged event.
  */
 export { deriveAcceptanceClauses, formatClauseWalkMessage, isScratchArtifactPath, readAcceptanceClauses, serializeAcceptanceClauses, stampDerivedClausesOnAcceptance, walkAcceptanceClauses, } from "./clauses.js";
-export { emitVerifyAcAttempts, evaluateProductOracleIntegrity, mergeOracleVerdict, VERIFY_AC_CHECK_ID_PREFIX, verifyAcCheckId, } from "./evaluate.js";
-export { flagPassAfterFailFromJsonl, flagPassAfterFailWithMethodChange, readVerificationAttempts, unresolvedMethodChangePasses, } from "./flag.js";
+export { emitVerifyAcAttempts, evaluateProductOracleIntegrity, mergeOracleVerdict, methodFingerprintForWalk, VERIFY_AC_CHECK_ID_PREFIX, verifyAcCheckId, } from "./evaluate.js";
+export { commandCountFromFingerprint, flagPassAfterFailFromJsonl, flagPassAfterFailWithMethodChange, readVerificationAttempts, unresolvedMethodChangePasses, } from "./flag.js";
 //# sourceMappingURL=index.js.map

package/dist/verify-source/contained-writes.js

@@ -46,6 +46,8 @@ export const CONTAINED_WRITES_ALLOWLIST = [
     // Implementation modules for containment + contained write.
     "packages/core/src/fs/contained-write.ts",
     "packages/core/src/fs/projection-containment.ts",
+    // #3424: read-only O_NOFOLLOW fd pin in intended-placement inspect (not a write sink).
+    "packages/core/src/preflight/intended-placement.ts",
     // Deposit tree copy / contain primitives (low-level install sinks).
     "packages/core/src/deposit/copy-tree.ts",
     "packages/core/src/deposit/contain.ts",

package/dist/verify-source/verify-stubs.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Shared "not product source" core (#3487) plus the directories only the stub
+ * scan treats as non-product: fixtures/tests, vendored trees, the history
+ * archive, and operator scripts.
+ */
 export declare const EXCLUDE_DIRS: Set<string>;
 export declare const EXTENSIONS: Set<string>;
 export interface StubFinding {
@@ -6,7 +11,16 @@ export interface StubFinding {
     readonly label: string;
     readonly text: string;
 }
-/** Recursive sorted rglob mirroring `sorted(Path(".").rglob("*"))`. */
+/**
+ * Recursive sorted rglob mirroring `sorted(Path(".").rglob("*"))`, pruning
+ * `EXCLUDE_DIRS` before recursing.
+ *
+ * Pruning is load-bearing, not an optimisation of a filter applied later: on a
+ * host with a populated `.deft-scratch/` the unpruned walk enumerates every
+ * swarm worktree (millions of entries) only to discard them per-file. #2953
+ * added `.deft-scratch` / `swarm-worktrees` to `EXCLUDE_DIRS` for exactly this
+ * reason but left the walk descending into them (#3481).
+ */
 export declare function sortedRglob(root: string): string[];
 export declare function scanFileForStubs(relPath: string, fullPath: string): StubFinding[];
 export interface VerifyStubsResult {

package/dist/verify-source/verify-stubs.js

@@ -1,20 +1,12 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
-export const EXCLUDE_DIRS = new Set([
-    "tests",
-    "vendor",
-    ".git",
-    "backup",
-    "history",
-    "node_modules",
-    ".venv",
-    "__pycache__",
-    "dist",
-    "scripts",
-    // Swarm / agent worktrees are not product source (#2953, #1656).
-    ".deft-scratch",
-    "swarm-worktrees",
-]);
+import { NON_PRODUCT_DIRS } from "../fs/non-product-dirs.js";
+/**
+ * Shared "not product source" core (#3487) plus the directories only the stub
+ * scan treats as non-product: fixtures/tests, vendored trees, the history
+ * archive, and operator scripts.
+ */
+export const EXCLUDE_DIRS = new Set([...NON_PRODUCT_DIRS, "tests", "vendor", "history", "scripts"]);
 export const EXTENSIONS = new Set([".py", ".go", ".sh"]);
 function isWordChar(ch) {
     if (ch.length === 0) {
@@ -73,7 +65,16 @@ function hasReturnNull(text) {
     }
     return false;
 }
-/** Recursive sorted rglob mirroring `sorted(Path(".").rglob("*"))`. */
+/**
+ * Recursive sorted rglob mirroring `sorted(Path(".").rglob("*"))`, pruning
+ * `EXCLUDE_DIRS` before recursing.
+ *
+ * Pruning is load-bearing, not an optimisation of a filter applied later: on a
+ * host with a populated `.deft-scratch/` the unpruned walk enumerates every
+ * swarm worktree (millions of entries) only to discard them per-file. #2953
+ * added `.deft-scratch` / `swarm-worktrees` to `EXCLUDE_DIRS` for exactly this
+ * reason but left the walk descending into them (#3481).
+ */
 export function sortedRglob(root) {
     const out = [];
     function walk(dir, relPrefix) {
@@ -95,6 +96,9 @@ export function sortedRglob(root) {
                 continue;
             }
             if (st.isDirectory()) {
+                if (EXCLUDE_DIRS.has(name)) {
+                    continue;
+                }
                 walk(full, rel);
             }
             else {

package/dist/vitest-runner/win32-coverage-tmp-setup.d.ts

@@ -3,18 +3,17 @@ export declare const COVERAGE_TMP_CHUNK_RE: RegExp;
 export declare function isCoverageTmpChunkPath(filePath: string): boolean;
 export declare function ensureCoverageTmpDir(coverageTmpDir?: string): void;
 /**
- * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
- * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
- * directory can disappear between clean() and writeFile under release-scale
+ * Vitest 4.x includes the upstream mkdir (vitest-dev/vitest#10117). On Windows the
+ * directory can still disappear between clean() and writeFile under release-scale
  * load; mkdir immediately before chunk writes closes that race without
- * soft-failing real threshold failures (#2634).
+ * soft-failing real threshold failures (#2634 / #3480).
  */
 export declare function installCoverageTmpWriteGuard(): () => void;
 /**
  * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
- * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
+ * Keepalive mkdir plus a writeFile guard remain until a full win32 coverage
+ * run proves vitest 4's #10117 mkdir is enough on its own (#3480).
  */
 export default function setup(): () => void;
 //# sourceMappingURL=win32-coverage-tmp-setup.d.ts.map

package/dist/vitest-runner/win32-coverage-tmp-setup.js

@@ -10,11 +10,10 @@ export function ensureCoverageTmpDir(coverageTmpDir = defaultCoverageTmp) {
     mkdirSync(coverageTmpDir, { recursive: true });
 }
 /**
- * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
- * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
- * directory can disappear between clean() and writeFile under release-scale
+ * Vitest 4.x includes the upstream mkdir (vitest-dev/vitest#10117). On Windows the
+ * directory can still disappear between clean() and writeFile under release-scale
  * load; mkdir immediately before chunk writes closes that race without
- * soft-failing real threshold failures (#2634).
+ * soft-failing real threshold failures (#2634 / #3480).
  */
 export function installCoverageTmpWriteGuard() {
     const originalWriteFile = fsPromises.writeFile.bind(fsPromises);
@@ -33,8 +32,8 @@ export function installCoverageTmpWriteGuard() {
 /**
  * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
- * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
+ * Keepalive mkdir plus a writeFile guard remain until a full win32 coverage
+ * run proves vitest 4's #10117 mkdir is enough on its own (#3480).
  */
 export default function setup() {
     if (process.platform !== "win32")

package/dist/xbrief-migrate/migrate-project.js

@@ -1,6 +1,6 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import { containedWrite } from "../fs/contained-write.js";
+import { containedRemove, containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { checkGitClean } from "../migrate-preflight/index.js";
 import { applyAgentsRefresh } from "../platform/agents-md.js";
@@ -36,10 +36,7 @@ export function shouldOmitLegacyMigrationFile(relativePath) {
  */
 export function removeStaleMigratedFrameworkNarrative(projectRoot) {
     const stale = join(projectRoot, MIGRATED_ARTIFACT_DIR, OBSOLETE_FRAMEWORK_NARRATIVE_FILENAME);
-    if (!existsSync(stale))
-        return false;
-    rmSync(stale, { force: true });
-    return true;
+    return containedRemove({ root: projectRoot, target: stale }).removed;
 }
 function mapRelativePath(relativePath) {
     return relativePath

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.104.0",
+  "version": "0.105.0",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -382,8 +382,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.104.0",
-    "@deftai/directive-types": "^0.104.0",
+    "@deftai/directive-content": "^0.105.0",
+    "@deftai/directive-types": "^0.105.0",
     "archiver": "^8.0.0"
   },
   "scripts": {