@deftai/directive-core 0.107.0 → 0.108.0

package/dist/hooks/fixtures/cases.d.ts

@@ -4,15 +4,16 @@
  * Cases are pure data: raw stdin or structured payload → expected classification.
  * Core tests and CLI hook-dispatch tests import this module (shared corpus collapse).
  */
+import type { ExactLifecycleVerb, HookHostIdentityStatus } from "../classify/host-session-identity.js";
 import type { ClassifyHookHost, HookWriteIntent } from "../classify/types.js";
 export type FixtureOs = "win32" | "posix";
-export type FixtureToolFamily = "Write" | "ApplyPatch" | "Task" | "StrReplace" | "other";
+export type FixtureToolFamily = "Write" | "ApplyPatch" | "Task" | "StrReplace" | "Shell" | "other";
 export interface HookFixtureCase {
     readonly id: string;
     readonly host: ClassifyHookHost;
     readonly os: FixtureOs;
     readonly tool: FixtureToolFamily;
-    /** Closed-issue tags for the regression class this case freezes. */
+    /** Issue/regression tags for the behavior class this case freezes. */
     readonly regression: readonly string[];
     /** Structured payload when the host sends JSON. */
     readonly payload?: unknown;
@@ -25,6 +26,19 @@ export interface HookFixtureCase {
         /** When raw is set: after parseHookStdin. */
         readonly stdinEmpty?: boolean;
         readonly parseFailed?: boolean;
+        /** Cooperative payload owner resolution expected for #3611 cases. */
+        readonly hostIdentity?: {
+            readonly status: HookHostIdentityStatus;
+            readonly sessionId: string | null;
+        };
+        /** Exact lifecycle classification/rewrite expected for #3611 shell cases. */
+        readonly lifecycle?: {
+            readonly verb: ExactLifecycleVerb | null;
+            readonly requestedSessionId: string;
+            readonly resultKind: "rewrite" | "conflict" | null;
+            readonly rewrittenCommand?: string;
+            readonly updatedInput?: Readonly<Record<string, unknown>>;
+        };
     };
     readonly notes?: string;
 }

package/dist/hooks/fixtures/cases.js

@@ -527,6 +527,181 @@ export const HOOK_FIXTURE_CASES = [
             writeTargetPath: "C:\\Repos\\proj\\src\\edit-me.ts",
         },
     },
+    // --- Cooperative host-session identity and exact lifecycle rewrite (#3611) ---
+    {
+        id: "codex-posix-shell-lifecycle-rewrite",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: {
+                command: "deft session:start --rearm",
+                description: "Re-arm the mutation session",
+            },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: "rewrite",
+                rewrittenCommand: "deft session:start --rearm --session-id=host:codex:v1:c2Vzc2lvbi1h",
+                updatedInput: {
+                    command: "deft session:start --rearm --session-id=host:codex:v1:c2Vzc2lvbi1h",
+                    description: "Re-arm the mutation session",
+                },
+            },
+        },
+    },
+    {
+        id: "codex-posix-shell-lifecycle-owner-conflict",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: {
+                command: "deft session:start --session-id=host:codex:v1:b3RoZXI",
+            },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: "conflict",
+            },
+        },
+    },
+    {
+        id: "codex-posix-shell-lifecycle-ambiguous",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: { command: "deft session:start && echo unsafe" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: null,
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: null,
+            },
+        },
+    },
+    {
+        id: "cursor-posix-shell-identity-conflict",
+        host: "cursor",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Shell",
+            conversation_id: "conversation-a",
+            session_id: "conversation-b",
+            tool_input: { command: "task session:ready" },
+        },
+        expected: {
+            toolName: "Shell",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "conflict", sessionId: null },
+        },
+    },
+    {
+        // #3599 item 5: the refresh verb is only useful if the id it renews is the
+        // one later hook processes compare against. #3611's bridge supplies that.
+        id: "cursor-posix-shell-occupancy-heartbeat-rewrite",
+        host: "cursor",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3599", "#3611"],
+        payload: {
+            tool_name: "Bash",
+            conversation_id: "session-a",
+            tool_input: { command: "task occupancy:heartbeat" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:cursor:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "occupancy:heartbeat",
+                requestedSessionId: "host:cursor:v1:c2Vzc2lvbi1h",
+                resultKind: "rewrite",
+                rewrittenCommand: "task occupancy:heartbeat -- --session-id=host:cursor:v1:c2Vzc2lvbi1h",
+                updatedInput: {
+                    command: "task occupancy:heartbeat -- --session-id=host:cursor:v1:c2Vzc2lvbi1h",
+                },
+            },
+        },
+    },
+    {
+        id: "claude-posix-shell-identity-missing",
+        host: "claude",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            tool_input: { command: "deft occupancy:release" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "missing", sessionId: null },
+        },
+    },
+    {
+        id: "claude-posix-shell-identity-malformed",
+        host: "claude",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: " malformed ",
+            tool_input: { command: "deft occupancy:release" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "invalid", sessionId: null },
+        },
+    },
     // --- Regression: empty / missing tool name ---
     {
         id: "cursor-posix-stdin-empty",

package/dist/hooks/scope.js

@@ -27,7 +27,9 @@ export function inspectActiveScope(projectRoot) {
     candidates.sort();
     let firstRejection = null;
     for (const candidate of candidates) {
-        const result = evaluate(candidate);
+        // #3736: origin freshness remains fail-closed at explicit xbrief:preflight.
+        // The host mutation path must stay local and render before its effective timeout.
+        const result = evaluate(candidate, { skipOriginFreshness: true });
         if (result.exitCode === 0) {
             return { ready: true, path: candidate, message: result.message };
         }

package/dist/init-deposit/agent-hooks.d.ts

@@ -1,6 +1,7 @@
 import type { HookHost } from "../hooks/dispatcher.js";
 import { type HostHooksPolicy } from "../policy/host-hooks.js";
 import type { InitDepositIo } from "./constants.js";
+import { type HookRuntimeTravelSeams } from "./hook-runtime-travel.js";
 export { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 export declare const DEFT_HOOK_COMMAND_MARKER = "deft-hook";
 export declare const LEGACY_DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
@@ -41,7 +42,7 @@ export interface AgentHookDepositResult {
     readonly changedPaths: AgentHookPath[];
 }
 /** Merge Directive-owned project hook entries without replacing user configuration. */
-export declare function writeAgentHookDeposit(projectRoot: string, io?: InitDepositIo, hostHooksPolicy?: HostHooksPolicy): AgentHookDepositResult;
+export declare function writeAgentHookDeposit(projectRoot: string, io?: InitDepositIo, hostHooksPolicy?: HostHooksPolicy, travelSeams?: HookRuntimeTravelSeams): AgentHookDepositResult;
 /** Read-only registration probe shared by verify and doctor. */
 export declare function inspectAgentHookDeposit(projectRoot: string, hostHooksPolicy?: HostHooksPolicy): AgentHookInspection[];
 //# sourceMappingURL=agent-hooks.d.ts.map

package/dist/init-deposit/agent-hooks.js

@@ -4,6 +4,7 @@ import { assertDepositContained } from "../deposit/contain.js";
 import { containedRemove, containedRename, containedWrite } from "../fs/contained-write.js";
 import { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 import { isHostHookDepositEnabled, loadHostHooksPolicyFromProject, } from "../policy/host-hooks.js";
+import { inspectHookRuntimeTravel } from "./hook-runtime-travel.js";
 export { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 export const DEFT_HOOK_COMMAND_MARKER = "deft-hook";
 export const LEGACY_DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
@@ -252,7 +253,7 @@ function writeJsonIfChanged(projectRoot, path, payload, kind) {
     return true;
 }
 /** Merge Directive-owned project hook entries without replacing user configuration. */
-export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefined }, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot)) {
+export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefined }, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot), travelSeams = {}) {
     const changedPaths = [];
     const strippedPaths = [];
     const definitions = [
@@ -332,6 +333,12 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     if (changedPaths.length === 0 && strippedPaths.length === 0 && adaptersRemoved === 0) {
         io.printf("Directive agent hooks already current.\n");
     }
+    // #3785: the registration is trackable and the deposit that implements it is
+    // born-ignored, so warn when a clone would inherit the fence without a way to
+    // obtain the runtime it names.
+    const travel = inspectHookRuntimeTravel(projectRoot, definitions.map((definition) => ({ host: definition.host, path: definition.path })), hostHooksPolicy, travelSeams);
+    if (travel.warning !== null)
+        io.printf(`${travel.warning}\n`);
     return {
         changed: changedPaths.length + strippedPaths.length + adaptersRemoved > 0,
         changedPaths: [...changedPaths, ...strippedPaths],

package/dist/init-deposit/hook-runtime-travel.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Hook-runtime travel warning (#3785).
+ *
+ * Directive keeps the agent-hook registration files trackable by design and
+ * born-ignores the deposit that implements them. When a registration travels
+ * with the tree and nothing in that tree lets a clone obtain `deft-hook`, the
+ * registration arrives and the runtime does not. A fresh clone, CI runner, or
+ * container without a global install then fail-closes every mutation on an
+ * opaque exit 127, and no Directive code runs to explain it.
+ *
+ * "Travels" means tracked OR trackable-and-not-ignored. A first `deft init`
+ * writes the registration unstaged, so a tracked-only probe would go quiet on
+ * exactly the run that precedes the commit carrying the fence into every clone.
+ *
+ * The committed `package.json` dependency on `@deftai/directive` (#2264) is the
+ * existing reconstitution anchor. With it a clone can install the runtime the
+ * registration names; without it the registration names a command no clone can
+ * host. The anchor is read from the commit, not from the working tree or the
+ * index: a consumer can commit the generated registration and leave the
+ * manifest merely present, staged, or edited, and that is the case that strands
+ * the clone.
+ *
+ * Warn-only. Refusing `deft init` / `deft update` on this condition would be
+ * the same lockout from the other side, so the deposit still writes and
+ * reports. Absence of the runtime stays a deny — fail-open-on-absence was
+ * refuted as unimplementable and as a bypass primitive (#3156).
+ *
+ * Refs #3785, #3736, #3571, #2752, #2264, #3156.
+ */
+import { type HookHost, type HostHooksPolicy } from "../policy/host-hooks.js";
+import { type PinReadResult } from "../resolution/pin.js";
+/**
+ * Hosts whose registration is deposited `failClosed: true`. Only these turn a
+ * missing runtime into a denial; the rest fail open and merely lose the gate.
+ */
+export declare const FAIL_CLOSED_HOOK_HOSTS: readonly HookHost[];
+/** Manifest carrying the committed runtime anchor. */
+export declare const RUNTIME_ANCHOR_MANIFEST = "package.json";
+/**
+ * Spec prefixes that name a location instead of a release. Each resolves
+ * against something outside the tree -- a path, a symlink target, a workspace
+ * member -- so the clone that receives the registration cannot install from it.
+ */
+export declare const LOCATION_SPEC_PREFIXES: readonly ["file:", "link:", "portal:", "workspace:", "git+file:"];
+export type GitLsFilesProbe = (projectDir: string, paths: readonly string[]) => string | null;
+/** Contents of a path as committed at `HEAD`, or null when there is none. */
+export type CommittedFileProbe = (projectDir: string, path: string) => string | null;
+export interface HookRuntimeTravelSeams {
+    readonly gitLsFiles?: GitLsFilesProbe;
+    readonly readCommittedFile?: CommittedFileProbe;
+    readonly readPin?: (projectRoot: string) => PinReadResult;
+}
+/** One deposited registration considered by the probe. */
+export interface HookRegistrationRef {
+    readonly host: HookHost;
+    readonly path: string;
+}
+export interface HookRuntimeTravelResult {
+    /** Enabled registrations that travel with this repository. */
+    readonly travelingRegistrations: readonly string[];
+    /** Subset of {@link travelingRegistrations} deposited fail-closed. */
+    readonly failClosedRegistrations: readonly string[];
+    /** A committed manifest declares `@deftai/directive`, so a clone can install it. */
+    readonly runtimeTravels: boolean;
+    /** Null when the pairing is safe or git could not answer. */
+    readonly warning: string | null;
+}
+/**
+ * Report whether any enabled agent-hook registration travels with this tree
+ * while no manifest travelling alongside it lets a clone install the runtime it
+ * names.
+ *
+ * Disabled hosts are excluded: their registration is stripped, so a leftover
+ * copy cannot deny anything.
+ */
+export declare function inspectHookRuntimeTravel(projectRoot: string, registrations: readonly HookRegistrationRef[], hostHooksPolicy: HostHooksPolicy, seams?: HookRuntimeTravelSeams): HookRuntimeTravelResult;
+//# sourceMappingURL=hook-runtime-travel.d.ts.map

package/dist/init-deposit/hook-runtime-travel.js

@@ -0,0 +1,269 @@
+/**
+ * Hook-runtime travel warning (#3785).
+ *
+ * Directive keeps the agent-hook registration files trackable by design and
+ * born-ignores the deposit that implements them. When a registration travels
+ * with the tree and nothing in that tree lets a clone obtain `deft-hook`, the
+ * registration arrives and the runtime does not. A fresh clone, CI runner, or
+ * container without a global install then fail-closes every mutation on an
+ * opaque exit 127, and no Directive code runs to explain it.
+ *
+ * "Travels" means tracked OR trackable-and-not-ignored. A first `deft init`
+ * writes the registration unstaged, so a tracked-only probe would go quiet on
+ * exactly the run that precedes the commit carrying the fence into every clone.
+ *
+ * The committed `package.json` dependency on `@deftai/directive` (#2264) is the
+ * existing reconstitution anchor. With it a clone can install the runtime the
+ * registration names; without it the registration names a command no clone can
+ * host. The anchor is read from the commit, not from the working tree or the
+ * index: a consumer can commit the generated registration and leave the
+ * manifest merely present, staged, or edited, and that is the case that strands
+ * the clone.
+ *
+ * Warn-only. Refusing `deft init` / `deft update` on this condition would be
+ * the same lockout from the other side, so the deposit still writes and
+ * reports. Absence of the runtime stays a deny — fail-open-on-absence was
+ * refuted as unimplementable and as a bypass primitive (#3156).
+ *
+ * Refs #3785, #3736, #3571, #2752, #2264, #3156.
+ */
+import { execFileSync } from "node:child_process";
+import { disableHostHooksInvocation, isHostHookDepositEnabled, } from "../policy/host-hooks.js";
+import { PIN_DEPENDENCY_NAME, readPin } from "../resolution/pin.js";
+/**
+ * Hosts whose registration is deposited `failClosed: true`. Only these turn a
+ * missing runtime into a denial; the rest fail open and merely lose the gate.
+ */
+export const FAIL_CLOSED_HOOK_HOSTS = ["cursor"];
+/** Manifest carrying the committed runtime anchor. */
+export const RUNTIME_ANCHOR_MANIFEST = "package.json";
+/**
+ * Spec prefixes that name a location instead of a release. Each resolves
+ * against something outside the tree -- a path, a symlink target, a workspace
+ * member -- so the clone that receives the registration cannot install from it.
+ */
+export const LOCATION_SPEC_PREFIXES = [
+    "file:",
+    "link:",
+    "portal:",
+    "workspace:",
+    "git+file:",
+];
+/** Prefixes any clone can fetch: a registry alias or a remote repository. */
+const REMOTE_SPEC_PREFIXES = [
+    "npm:",
+    "http:",
+    "https:",
+    "git:",
+    "git+http:",
+    "git+https:",
+    "git+ssh:",
+    "github:",
+    "gitlab:",
+    "bitbucket:",
+];
+/**
+ * Whether a clone could install `deft-hook` from this spec.
+ *
+ * Allowlist, not denylist. Location forms are open-ended -- `file:`,
+ * `git+file:`, `../directive`, `/opt/directive`, `C:\src\directive`, `~/dev` --
+ * so enumerating them leaves the next shape uncovered, and an uncovered shape
+ * silences the warning. Anything that is not recognisably a registry release or
+ * a fetchable remote is therefore treated as not travelling. A bare
+ * `owner/repo` shorthand is refused on the same rule: it warns where the
+ * runtime might in fact arrive, which is the harmless direction for a
+ * warn-only probe.
+ */
+function reconstitutesForAClone(rawSpec) {
+    const spec = rawSpec.trim();
+    if (spec.length === 0)
+        return false;
+    const lower = spec.toLowerCase();
+    if (LOCATION_SPEC_PREFIXES.some((prefix) => lower.startsWith(prefix)))
+        return false;
+    if (REMOTE_SPEC_PREFIXES.some((prefix) => lower.startsWith(prefix)))
+        return true;
+    // Bare paths: relative, home-anchored, POSIX-absolute, or a Windows drive.
+    if (/^[.~/\\]/.test(spec) || /^[a-z]:[\\/]/i.test(spec))
+        return false;
+    // Anything else with a separator is a path or a repository shorthand, not a
+    // version, a range, or a dist-tag.
+    return !(spec.includes("/") || spec.includes("\\"));
+}
+function defaultGitLsFiles(projectDir, paths) {
+    try {
+        // Ask git rather than looking for `.git`: a project deposited into a
+        // subdirectory of a repository has no `.git` of its own, yet its
+        // registration is trackable by the parent. `ls-files` answers from any
+        // depth, relative to this directory, and declines outside a repository.
+        //
+        // `--cached` reports what is in the index, `--others --exclude-standard`
+        // what a first `deft init` just wrote and the next `git add` would sweep
+        // in; ignored paths are omitted, since they cannot reach a clone.
+        return execFileSync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "--", ...paths], {
+            cwd: projectDir,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        });
+    }
+    catch {
+        // git absent, or not a repository: whether these paths travel has no answer
+        // here, so the caller stays silent rather than guessing.
+        return null;
+    }
+}
+/** Paths that travel, as reported by git, or null when git could not answer. */
+function travelingPaths(output) {
+    if (output === null)
+        return null;
+    return new Set(output
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0));
+}
+function defaultReadCommittedFile(projectDir, path) {
+    try {
+        // `HEAD:./<path>` resolves relative to this directory, so a project nested
+        // in a repository reads its own manifest rather than the parent's.
+        return execFileSync("git", ["show", `HEAD:./${path}`], {
+            cwd: projectDir,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        });
+    }
+    catch {
+        // No commit, no such path in it, or no repository: nothing is committed
+        // here that a clone would receive.
+        return null;
+    }
+}
+/** The `@deftai/directive` spec as committed, or null when none is. */
+function committedRuntimeSpec(manifest) {
+    if (manifest === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(manifest);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const pkg = parsed;
+    for (const block of ["devDependencies", "dependencies"]) {
+        const deps = pkg[block];
+        if (typeof deps !== "object" || deps === null || Array.isArray(deps))
+            continue;
+        const spec = deps[PIN_DEPENDENCY_NAME];
+        if (typeof spec === "string" && spec.trim().length > 0)
+            return spec.trim();
+    }
+    return null;
+}
+function isFailClosed(host) {
+    return FAIL_CLOSED_HOOK_HOSTS.includes(host);
+}
+function recoveryHosts(failClosed) {
+    const hosts = [...new Set(failClosed.map((entry) => entry.host))];
+    return hosts
+        .map((host) => `\`${disableHostHooksInvocation(` --host ${host} --confirm`)}\``)
+        .join(" / ");
+}
+function causeLine(anchor) {
+    if (anchor.kind === "uncommitted") {
+        return `  ${RUNTIME_ANCHOR_MANIFEST} declares ${PIN_DEPENDENCY_NAME} but is not committed, so a fresh`;
+    }
+    if (anchor.kind === "non-portable") {
+        return `  ${RUNTIME_ANCHOR_MANIFEST} pins ${PIN_DEPENDENCY_NAME} to \`${anchor.spec}\`, which no clone can install, so a fresh`;
+    }
+    return `  No ${RUNTIME_ANCHOR_MANIFEST} dependency on ${PIN_DEPENDENCY_NAME} travels with this tree, so a fresh`;
+}
+function fixLine(anchor) {
+    if (anchor.kind === "uncommitted") {
+        return `  Fix: commit ${RUNTIME_ANCHOR_MANIFEST} so the runtime travels with the registration.`;
+    }
+    if (anchor.kind === "non-portable") {
+        return `  Fix: pin ${PIN_DEPENDENCY_NAME} to a published version so a clone can install it.`;
+    }
+    return `  Fix: commit a ${RUNTIME_ANCHOR_MANIFEST} dependency on ${PIN_DEPENDENCY_NAME} so the runtime travels too.`;
+}
+/**
+ * Judge the anchor from the commit, not the working tree or the index.
+ *
+ * A clone receives commits. A manifest that is merely present, merely staged,
+ * or edited-but-uncommitted declares the runtime to this machine only, and the
+ * consumer is free to commit the generated registration without it.
+ */
+function resolveAnchorState(committedSpec, workingSpec) {
+    if (committedSpec === null) {
+        return workingSpec === null ? { kind: "absent" } : { kind: "uncommitted" };
+    }
+    if (!reconstitutesForAClone(committedSpec)) {
+        return { kind: "non-portable", spec: committedSpec };
+    }
+    return { kind: "travels" };
+}
+function buildWarning(traveling, failClosed, anchor) {
+    const listed = traveling
+        .map((entry) => `${entry.path}${isFailClosed(entry.host) ? " (fail-closed)" : ""}`)
+        .join(", ");
+    const cause = causeLine(anchor);
+    const lines = [
+        `\u26a0 Hook registration travels without its runtime (#3785): ${listed}`,
+        cause,
+        "  clone, CI runner, or container cannot obtain the `deft-hook` command these files name.",
+    ];
+    if (failClosed.length > 0) {
+        lines.push("  Fail-closed hosts then deny every mutation on an opaque exit 127, and no Directive", "  code runs to say why. There is no in-session recovery on a host without Node.");
+    }
+    lines.push(fixLine(anchor));
+    if (failClosed.length > 0) {
+        lines.push(`  Or, accepting the capability cost: ${recoveryHosts(failClosed)}.`);
+    }
+    lines.push("  \u2297 Do not hand-edit `failClosed` in the deposited file -- the next `deft update` restores it.", "  Detail: .deft/core/docs/hook-runtime-unavailable.md");
+    return lines.join("\n");
+}
+/**
+ * Report whether any enabled agent-hook registration travels with this tree
+ * while no manifest travelling alongside it lets a clone install the runtime it
+ * names.
+ *
+ * Disabled hosts are excluded: their registration is stripped, so a leftover
+ * copy cannot deny anything.
+ */
+export function inspectHookRuntimeTravel(projectRoot, registrations, hostHooksPolicy, seams = {}) {
+    const enabled = registrations.filter((entry) => isHostHookDepositEnabled(entry.host, hostHooksPolicy));
+    const probePaths = [...enabled.map((entry) => entry.path), RUNTIME_ANCHOR_MANIFEST];
+    const gitLsFiles = seams.gitLsFiles ?? defaultGitLsFiles;
+    const traveling = travelingPaths(gitLsFiles(projectRoot, probePaths));
+    if (traveling === null) {
+        return {
+            travelingRegistrations: [],
+            failClosedRegistrations: [],
+            runtimeTravels: false,
+            warning: null,
+        };
+    }
+    // The two sides are judged asymmetrically, deliberately. A registration is
+    // dangerous as soon as it is trackable: one `git add` sends it to every
+    // clone. An anchor counts only once a commit carries it, because a clone
+    // receives commits -- present, staged, and edited-but-uncommitted manifests
+    // all declare the runtime to this machine alone.
+    const readCommittedFile = seams.readCommittedFile ?? defaultReadCommittedFile;
+    const committedSpec = committedRuntimeSpec(readCommittedFile(projectRoot, RUNTIME_ANCHOR_MANIFEST));
+    const anchor = resolveAnchorState(committedSpec, (seams.readPin ?? readPin)(projectRoot).rawSpec);
+    const runtimeTravels = anchor.kind === "travels";
+    const travelingRegistrations = enabled.filter((entry) => traveling.has(entry.path));
+    const failClosedRegistrations = travelingRegistrations.filter((entry) => isFailClosed(entry.host));
+    const unsafe = travelingRegistrations.length > 0 && !runtimeTravels;
+    return {
+        travelingRegistrations: travelingRegistrations.map((entry) => entry.path),
+        failClosedRegistrations: failClosedRegistrations.map((entry) => entry.path),
+        runtimeTravels,
+        warning: unsafe ? buildWarning(travelingRegistrations, failClosedRegistrations, anchor) : null,
+    };
+}
+//# sourceMappingURL=hook-runtime-travel.js.map

package/dist/intake/clause-derivation.js

@@ -6,7 +6,7 @@
  * the missing derive step.
  */
 import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter, } from "../run-summary/index.js";
-import { deriveAcceptanceClauses, readAcceptanceClauses, serializeAcceptanceClauses, } from "../verify-ac/clauses.js";
+import { collectPlanItemAcceptanceSurface, deriveAcceptanceClauses, readAcceptanceClauses, serializeAcceptanceClauses, } from "../verify-ac/clauses.js";
 /** One-line remediation when a stamp has no statement-traceable clause (#3398). */
 export const CLAUSE_STAMP_IMPLEMENTATION_ONLY_REMEDIATION = "derive clauses from the statement's testable constraints";
 export const MISSING_AMBIGUITY_ATTESTATION_CAUSE = "missing_ambiguity_attestation";
@@ -72,7 +72,11 @@ export function collectTaskStatementFromPlan(plan) {
                 continue;
             }
             const narrative = asRecord(rec.narrative);
-            const text = narrative?.Acceptance;
+            const declared = narrative?.Acceptance;
+            // #3826: criteria commonly live in item.title with an empty narrative object.
+            // Reading only narrative.Acceptance left them out of the statement entirely,
+            // so a clause derived from a title could not trace back to it.
+            const text = isNonEmptyString(declared) ? declared : rec.title;
             if (isNonEmptyString(text)) {
                 parts.push(text.trim());
             }
@@ -296,7 +300,9 @@ export function applyClauseDerivationToPlan(plan, options = {}) {
             notice: "",
         };
     }
-    const clauses = deriveAcceptanceClauses(collectTaskStatementFromPlan(plan));
+    const clauses = deriveAcceptanceClauses(collectTaskStatementFromPlan(plan), {
+        itemSurface: collectPlanItemAcceptanceSurface(plan),
+    });
     if (clauses.length === 0) {
         return { applied: false, clauses: [], notice: "" };
     }