@deftai/directive-core 0.104.0 → 0.105.0

package/dist/fs/non-product-dirs.js

@@ -0,0 +1,96 @@
+/**
+ * non-product-dirs.ts — one source of truth for the "not product source"
+ * directory basenames shared by every Directive filesystem walk (#3487).
+ *
+ * Directive shipped four independently hand-maintained exclusion sets:
+ *
+ *   - `EXCLUDE_DIRS`     — `verify-source/verify-stubs.ts`
+ *   - `EXCLUDE_DIRS`     — `validate-content/validate-links.ts`
+ *   - `SKIP_DIRS`        — `codebase/default-extractor.ts`
+ *   - `DEFAULT_EXCLUDES` — `release/build-dist.ts`
+ *
+ * They drifted from each other, which is exactly how #2953 added
+ * `.deft-scratch` / `swarm-worktrees` to some walks and missed the
+ * `verify-stubs` walk (#3481), and how none of them ever learned about agent
+ * working directories even though Directive ships first-class support for
+ * several agent hosts. Because `@deftai/directive-core` is published, a
+ * consumer cannot patch any of the four.
+ *
+ * `NON_PRODUCT_DIRS` is the common core each walk now extends. It carries only
+ * basenames that are never product source in any repo: VCS metadata,
+ * dependency trees, build output, tool caches, and agent working directories.
+ * Walk-specific entries (`tests`, `specs`, `.planning`, `htmlcov`, …) stay with
+ * the walk that needs them — this constant is a floor, not a ceiling.
+ *
+ * Adding a directory here is a one-line change all four walks pick up, and
+ * `non-product-dirs.test.ts` fails if any of them stops agreeing.
+ *
+ * Refs #3487, #3481, #2953, #2954, #1656.
+ */
+/**
+ * Swarm / agent scratch worktree roots (#2953, #1656).
+ *
+ * `.deft-scratch` is the current layout (`.deft-scratch/worktrees/<story-id>`,
+ * built by `swarm/launch.ts`); `swarm-worktrees` is the pre-`.deft-scratch`
+ * name, kept for repos that still carry one.
+ */
+export const AGENT_SCRATCH_DIRS = [".deft-scratch", "swarm-worktrees"];
+/**
+ * Agent-host directories that hold host *working* state rather than product
+ * source (#3487).
+ *
+ * Only names with evidence of a real working directory belong here. Directive
+ * knows several host directories (`.claude`, `.cursor`, `.grok`, `.codex`,
+ * `.github/skills`, `.agents`), but most of them hold nothing except
+ * Directive's own committed deposits — `commands.md` § Native multi-host
+ * registration (LockedDecision L8) says to *commit* those, so blanket-excluding
+ * them would hide committed team surface for no measured gain.
+ *
+ * `.claude` is different in kind: the Claude Code host keeps live session state
+ * in the same directory it keeps config — `settings.local.json`, and agent
+ * worktrees under `.claude/worktrees/<agent-id>`, each a full nested checkout.
+ * Three such worktrees added ~11,000 walkable entries to this repo
+ * (9,128 → 20,393) that no Directive walk skipped. Its Directive-managed
+ * contents (`.claude/settings.json`, `.claude/commands/*.md`,
+ * `.claude/skills/`) are deposits generated from `content/`, which every walk
+ * still visits at the authoring source.
+ *
+ * Deliberately **not** listed:
+ *   - `.openclaw` — there is no project-level `.openclaw/`; the host state dir
+ *     is `~/.openclaw` in `$HOME` (see `doctor/openclaw-skills.ts`), and
+ *     inventing a project one is explicitly forbidden by
+ *     `content/docs/openclaw-agent-host.md` and asserted against in
+ *     `slash/openclaw-adapter.test.ts`.
+ *   - `.cursor`, `.grok`, `.codex`, `.github` — committed Directive deposits
+ *     (`.cursor/hooks.json`, `.grok/commands/`, `.codex/prompts/`,
+ *     `.github/skills/`) with no known working/worktree subtree. No evidence
+ *     of a scratch convention was found for any of them.
+ */
+export const AGENT_HOST_WORKING_DIRS = [".claude"];
+/**
+ * Directory basenames no Directive walk should descend into.
+ *
+ * Every walk extends this set; none may shrink it. Keep entries to basenames
+ * that cannot be product source in any repo — a name that is merely *usually*
+ * uninteresting to one gate (`tests`, `scripts`, `specs`) belongs to that
+ * walk's own set, not here.
+ */
+export const NON_PRODUCT_DIRS = new Set([
+    // Version-control metadata.
+    ".git",
+    // Dependency trees and language virtualenvs.
+    "node_modules",
+    ".venv",
+    // Build output and operator backups.
+    "dist",
+    "backup",
+    // Tool caches.
+    "__pycache__",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    // Agent working directories.
+    ...AGENT_SCRATCH_DIRS,
+    ...AGENT_HOST_WORKING_DIRS,
+]);
+//# sourceMappingURL=non-product-dirs.js.map

package/dist/hooks/dispatcher.d.ts

@@ -21,7 +21,9 @@ export type HookDecisionCode = "session-start" | "session-start-disabled" | "ses
 /** Enforcement skipped: root `.deft-directive-disable` test kill-switch (#3039). */
  | "directive-disabled" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
 /** Host closed stdin with zero bytes — integration failure, not a policy gate (#2864). */
- | "stdin-empty" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready"
+ | "stdin-empty" | "ritual-not-ready"
+/** Product-path write while another live session occupies this worktree (#3433). */
+ | "occupancy-occupied" | "scope-not-ready" | "write-propose-ready"
 /** Allowlisted assist/scratch write without active xBRIEF (#1802). */
  | "write-assist-scratch-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready"
 /** Non-lifecycle assist/docs spawn allowed without active xBRIEF (#3080). */

package/dist/hooks/dispatcher.js

@@ -10,6 +10,7 @@ import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAutho
 import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
 import { appendSoftAgentsRebindToMessage, decisionCarriesSoftAgentsRebind, formatSoftAgentsRebindChecklist, } from "../session/compact-ritual.js";
 import { detectBranch } from "../session/git.js";
+import { evaluateOccupancyWriteGate } from "../session/occupancy.js";
 import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
@@ -598,6 +599,19 @@ function inspectMutationGates(input, toolName, seams, options) {
         return deny(input, "ritual-not-ready", toolName, `Directive could not inspect the gated session ritual: ${String(cause)}. ` +
             formatRitualRecoveryInstruction("cold"));
     }
+    const occupancyGate = isSpawnTool(toolName)
+        ? { allow: true, message: null, occupant: null }
+        : evaluateOccupancyWriteGate(projectRoot, { env: environ });
+    if (!occupancyGate.allow && occupancyGate.message !== null) {
+        const ritualNote = ritual.code !== 0 ? ` Also ritual-not-ready: ${ritual.message}` : "";
+        emitSessionRitualBlockedProcessCost({
+            toolName,
+            code: "occupancy-occupied",
+            recoveryTier: ritual.recoveryTier === "rearm" ? "rearm" : "cold",
+            detail: occupancyGate.message,
+        }, { projectRoot });
+        return deny(input, "occupancy-occupied", toolName, `Directive denied ${toolName}: ${occupancyGate.message}${ritualNote}`);
+    }
     if (ritual.code !== 0) {
         // #2992: prefer re-arm recovery when age/compact stale; cold when bind invalid.
         const recoveryTier = ritual.recoveryTier === "rearm" ? "rearm" : "cold";

package/dist/index.d.ts

@@ -30,6 +30,7 @@ export * as events from "./events/attribution-ledger.js";
 export * from "./forward-coverage/evaluate.js";
 export * as freshness from "./freshness/index.js";
 export { ContainedWriteError, ContainedWriteErrorCode, type ContainedWriteInput, type ContainedWriteMode, type ContainedWriteResult, containedWrite, resolveContainedTarget, } from "./fs/contained-write.js";
+export { AGENT_HOST_WORKING_DIRS, AGENT_SCRATCH_DIRS, NON_PRODUCT_DIRS, } from "./fs/non-product-dirs.js";
 export { assertDestinationNotSymlink, assertDirectoryNotSymlink, assertProjectionContained, assertWriteTargetSafe, PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "./fs/projection-containment.js";
 export * as handoffEvidence from "./handoff-evidence/index.js";
 export * as intake from "./intake/index.js";

package/dist/index.js

@@ -31,6 +31,8 @@ export * from "./forward-coverage/evaluate.js";
 export * as freshness from "./freshness/index.js";
 // #2951 Phase 1: contained-write API for product sinks.
 export { ContainedWriteError, ContainedWriteErrorCode, containedWrite, resolveContainedTarget, } from "./fs/contained-write.js";
+// #3487: single source of truth for walk exclusions, shared by every gate.
+export { AGENT_HOST_WORKING_DIRS, AGENT_SCRATCH_DIRS, NON_PRODUCT_DIRS, } from "./fs/non-product-dirs.js";
 export { assertDestinationNotSymlink, assertDirectoryNotSymlink, assertProjectionContained, assertWriteTargetSafe, PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "./fs/projection-containment.js";
 export * as handoffEvidence from "./handoff-evidence/index.js";
 export * as intake from "./intake/index.js";

package/dist/init-deposit/agent-hooks.js

@@ -1,7 +1,7 @@
-import { existsSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { containedWrite } from "../fs/contained-write.js";
+import { containedRemove, containedRename, containedWrite } from "../fs/contained-write.js";
 import { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 import { isHostHookDepositEnabled, loadHostHooksPolicyFromProject, } from "../policy/host-hooks.js";
 export { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
@@ -217,7 +217,7 @@ function mergeCursorConfig(config, path) {
     ];
     return { ...config, version: 1, hooks };
 }
-function writeJsonIfChanged(projectRoot, path, payload) {
+function writeJsonIfChanged(projectRoot, path, payload, kind) {
     const next = `${JSON.stringify(payload, null, 2)}\n`;
     if (existsSync(path) && readFileSync(path, "utf8") === next)
         return false;
@@ -231,12 +231,18 @@ function writeJsonIfChanged(projectRoot, path, payload) {
             target: temporary,
             data: next,
             mode: "replace",
+            mutation: { kind, path },
+        });
+        containedRename({
+            root: resolve(projectRoot),
+            from: temporary,
+            to: path,
+            mutation: false,
         });
-        renameSync(temporary, path);
     }
     catch (err) {
         try {
-            rmSync(temporary, { force: true });
+            containedRemove({ root: resolve(projectRoot), target: temporary, mutation: false });
         }
         catch {
             /* best-effort cleanup */
@@ -298,7 +304,7 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     for (const item of prepared) {
         if (item.mode === "skip")
             continue;
-        if (writeJsonIfChanged(projectRoot, item.absolute, item.payload)) {
+        if (writeJsonIfChanged(projectRoot, item.absolute, item.payload, item.mode === "strip" ? "stripped" : "wrote")) {
             if (item.mode === "strip")
                 strippedPaths.push(item.path);
             else
@@ -309,29 +315,25 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
         ".cursor/hooks/deft-cursor-hook-adapter.mjs",
         ".cursor/hooks/deft-cursor-hook-adapter.test.mjs",
     ];
-    let removedLegacyAdapter = false;
+    let adaptersRemoved = 0;
     for (const relative of legacyAdapterPaths) {
         const absolute = join(projectRoot, relative);
         assertDepositContained(projectRoot, absolute);
-        if (existsSync(absolute)) {
-            rmSync(absolute, { force: true });
-            removedLegacyAdapter = true;
+        if (containedRemove({ root: projectRoot, target: absolute }).removed) {
+            adaptersRemoved += 1;
         }
     }
-    if (removedLegacyAdapter && !changedPaths.includes(AGENT_HOOK_PATHS[2])) {
-        changedPaths.push(AGENT_HOOK_PATHS[2]);
-    }
     if (changedPaths.length > 0) {
         io.printf(`Installed Directive agent hooks: ${changedPaths.join(", ")}\n`);
     }
     if (strippedPaths.length > 0) {
         io.printf(`Removed Directive-managed agent hooks (plan.policy.hostHooks opt-out): ${strippedPaths.join(", ")}\n`);
     }
-    if (changedPaths.length === 0 && strippedPaths.length === 0) {
+    if (changedPaths.length === 0 && strippedPaths.length === 0 && adaptersRemoved === 0) {
         io.printf("Directive agent hooks already current.\n");
     }
     return {
-        changed: changedPaths.length + strippedPaths.length > 0,
+        changed: changedPaths.length + strippedPaths.length + adaptersRemoved > 0,
         changedPaths: [...changedPaths, ...strippedPaths],
     };
 }

package/dist/init-deposit/core-guard-pin-content.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Embedded python3 pin/lock checker for deposited deft-core-guard (#3193 / #3427).
+ * Twin of cmd/deft-install/core_guard_pin_content.embed — keep byte-identical.
+ * Not a .py file; CodeQL default setup must not see Python here.
+ */
+export declare const CORE_GUARD_PIN_CONTENT_PYTHON: string;
+//# sourceMappingURL=core-guard-pin-content.d.ts.map

package/dist/init-deposit/core-guard-pin-content.js

@@ -0,0 +1,393 @@
+/**
+ * Embedded python3 pin/lock checker for deposited deft-core-guard (#3193 / #3427).
+ * Twin of cmd/deft-install/core_guard_pin_content.embed — keep byte-identical.
+ * Not a .py file; CodeQL default setup must not see Python here.
+ */
+export const CORE_GUARD_PIN_CONTENT_PYTHON = [
+    "# Content-aware pin unit for deposited deft-core-guard (#3193).",
+    '# Invoked as: python3 - "$BASE_SHA" "$HEAD_SHA"',
+    "# Mirrors packages/core/src/init-deposit/hygiene.ts isUpgradePinPathContentAllowed.",
+    "from __future__ import annotations",
+    "",
+    "import json",
+    "import re",
+    "import subprocess",
+    "import sys",
+    "",
+    "_Q = chr(39) + chr(34)  # ' and \" without raw-string quote pain",
+    "",
+    "",
+    "def git_show(sha, path):",
+    "    try:",
+    "        return subprocess.check_output(",
+    '            ["git", "show", f"{sha}:{path}"], text=True, stderr=subprocess.DEVNULL',
+    "        )",
+    "    except subprocess.CalledProcessError:",
+    '        return ""',
+    "",
+    "",
+    "def changed_names(base_sha, head_sha):",
+    "    out = subprocess.check_output(",
+    '        ["git", "diff", "--name-only", base_sha, head_sha], text=True',
+    "    )",
+    "    return [p for p in out.splitlines() if p]",
+    "",
+    "",
+    "def is_dir_key(n):",
+    '    return n.startswith("@deftai/directive")',
+    "",
+    "",
+    "DEP_FIELDS = (",
+    '    "dependencies",',
+    '    "devDependencies",',
+    '    "optionalDependencies",',
+    '    "peerDependencies",',
+    ")",
+    "",
+    "",
+    "def deep_eq(a, b):",
+    "    if a is b:",
+    "        return True",
+    "    if type(a) is not type(b):",
+    "        return False",
+    "    if isinstance(a, dict):",
+    "        if set(a) != set(b):",
+    "            return False",
+    "        return all(deep_eq(a[k], b[k]) for k in a)",
+    "    if isinstance(a, list):",
+    "        return len(a) == len(b) and all(deep_eq(x, y) for x, y in zip(a, b))",
+    "    return a == b",
+    "",
+    "",
+    "def strip_pins(obj):",
+    "    if not isinstance(obj, dict):",
+    "        return obj",
+    "    out = {}",
+    "    for k, v in obj.items():",
+    "        if k in DEP_FIELDS and isinstance(v, dict):",
+    "            out[k] = {dk: dv for dk, dv in v.items() if not is_dir_key(dk)}",
+    "        else:",
+    "            out[k] = v",
+    "    return out",
+    "",
+    "",
+    "def pkg_pin_only(base, head):",
+    "    try:",
+    '        b, h = json.loads(base or "{}"), json.loads(head or "{}")',
+    "    except json.JSONDecodeError:",
+    "        return False",
+    "    return deep_eq(strip_pins(b), strip_pins(h))",
+    "",
+    "",
+    "def collect_deps(pkg):",
+    "    out = {}",
+    "    if not isinstance(pkg, dict):",
+    "        return out",
+    "    for f in DEP_FIELDS:",
+    "        block = pkg.get(f)",
+    "        if isinstance(block, dict):",
+    "            for k, v in block.items():",
+    "                if isinstance(v, str):",
+    "                    out[k] = v",
+    '                elif isinstance(v, dict) and isinstance(v.get("version"), str):',
+    '                    out[k] = v["version"]',
+    "                elif v is not None:",
+    "                    out[k] = str(v)",
+    "    return out",
+    "",
+    "",
+    "def only_dir_diff(bd, hd):",
+    "    keys = set(bd) | set(hd)",
+    "    for k in keys:",
+    "        if is_dir_key(k):",
+    "            continue",
+    "        if bd.get(k) != hd.get(k):",
+    "            return False",
+    "    return True",
+    "",
+    "",
+    "def npm_root_deps(lock):",
+    '    pkgs = lock.get("packages") if isinstance(lock, dict) else None',
+    '    if isinstance(pkgs, dict) and isinstance(pkgs.get(""), dict):',
+    '        return collect_deps(pkgs[""])',
+    '    deps = lock.get("dependencies") if isinstance(lock, dict) else None',
+    "    out = {}",
+    "    if isinstance(deps, dict):",
+    "        for k, v in deps.items():",
+    "            if isinstance(v, dict):",
+    '                out[k] = str(v.get("version", v))',
+    "            elif isinstance(v, str):",
+    "                out[k] = v",
+    "    return out",
+    "",
+    "",
+    "def npm_lock_ok(base, head):",
+    "    try:",
+    '        b, h = json.loads(base or "{}"), json.loads(head or "{}")',
+    "    except json.JSONDecodeError:",
+    "        return False",
+    "    br, hr = npm_root_deps(b), npm_root_deps(h)",
+    "    if not only_dir_diff(br, hr):",
+    "        return False",
+    '    bp, hp = b.get("packages") or {}, h.get("packages") or {}',
+    "    if not isinstance(bp, dict):",
+    "        bp = {}",
+    "    if not isinstance(hp, dict):",
+    "        hp = {}",
+    "    all_keys = set(bp) | set(hp)",
+    "    for key in all_keys:",
+    '        if key == "":',
+    "            continue",
+    '        if "node_modules/@deftai/directive" in key or "/@deftai/directive/" in key:',
+    "            continue",
+    "        if not deep_eq(bp.get(key), hp.get(key)):",
+    "            return False",
+    "    # lockfileVersion 1: freeze nested dependencies tree without directive keys",
+    "    if not bp and not hp:",
+    "        def strip_dir(v):",
+    "            if not isinstance(v, dict):",
+    "                return v",
+    "            out = {}",
+    "            for k, val in v.items():",
+    "                if is_dir_key(k):",
+    "                    continue",
+    "                if isinstance(val, dict):",
+    "                    nxt = dict(val)",
+    '                    if "dependencies" in val:',
+    '                        nxt["dependencies"] = strip_dir(val["dependencies"])',
+    "                    out[k] = nxt",
+    "                else:",
+    "                    out[k] = val",
+    "            return out",
+    '        if not deep_eq(strip_dir(b.get("dependencies")), strip_dir(h.get("dependencies"))):',
+    "            return False",
+    "    return True",
+    "",
+    "",
+    "def unq(s):",
+    "    s = s.strip()",
+    "    if len(s) >= 2 and s[0] == s[-1] and s[0] in _Q:",
+    "        return s[1:-1]",
+    "    return s",
+    "",
+    "",
+    "def pnpm_root_deps(raw):",
+    "    out = {}",
+    "    in_imp = in_root = in_dep = False",
+    "    cur = None",
+    "    for line in raw.splitlines():",
+    '        if re.match(r"^importers:\\s*$", line):',
+    "            in_imp, in_root, in_dep, cur = True, False, False, None",
+    "            continue",
+    "        if not in_imp:",
+    "            continue",
+    '        if re.match(r"^[^\\s#]", line) and not line.startswith("importers"):',
+    "            break",
+    '        if re.match(r"^ {2}(?:\\.|\'\\.\'|\\"\\.\\"):\\s*$", line):',
+    "            in_root, in_dep, cur = True, False, None",
+    "            continue",
+    '        if in_root and re.match(r"^ {2}\\S", line) and not re.match(r"^ {2}\\.", line):',
+    "            in_root, in_dep, cur = False, False, None",
+    "            continue",
+    "        if not in_root:",
+    "            continue",
+    "        if re.match(",
+    '            r"^ {4}(?:dependencies|devDependencies|optionalDependencies|peerDependencies):\\s*$",',
+    "            line,",
+    "        ):",
+    "            in_dep, cur = True, None",
+    "            continue",
+    '        if in_dep and re.match(r"^ {4}\\S", line):',
+    "            in_dep, cur = False, None",
+    "            continue",
+    "        if not in_dep:",
+    "            continue",
+    '        m = re.match(r"^ {6}(.+?):\\s*$", line)',
+    "        if m:",
+    "            cur = unq(m.group(1))",
+    "            continue",
+    "        if cur:",
+    '            vm = re.match(r"^ {8}version:\\s*(.+?)\\s*$", line)',
+    "            if vm:",
+    "                out[cur] = unq(vm.group(1))",
+    "                cur = None",
+    "    return out",
+    "",
+    "",
+    "def pnpm_packages_by_name(raw):",
+    "    out = {}",
+    "    blocks = {}",
+    "    in_pkg = False",
+    "    cur = None",
+    "    buf = []",
+    "",
+    "    def flush():",
+    "        nonlocal cur, buf",
+    "        if cur is None:",
+    "            return",
+    '        blocks.setdefault(cur, []).append("\\n".join(buf))',
+    "        cur, buf = None, []",
+    "",
+    "    for line in raw.splitlines():",
+    '        if re.match(r"^packages:\\s*$", line):',
+    "            flush()",
+    "            in_pkg = True",
+    "            continue",
+    "        if not in_pkg:",
+    "            continue",
+    '        if re.match(r"^[^\\s#]", line) and not line.startswith("packages"):',
+    "            flush()",
+    "            break",
+    '        m = re.match(r"^ {2}(.+?):\\s*$", line)',
+    "        if m:",
+    "            flush()",
+    "            key = unq(m.group(1))",
+    '            at = key.find("@", 1) if key.startswith("@") else key.find("@")',
+    "            cur = key[:at] if at > 0 else key",
+    "            buf = [line]",
+    "            continue",
+    "        if cur is not None:",
+    "            buf.append(line)",
+    "    flush()",
+    "    for name, blist in blocks.items():",
+    '        out[name] = "\\n---\\n".join(sorted(blist))',
+    "    return out",
+    "",
+    "",
+    "def pnpm_section_by_name(raw, section):",
+    "    blocks, out = {}, {}",
+    "    in_sec, cur, buf = False, None, []",
+    '    sec_re = re.compile(r"^" + re.escape(section) + r":\\s*$")',
+    "",
+    "    def flush():",
+    "        nonlocal cur, buf",
+    "        if cur is None:",
+    "            return",
+    '        blocks.setdefault(cur, []).append("\\n".join(buf))',
+    "        cur, buf = None, []",
+    "",
+    "    for line in raw.splitlines():",
+    "        if sec_re.match(line):",
+    "            flush()",
+    "            in_sec = True",
+    "            continue",
+    "        if not in_sec:",
+    "            continue",
+    '        if re.match(r"^[^\\s#]", line) and not line.startswith(section):',
+    "            flush()",
+    "            break",
+    '        m = re.match(r"^ {2}(.+?):\\s*$", line)',
+    "        if m:",
+    "            flush()",
+    "            key = unq(m.group(1))",
+    '            at = key.find("@", 1) if key.startswith("@") else key.find("@")',
+    "            cur = key[:at] if at > 0 else key",
+    "            buf = [line]",
+    "            continue",
+    "        if cur is not None:",
+    "            buf.append(line)",
+    "    flush()",
+    "    for name, blist in blocks.items():",
+    '        out[name] = "\\n---\\n".join(sorted(blist))',
+    "    return out",
+    "",
+    "",
+    "def pnpm_ok(base, head):",
+    "    br, hr = pnpm_root_deps(base), pnpm_root_deps(head)",
+    "    if not only_dir_diff(br, hr):",
+    "        return False",
+    '    for section in ("packages", "snapshots"):',
+    "        bp, hp = pnpm_section_by_name(base, section), pnpm_section_by_name(head, section)",
+    "        for name in set(bp) | set(hp):",
+    "            if is_dir_key(name):",
+    "                continue",
+    "            if bp.get(name) != hp.get(name):",
+    "                return False",
+    "    return True",
+    "",
+    "",
+    "def yarn_blocks(raw):",
+    "    blocks = {}",
+    "    names, buf = [], []",
+    "",
+    "    def flush():",
+    "        nonlocal names, buf",
+    "        if not names:",
+    "            return",
+    '        body = "\\n".join(buf)',
+    "        for n in names:",
+    "            blocks[n] = body",
+    "        names, buf = [], []",
+    "",
+    "    for line in raw.splitlines():",
+    '        if line == "" or line.startswith("#"):',
+    '            if names and line == "":',
+    "                flush()",
+    "            continue",
+    '        if not re.match(r"^\\s", line) and line.endswith(":"):',
+    "            flush()",
+    "            header = line[:-1]",
+    "            names = []",
+    '            for part in header.split(","):',
+    "                p = part.strip()",
+    "                if len(p) >= 2 and p[0] == p[-1] and p[0] in _Q:",
+    "                    p = p[1:-1]",
+    '                at = p.find("@", 1) if p.startswith("@") else p.find("@")',
+    "                names.append(p[:at] if at > 0 else p)",
+    "            buf = [line]",
+    "            continue",
+    "        if names:",
+    "            buf.append(line)",
+    "    flush()",
+    "    return blocks",
+    "",
+    "",
+    "def yarn_ok(base, head):",
+    "    bb, hb = yarn_blocks(base), yarn_blocks(head)",
+    "    for name in set(bb) | set(hb):",
+    "        if is_dir_key(name):",
+    "            continue",
+    "        if bb.get(name) != hb.get(name):",
+    "            return False",
+    "    return True",
+    "",
+    "",
+    "def main(argv: list[str] | None = None) -> int:",
+    "    args = list(sys.argv[1:] if argv is None else argv)",
+    "    if len(args) < 2:",
+    '        print("usage: core_guard_pin_content <base_sha> <head_sha>", file=sys.stderr)',
+    "        return 2",
+    "    base_sha, head_sha = args[0], args[1]",
+    "    paths = changed_names(base_sha, head_sha)",
+    '    core = [p for p in paths if p == ".deft/core" or p.startswith(".deft/core/")]',
+    "    if not core:",
+    "        return 0",
+    "    checks = {",
+    '        "package.json": pkg_pin_only,',
+    '        "package-lock.json": npm_lock_ok,',
+    '        "pnpm-lock.yaml": pnpm_ok,',
+    '        "yarn.lock": yarn_ok,',
+    "    }",
+    "    bad = []",
+    "    for path, fn in checks.items():",
+    "        if path not in paths:",
+    "            continue",
+    "        if not fn(git_show(base_sha, path), git_show(head_sha, path)):",
+    "            bad.append(path)",
+    "    if bad:",
+    "        print(",
+    '            "::error title=deft-core guard (#3193)::package/lock co-travel with "',
+    '            ".deft/core/** must be @deftai/directive* pin-only + lock follow-through. "',
+    '            "Rejected: " + ", ".join(bad)',
+    "        )",
+    '        print("--- content-rejected pin/lock paths ---")',
+    '        print("\\n".join(bad))',
+    "        return 1",
+    '    print("OK: package/lock content is Directive pin unit (#3193).")',
+    "    return 0",
+    "",
+    "",
+    'if __name__ == "__main__":',
+    "    sys.exit(main())",
+].join("\n") + "\n";
+//# sourceMappingURL=core-guard-pin-content.js.map

package/dist/init-deposit/gitignore.js

@@ -29,7 +29,16 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     ".deft/.cli/",
     ".deft/ritual-state.json",
     ".deft/last-session.json",
+    ".deft/occupancy.json",
     ".deft/routing.local.json",
+    // Agent-host working state (#3502). Selective, NEVER blanket `.claude/`:
+    // `.claude/settings.json`, `.claude/skills/` and `.claude/commands/` are
+    // MANAGED DEPOSITS (agent-hooks.ts / skill-discovery-hosts.ts) and must stay
+    // trackable -- same #1144 hybrid rule that forbids blanket `.eval/`.
+    // Un-ignored agent worktrees leave a permanently dirty tree, which refuses
+    // release Step 1 for every consumer that dispatches subagents.
+    ".claude/worktrees/",
+    ".claude/settings.local.json",
     // #3282: opt-in default run-summary JSONL at repo root (collectible; must not dirty trees).
     ".deft-run-summary.json",
     // Temporary test/local kill-switch — must stay untracked (#3039).