@deftai/directive-core 0.106.0 → 0.108.0

package/dist/intake/clause-derivation.js

@@ -6,7 +6,7 @@
  * the missing derive step.
  */
 import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter, } from "../run-summary/index.js";
-import { deriveAcceptanceClauses, readAcceptanceClauses, serializeAcceptanceClauses, } from "../verify-ac/clauses.js";
+import { collectPlanItemAcceptanceSurface, deriveAcceptanceClauses, readAcceptanceClauses, serializeAcceptanceClauses, } from "../verify-ac/clauses.js";
 /** One-line remediation when a stamp has no statement-traceable clause (#3398). */
 export const CLAUSE_STAMP_IMPLEMENTATION_ONLY_REMEDIATION = "derive clauses from the statement's testable constraints";
 export const MISSING_AMBIGUITY_ATTESTATION_CAUSE = "missing_ambiguity_attestation";
@@ -72,7 +72,11 @@ export function collectTaskStatementFromPlan(plan) {
                 continue;
             }
             const narrative = asRecord(rec.narrative);
-            const text = narrative?.Acceptance;
+            const declared = narrative?.Acceptance;
+            // #3826: criteria commonly live in item.title with an empty narrative object.
+            // Reading only narrative.Acceptance left them out of the statement entirely,
+            // so a clause derived from a title could not trace back to it.
+            const text = isNonEmptyString(declared) ? declared : rec.title;
             if (isNonEmptyString(text)) {
                 parts.push(text.trim());
             }
@@ -296,7 +300,9 @@ export function applyClauseDerivationToPlan(plan, options = {}) {
             notice: "",
         };
     }
-    const clauses = deriveAcceptanceClauses(collectTaskStatementFromPlan(plan));
+    const clauses = deriveAcceptanceClauses(collectTaskStatementFromPlan(plan), {
+        itemSurface: collectPlanItemAcceptanceSurface(plan),
+    });
     if (clauses.length === 0) {
         return { applied: false, clauses: [], notice: "" };
     }

package/dist/intake/github-auth-modes-cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { fileURLToPath } from "node:url";
-import { githubAuthModesMain } from "./github-auth-modes.js";
+import { githubAuthModesMain, INSTALLATION_IDENTITY_ISSUE_URL } from "./github-auth-modes.js";
 function parseArgs(argv) {
     const out = {};
     for (let i = 0; i < argv.length; i += 1) {
@@ -11,11 +11,23 @@ function parseArgs(argv) {
             out.repo = argv[++i];
         else if (arg === "--github-auth-mode")
             out.githubAuthMode = argv[++i];
+        else if (arg === "--expected-login")
+            out.expectedLogin = argv[++i];
+        else if (arg === "--expected-app-slug" || arg === "--expected-installation-id") {
+            throw new Error(`${arg} is not accepted; GitHub App installation identity is deferred to ${INSTALLATION_IDENTITY_ISSUE_URL}`);
+        }
     }
     return out;
 }
 export function mainEntry(argv = process.argv.slice(2)) {
-    return githubAuthModesMain(parseArgs(argv));
+    try {
+        return githubAuthModesMain(parseArgs(argv));
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`${message}\n`);
+        return 2;
+    }
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
     process.exit(mainEntry());

package/dist/intake/github-auth-modes.d.ts

@@ -3,12 +3,23 @@ import { probeRuntimeCapabilities, type RuntimeCapabilityReport } from "./platfo
 export declare const GITHUB_AUTH_MODE_INJECTED_TOKEN = "injected-token";
 export declare const GITHUB_AUTH_MODE_HOST_GH = "host-gh";
 export declare const KNOWN_GITHUB_AUTH_MODES: Set<string>;
-export declare const DEFAULT_VALIDATION_REPO = "deftai/directive";
+export declare const PRINCIPAL_KIND_USER = "user";
 export declare const FAILURE_MISSING_INJECTED_TOKEN = "missing_injected_token";
 export declare const FAILURE_GH_AUTH = "gh_auth_failed";
 export declare const FAILURE_API_UNREACHABLE = "api_unreachable";
 export declare const FAILURE_REPO_ACCESS = "repo_access_denied";
 export declare const FAILURE_INVALID_MODE = "invalid_auth_mode";
+export declare const FAILURE_MISSING_EXPECTED_PRINCIPAL = "missing_expected_principal";
+export declare const FAILURE_PRINCIPAL_MISMATCH = "principal_mismatch";
+export declare const FAILURE_MISSING_TARGET_REPO = "missing_target_repo";
+export declare const FAILURE_INSTALLATION_IDENTITY_UNVERIFIABLE = "installation_identity_unverifiable";
+export declare const ENV_EXPECTED_GITHUB_LOGIN = "DEFT_EXPECTED_GITHUB_LOGIN";
+export declare const INSTALLATION_IDENTITY_ISSUE_URL = "https://github.com/deftai/directive/issues/3693";
+/** GitHub-specific expected worker principal. Not a universal (provider-neutral) identity. */
+export type ExpectedGithubWorkerPrincipal = {
+    readonly kind: "user";
+    readonly login: string;
+};
 export interface GitHubAuthValidationResult {
     readonly ok: boolean;
     readonly githubAuthMode: string;
@@ -17,31 +28,63 @@ export interface GitHubAuthValidationResult {
     readonly detail: string;
     readonly remediation: string | null;
     readonly login: string | null;
+    readonly principal: ExpectedGithubWorkerPrincipal | null;
+    readonly validationRepo: string | null;
 }
 export type GhRunner = (args: readonly string[], environ: NodeJS.ProcessEnv) => CompletedProcess;
-export declare function findInjectedToken(environ: NodeJS.ProcessEnv): string | null;
-export declare function inferGithubAuthMode(runtimeReport: RuntimeCapabilityReport): string;
-export declare function validateInjectedTokenMode(environ: NodeJS.ProcessEnv, options?: {
+export type GitRemoteReader = (cwd?: string) => string | null;
+export interface GithubAuthValidationOptions {
     repo?: string;
     runtimeMode?: string | null;
     runGh?: GhRunner;
-}): GitHubAuthValidationResult;
-export declare function validateHostGhMode(environ: NodeJS.ProcessEnv, options?: {
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
+    gitRemoteUrl?: string | null;
+    readGitRemote?: GitRemoteReader;
+    cwd?: string;
+}
+export declare function findInjectedToken(environ: NodeJS.ProcessEnv): string | null;
+export declare function inferGithubAuthMode(runtimeReport: RuntimeCapabilityReport): string;
+export declare function defaultReadGitOriginUrl(cwd?: string): string | null;
+export declare function parseOwnerRepoSlug(input: string): string | null;
+export declare function deriveValidationRepo(options: {
     repo?: string;
-    runtimeMode?: string | null;
-    runGh?: GhRunner;
-}): GitHubAuthValidationResult;
+    environ?: NodeJS.ProcessEnv;
+    gitRemoteUrl?: string | null;
+    readGitRemote?: GitRemoteReader;
+    cwd?: string;
+}): {
+    ok: true;
+    repo: string;
+} | {
+    ok: false;
+    detail: string;
+};
+export declare function resolveExpectedGithubWorkerPrincipal(environ: NodeJS.ProcessEnv, explicit?: ExpectedGithubWorkerPrincipal | null): ExpectedGithubWorkerPrincipal | {
+    error: string;
+} | null;
+export declare function isInstallationUserEndpointInapplicable(proc: CompletedProcess): boolean;
+export declare function formatUserApiFailureDetail(mode: string, proc: CompletedProcess): string;
+export declare function validateInjectedTokenMode(environ: NodeJS.ProcessEnv, options?: GithubAuthValidationOptions): GitHubAuthValidationResult;
+export declare function validateHostGhMode(environ: NodeJS.ProcessEnv, options?: GithubAuthValidationOptions): GitHubAuthValidationResult;
 export declare function validateGithubAuth(githubAuthMode: string, options?: {
     environ?: NodeJS.ProcessEnv;
     runtimeReport?: RuntimeCapabilityReport | null;
     repo?: string;
     runGh?: GhRunner;
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
+    gitRemoteUrl?: string | null;
+    readGitRemote?: GitRemoteReader;
+    cwd?: string;
 }): GitHubAuthValidationResult;
 export declare function validateGithubAuthForWorker(githubAuthMode?: string | null, options?: {
     environ?: NodeJS.ProcessEnv;
     runtimeReport?: RuntimeCapabilityReport | null;
     repo?: string;
     runGh?: GhRunner;
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
+    gitRemoteUrl?: string | null;
+    readGitRemote?: GitRemoteReader;
+    cwd?: string;
 }): GitHubAuthValidationResult;
 export declare function resultToDict(result: GitHubAuthValidationResult): Record<string, unknown>;
 export interface GitHubAuthModesCliArgs {
@@ -49,6 +92,8 @@ export interface GitHubAuthModesCliArgs {
     repo?: string;
     json?: boolean;
     runGh?: GhRunner;
+    expectedLogin?: string;
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
 }
 export declare function githubAuthModesMain(args: GitHubAuthModesCliArgs): number;
 export { probeRuntimeCapabilities };