@deftai/directive-core 0.106.0 → 0.108.0

package/dist/hooks/classify/index.js

@@ -5,9 +5,10 @@
  * Policy / ritual / scope / permission emission stay in dispatcher + CLI adapter.
  */
 export { classifyHookPayload } from "./classify.js";
-export { hookMcpArgsText, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
+export { EXACT_LIFECYCLE_VERBS, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
+export { hookApplyPatchBodyPaths, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
 export { fieldPresent, fieldString, firstString, hookPayloadTopLevelKeys, record, toolInputRecord, } from "./payload.js";
-export { parseHookStdin, stripUtf8Bom } from "./stdin.js";
+export { applyPatchMutationPaths, parseHookStdin, stripUtf8Bom } from "./stdin.js";
 export { hookToolName, inferCursorDirectWriteToolName, missingToolNameMessage, } from "./tool-name.js";
 export { CLASSIFY_HOOK_HOSTS } from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/hooks/classify/paths.d.ts

@@ -7,6 +7,13 @@
  * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
  */
 export declare function hookWriteTargetPath(payload: unknown): string | null;
+/** ApplyPatch body paths from patch / unified_diff / diff fields. */
+export declare function hookApplyPatchBodyPaths(payload: unknown): string[];
+/**
+ * Declared write target plus ApplyPatch body members. Used to admit one
+ * effectiveRoot; a span across two Git toplevels is refused (#3794).
+ */
+export declare function hookMutationTargetPaths(payload: unknown): string[];
 /**
  * Best-effort shell command string from host PreToolUse payloads (#2711).
  * Hosts disagree on nesting (`tool_input.command` vs top-level `command`).

package/dist/hooks/classify/paths.js

@@ -3,6 +3,7 @@
  * No process I/O — does not resolve against projectRoot or realpath.
  */
 import { firstString, record, toolInputRecord } from "./payload.js";
+import { applyPatchMutationPaths } from "./stdin.js";
 /**
  * Best-effort write-target path from host PreToolUse payloads (#2625).
  * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
@@ -21,6 +22,40 @@ export function hookWriteTargetPath(payload) {
         input.path,
     ]);
 }
+/** ApplyPatch body paths from patch / unified_diff / diff fields. */
+export function hookApplyPatchBodyPaths(payload) {
+    const input = record(payload);
+    if (input === null)
+        return [];
+    const toolInput = toolInputRecord(input);
+    const patch = firstString([
+        toolInput?.patch,
+        toolInput?.unified_diff,
+        toolInput?.diff,
+        input.patch,
+        input.unified_diff,
+        input.diff,
+    ]);
+    return patch === null ? [] : applyPatchMutationPaths(patch);
+}
+/**
+ * Declared write target plus ApplyPatch body members. Used to admit one
+ * effectiveRoot; a span across two Git toplevels is refused (#3794).
+ */
+export function hookMutationTargetPaths(payload) {
+    const seen = new Set();
+    const out = [];
+    const push = (value) => {
+        if (value === null || value.length === 0 || seen.has(value))
+            return;
+        seen.add(value);
+        out.push(value);
+    };
+    push(hookWriteTargetPath(payload));
+    for (const path of hookApplyPatchBodyPaths(payload))
+        push(path);
+    return out;
+}
 /**
  * Best-effort shell command string from host PreToolUse payloads (#2711).
  * Hosts disagree on nesting (`tool_input.command` vs top-level `command`).

package/dist/hooks/classify/stdin.d.ts

@@ -4,6 +4,11 @@
  */
 import type { ParsedHookPayload } from "./types.js";
 export declare function stripUtf8Bom(raw: string): string;
+/**
+ * Paths named by ApplyPatch mutation headers, plus `*** Move to:` rename
+ * destinations. Order preserved, duplicates dropped.
+ */
+export declare function applyPatchMutationPaths(text: string): string[];
 /**
  * Parse host hook stdin text into a payload + parse context.
  * Empty → stdinEmpty; invalid JSON without free-form ApplyPatch → parseFailed.

package/dist/hooks/classify/stdin.js

@@ -6,9 +6,36 @@ const UTF8_BOM = "\uFEFF";
 const APPLY_PATCH_BEGIN_MARKER = "*** Begin Patch";
 /** Single-file Add/Update only — other *** … File: ops must fail closed (#2738 Greptile). */
 const APPLY_PATCH_MUTATION_LINE_RE = /^\*\*\* (Add File|Update File|Delete File|Move File|Rename File): (.+)$/gm;
+/**
+ * Canonical apply_patch spells a rename as `*** Update File:` followed by
+ * `*** Move to:`. The destination is a mutation target in its own right, so it
+ * must reach root admission; kept separate from the header regex above so the
+ * single-mutation #2738 synthesis contract is unchanged (#3794).
+ */
+const APPLY_PATCH_MOVE_DESTINATION_RE = /^\*\*\* Move to: (.+)$/gm;
 export function stripUtf8Bom(raw) {
     return raw.startsWith(UTF8_BOM) ? raw.slice(UTF8_BOM.length) : raw;
 }
+/**
+ * Paths named by ApplyPatch mutation headers, plus `*** Move to:` rename
+ * destinations. Order preserved, duplicates dropped.
+ */
+export function applyPatchMutationPaths(text) {
+    const paths = [];
+    const seen = new Set();
+    const push = (raw) => {
+        const path = raw?.trim();
+        if (!path || seen.has(path))
+            return;
+        seen.add(path);
+        paths.push(path);
+    };
+    for (const match of text.matchAll(APPLY_PATCH_MUTATION_LINE_RE))
+        push(match[2]);
+    for (const match of text.matchAll(APPLY_PATCH_MOVE_DESTINATION_RE))
+        push(match[1]);
+    return paths;
+}
 function trySynthesizeFreeFormApplyPatch(normalized) {
     if (!normalized.includes(APPLY_PATCH_BEGIN_MARKER))
         return null;

package/dist/hooks/dest-form.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Product dest-form classifier for in-repo Shell mutations (#3438).
+ *
+ * NEW harvest — do not reuse `classifyShellAuthzOps` / `listShellOps` as-is.
+ * Those return [] for `git checkout --` / `rm` of ordinary product paths.
+ *
+ * ! Resolves a target for ONE shape only: a single simple command. Everything
+ * else is recognized and fail-closed. Reconstructing a target from shell state
+ * was implemented and withdrawn — cwd depends on operator precedence, on exit
+ * status, on subshell boundaries, and on git config, and every resolution rule
+ * added produced its own fence bypass. Do not add it back; widen the recognized
+ * *forms* instead, and see `content/contracts/path-write-fence.md`.
+ *
+ * Residual known-open (recognition, not resolution): `python -c`,
+ * `cmd /c copy`, obfuscated `bash -c`.
+ *
+ * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
+ * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
+ * verified by a literal token search, so wrapping it silently fails the gate.
+ */
+export type ProductDestFormKind = "git-checkout" | "git-restore" | "rm" | "rmdir";
+export interface ProductDestForm {
+    readonly kind: ProductDestFormKind;
+    readonly path: string;
+    /**
+     * True when the target is not provable — a glob/variable or leading `~` dest,
+     * a git context option, or any command that is not a single simple one. The
+     * dispatcher denies these outright; `path` is then only for the message, and
+     * is `SHELL_DEST_EXPANSION_SENTINEL` when no token can be named.
+     */
+    readonly expansion?: boolean;
+}
+/** Injected write target for expansion dests so the fence cannot match a literal glob. */
+export declare const SHELL_DEST_EXPANSION_SENTINEL = "__shell_dest_expansion__";
+/**
+ * Inject a dest path so `inspectMutationGates` sees the same write target as Edit/Write.
+ * Preserves original payload fields (command, posture markers).
+ */
+export declare function payloadWithInjectedWriteTarget(payload: unknown, destPath: string): Record<string, unknown>;
+/**
+ * Classify recognized product dest-forms in a shell command (#3438 v1 list).
+ * Empty when the command is not `git checkout -- <paths>`, `git restore`, or `rm`/`rmdir`.
+ */
+export declare function destFormHasExpansion(path: string): boolean;
+export declare function classifyProductDestForms(command: string): ProductDestForm[];
+//# sourceMappingURL=dest-form.d.ts.map