@deftai/directive-core 0.107.0 → 0.109.0

package/dist/hooks/fixtures/cases.d.ts

@@ -4,20 +4,27 @@
  * Cases are pure data: raw stdin or structured payload → expected classification.
  * Core tests and CLI hook-dispatch tests import this module (shared corpus collapse).
  */
+import type { ExactLifecycleVerb, HookHostIdentityStatus } from "../classify/host-session-identity.js";
 import type { ClassifyHookHost, HookWriteIntent } from "../classify/types.js";
 export type FixtureOs = "win32" | "posix";
-export type FixtureToolFamily = "Write" | "ApplyPatch" | "Task" | "StrReplace" | "other";
+export type FixtureToolFamily = "Write" | "ApplyPatch" | "Task" | "StrReplace" | "Shell" | "other";
 export interface HookFixtureCase {
     readonly id: string;
     readonly host: ClassifyHookHost;
     readonly os: FixtureOs;
     readonly tool: FixtureToolFamily;
-    /** Closed-issue tags for the regression class this case freezes. */
+    /** Issue/regression tags for the behavior class this case freezes. */
     readonly regression: readonly string[];
     /** Structured payload when the host sends JSON. */
     readonly payload?: unknown;
     /** Raw stdin when testing BOM / free-form ApplyPatch parse. */
     readonly raw?: string;
+    /**
+     * Hook process environment for `host-env` identity providers (#3873).
+     * Identity assertions resolve against this instead of the ambient
+     * environment, so a corpus case cannot pass or fail by where it runs.
+     */
+    readonly environ?: Readonly<Record<string, string>>;
     readonly expected: {
         readonly toolName: string | null;
         readonly writeIntent: HookWriteIntent;
@@ -25,6 +32,19 @@ export interface HookFixtureCase {
         /** When raw is set: after parseHookStdin. */
         readonly stdinEmpty?: boolean;
         readonly parseFailed?: boolean;
+        /** Cooperative payload owner resolution expected for #3611 cases. */
+        readonly hostIdentity?: {
+            readonly status: HookHostIdentityStatus;
+            readonly sessionId: string | null;
+        };
+        /** Exact lifecycle classification/rewrite expected for #3611 shell cases. */
+        readonly lifecycle?: {
+            readonly verb: ExactLifecycleVerb | null;
+            readonly requestedSessionId: string;
+            readonly resultKind: "rewrite" | "conflict" | null;
+            readonly rewrittenCommand?: string;
+            readonly updatedInput?: Readonly<Record<string, unknown>>;
+        };
     };
     readonly notes?: string;
 }

package/dist/hooks/fixtures/cases.js

@@ -527,6 +527,234 @@ export const HOOK_FIXTURE_CASES = [
             writeTargetPath: "C:\\Repos\\proj\\src\\edit-me.ts",
         },
     },
+    // --- Cooperative host-session identity and exact lifecycle rewrite (#3611) ---
+    {
+        id: "codex-posix-shell-lifecycle-rewrite",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: {
+                command: "deft session:start --rearm",
+                description: "Re-arm the mutation session",
+            },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: "rewrite",
+                rewrittenCommand: "deft session:start --rearm --session-id=host:codex:v1:c2Vzc2lvbi1h",
+                updatedInput: {
+                    command: "deft session:start --rearm --session-id=host:codex:v1:c2Vzc2lvbi1h",
+                    description: "Re-arm the mutation session",
+                },
+            },
+        },
+    },
+    {
+        id: "codex-posix-shell-lifecycle-owner-conflict",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: {
+                command: "deft session:start --session-id=host:codex:v1:b3RoZXI",
+            },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: "conflict",
+            },
+        },
+    },
+    {
+        id: "codex-posix-shell-lifecycle-ambiguous",
+        host: "codex",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: "session-a",
+            tool_input: { command: "deft session:start && echo unsafe" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:codex:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: null,
+                requestedSessionId: "host:codex:v1:c2Vzc2lvbi1h",
+                resultKind: null,
+            },
+        },
+    },
+    {
+        id: "cursor-posix-shell-identity-conflict",
+        host: "cursor",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Shell",
+            conversation_id: "conversation-a",
+            session_id: "conversation-b",
+            tool_input: { command: "task session:ready" },
+        },
+        expected: {
+            toolName: "Shell",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "conflict", sessionId: null },
+        },
+    },
+    {
+        // #3599 item 5: the refresh verb is only useful if the id it renews is the
+        // one later hook processes compare against. #3611's bridge supplies that.
+        id: "cursor-posix-shell-occupancy-heartbeat-rewrite",
+        host: "cursor",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3599", "#3611"],
+        payload: {
+            tool_name: "Bash",
+            conversation_id: "session-a",
+            tool_input: { command: "task occupancy:heartbeat" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:cursor:v1:c2Vzc2lvbi1h",
+            },
+            lifecycle: {
+                verb: "occupancy:heartbeat",
+                requestedSessionId: "host:cursor:v1:c2Vzc2lvbi1h",
+                resultKind: "rewrite",
+                rewrittenCommand: "task occupancy:heartbeat -- --session-id=host:cursor:v1:c2Vzc2lvbi1h",
+                updatedInput: {
+                    command: "task occupancy:heartbeat -- --session-id=host:cursor:v1:c2Vzc2lvbi1h",
+                },
+            },
+        },
+    },
+    {
+        id: "claude-posix-shell-identity-missing",
+        host: "claude",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            tool_input: { command: "deft occupancy:release" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "missing", sessionId: null },
+        },
+    },
+    {
+        id: "claude-posix-shell-identity-malformed",
+        host: "claude",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3611"],
+        payload: {
+            tool_name: "Bash",
+            session_id: " malformed ",
+            tool_input: { command: "deft occupancy:release" },
+        },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: { status: "invalid", sessionId: null },
+        },
+    },
+    // --- Host-env session identity (#3873) ---
+    {
+        // The claim side of the loop: without this rewrite the lease is claimed
+        // under a minted UUID that the later write gate can never present.
+        id: "grok-posix-shell-host-env-lifecycle-rewrite",
+        host: "grok",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3873", "#3611"],
+        payload: {
+            tool_name: "Bash",
+            tool_input: { command: "deft session:start" },
+        },
+        environ: { GROK_SESSION_ID: "grok-session-a" },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                resultKind: "rewrite",
+                rewrittenCommand: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                updatedInput: {
+                    command: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                },
+            },
+        },
+    },
+    {
+        id: "grok-posix-write-payload-session-id-untrusted",
+        host: "grok",
+        os: "posix",
+        tool: "Write",
+        regression: ["#3873"],
+        payload: {
+            tool_name: "Write",
+            session_id: "payload-owner",
+            tool_input: { content: "x", file_path: "src/app.ts" },
+        },
+        environ: {},
+        expected: {
+            toolName: "Write",
+            writeIntent: "direct-write",
+            writeTargetPath: "src/app.ts",
+            hostIdentity: { status: "missing", sessionId: null },
+        },
+        notes: "Grok's payload session_id contract is unverified; only the host variable is read",
+    },
     // --- Regression: empty / missing tool name ---
     {
         id: "cursor-posix-stdin-empty",

package/dist/hooks/git-destructive-log.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import type { GitDestructiveKind } from "./dest-form.js";
+export declare const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export type GitDestructiveDisposition = "deny" | "allow-fixture";
+export interface GitDestructiveRecord {
+    readonly ts: string;
+    readonly kind: GitDestructiveKind;
+    readonly disposition: GitDestructiveDisposition;
+    readonly command: string;
+    readonly projectRoot: string;
+    readonly host: string;
+    readonly toolName: string | null;
+    readonly actor: string;
+    readonly pid: number;
+    readonly relocators: readonly string[];
+    readonly unprovable: boolean;
+}
+export declare function resolveGitDestructiveLogPath(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDir?: string): string;
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export declare function appendGitDestructiveRecord(record: GitDestructiveRecord, options?: {
+    readonly logPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly append?: (path: string, line: string) => void;
+}): void;
+//# sourceMappingURL=git-destructive-log.d.ts.map

package/dist/hooks/git-destructive-log.js

@@ -0,0 +1,46 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { platformUserConfigDir } from "../user-config/resolve-user-md.js";
+export const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export function resolveGitDestructiveLogPath(env = process.env, platform = process.platform, homeDir = homedir()) {
+    const override = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim();
+    if (override !== undefined && override.length > 0) {
+        return resolve(override);
+    }
+    return join(platformUserConfigDir(platform, env, homeDir), "logs", "git-destructive.jsonl");
+}
+function defaultAppend(path, line) {
+    const targetAbs = resolve(path);
+    const parent = dirname(targetAbs);
+    mkdirSync(parent, { recursive: true });
+    containedWrite({
+        root: parent,
+        target: targetAbs,
+        data: line,
+        mode: "append",
+        mkdir: false,
+        mutation: false,
+    });
+}
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export function appendGitDestructiveRecord(record, options = {}) {
+    try {
+        const path = options.logPath ?? resolveGitDestructiveLogPath(options.env ?? process.env);
+        const line = `${JSON.stringify(record)}\n`;
+        (options.append ?? defaultAppend)(path, line);
+    }
+    catch {
+        // Attribution is best-effort; the fail-closed deny still stands.
+    }
+}
+//# sourceMappingURL=git-destructive-log.js.map

package/dist/hooks/index.d.ts

@@ -3,5 +3,7 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/hooks/index.js

@@ -3,5 +3,7 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.js.map

package/dist/hooks/scope.js

@@ -27,7 +27,9 @@ export function inspectActiveScope(projectRoot) {
     candidates.sort();
     let firstRejection = null;
     for (const candidate of candidates) {
-        const result = evaluate(candidate);
+        // #3736: origin freshness remains fail-closed at explicit xbrief:preflight.
+        // The host mutation path must stay local and render before its effective timeout.
+        const result = evaluate(candidate, { skipOriginFreshness: true });
         if (result.exitCode === 0) {
             return { ready: true, path: candidate, message: result.message };
         }

package/dist/hooks/shell-write-targets.d.ts

@@ -0,0 +1,10 @@
+export declare const SHELL_WRITE_KINDS: readonly ["set-content", "out-file", "add-content", "python-pathlib", "io-writealltext"];
+export type ShellWriteKind = (typeof SHELL_WRITE_KINDS)[number];
+export interface ShellWriteTarget {
+    readonly kind: ShellWriteKind;
+    readonly path: string;
+    readonly unprovable?: boolean;
+}
+export declare function classifyShellWriteTargets(command: string): ShellWriteTarget[];
+export declare function isInRepoShellWritePath(projectRoot: string, dest: string): boolean;
+//# sourceMappingURL=shell-write-targets.d.ts.map

package/dist/hooks/shell-write-targets.js

@@ -0,0 +1,274 @@
+/** Recognized in-repo Shell file-write dests (#3983 / #3987). */
+import { isAbsolute, relative, resolve } from "node:path";
+export const SHELL_WRITE_KINDS = [
+    "set-content",
+    "out-file",
+    "add-content",
+    "python-pathlib",
+    "io-writealltext",
+];
+const DQ = String.fromCharCode(34);
+const AQ = String.fromCharCode(39);
+function stripQuotes(token) {
+    const t = token.trim();
+    if (t.length < 2)
+        return t;
+    const a = t[0];
+    const b = t[t.length - 1];
+    if ((a === DQ && b === DQ) || (a === AQ && b === AQ))
+        return t.slice(1, -1);
+    return t;
+}
+function pushUnique(out, kind, raw) {
+    const path = stripQuotes(raw).trim();
+    if (path.length === 0)
+        return;
+    if (out.some((d) => d.kind === kind && d.path === path))
+        return;
+    out.push({ kind, path });
+}
+function extractQuoted(command, start) {
+    if (start >= command.length)
+        return { value: "", next: start };
+    const q = command[start];
+    if (q !== DQ && q !== AQ) {
+        let i = start;
+        while (i < command.length) {
+            const c = command[i];
+            if (c === undefined)
+                break;
+            if (c === " " || c === "	" || c === "," || c === ")")
+                break;
+            i += 1;
+        }
+        return { value: command.slice(start, i), next: i };
+    }
+    let i = start + 1;
+    while (i < command.length && command[i] !== q)
+        i += 1;
+    return { value: command.slice(start + 1, i), next: i + 1 };
+}
+function skipWs(command, start) {
+    let i = start;
+    while (i < command.length) {
+        const code = command.charCodeAt(i);
+        if (code !== 32 && code !== 9 && code !== 10 && code !== 13)
+            break;
+        i += 1;
+    }
+    return i;
+}
+function startsWithVerb(segment, verb) {
+    const i = skipWs(segment, 0);
+    if (segment.slice(i, i + verb.length).toLowerCase() !== verb.toLowerCase())
+        return false;
+    const next = segment[i + verb.length];
+    return next === undefined || next === " " || next === "	" || next === "-";
+}
+function splitWriteSegments(command) {
+    const segs = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        if (c === DQ || c === AQ) {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        const code = command.charCodeAt(i);
+        const next = command.charCodeAt(i + 1);
+        if ((code === 38 && next === 38) || (code === 124 && next === 124)) {
+            segs.push(cur);
+            cur = "";
+            i += 1;
+            continue;
+        }
+        if (code === 124 || code === 38 || code === 59 || code === 10 || code === 13) {
+            segs.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segs.push(cur);
+    return segs.map((seg) => seg.trim()).filter((seg) => seg.length > 0);
+}
+const PATH_PARAM_NAMES = ["path", "literalpath", "filepath"];
+function uniqueNamedParam(flag, names) {
+    const f = flag.replace(/^-+/, "").toLowerCase();
+    if (f.length === 0)
+        return null;
+    const hits = names.filter((n) => n.startsWith(f));
+    return hits.length === 1 ? (hits[0] ?? null) : null;
+}
+function parseFlag(token) {
+    if (!token.startsWith("-"))
+        return null;
+    const colon = token.indexOf(":");
+    if (colon <= 0)
+        return { flag: token, attached: null };
+    return { flag: token.slice(0, colon), attached: token.slice(colon + 1) };
+}
+function extractAfterVerb(command, verb, kind, out) {
+    if (!startsWithVerb(command, verb))
+        return;
+    const i = skipWs(command, 0);
+    let j = skipWs(command, i + verb.length);
+    let named = null;
+    let positional = null;
+    while (j < command.length) {
+        const extracted = extractQuoted(command, j);
+        if (extracted.value.length === 0)
+            break;
+        j = skipWs(command, extracted.next);
+        const parsed = parseFlag(extracted.value);
+        if (parsed === null) {
+            if (positional === null)
+                positional = extracted.value;
+            continue;
+        }
+        let arg = parsed.attached;
+        if (arg === null || arg.length === 0) {
+            const next = extractQuoted(command, j);
+            if (next.value.length > 0 && !next.value.startsWith("-")) {
+                arg = next.value;
+                j = skipWs(command, next.next);
+            }
+            else {
+                arg = null;
+            }
+        }
+        if (uniqueNamedParam(parsed.flag, PATH_PARAM_NAMES) !== null) {
+            if (arg !== null && arg.length > 0 && !arg.startsWith("-"))
+                named = arg;
+        }
+    }
+    const dest = named ?? positional;
+    if (dest !== null && !dest.startsWith("-"))
+        pushUnique(out, kind, dest);
+}
+function pathlibWriteFollows(command, afterPathArgs) {
+    let i = skipWs(command, afterPathArgs);
+    if (command[i] === ")")
+        i = skipWs(command, i + 1);
+    while (i < command.length) {
+        if (command[i] === ";")
+            return false;
+        i = skipWs(command, i);
+        if (command[i] !== ".")
+            return false;
+        i += 1;
+        const start = i;
+        while (i < command.length) {
+            const c = command.charCodeAt(i);
+            if ((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95) {
+                i += 1;
+                continue;
+            }
+            break;
+        }
+        const name = command.slice(start, i);
+        i = skipWs(command, i);
+        if (command[i] !== "(")
+            return false;
+        if (name === "write_text")
+            return true;
+        if (name === "write_bytes")
+            return true;
+        i += 1;
+        let depth = 1;
+        while (i < command.length && depth > 0) {
+            const ch = command[i];
+            if (ch === "(")
+                depth += 1;
+            else if (ch === ")")
+                depth -= 1;
+            i += 1;
+        }
+    }
+    return false;
+}
+function extractPythonPathlib(command, out) {
+    const i = skipWs(command, 0);
+    const head = command.slice(i, i + 10).toLowerCase();
+    if (!head.startsWith("python") && !head.startsWith("py ") && !head.startsWith("py.exe"))
+        return;
+    const needle = "Path(";
+    let from = i;
+    while (from < command.length) {
+        const at = command.indexOf(needle, from);
+        if (at < 0)
+            return;
+        let j = skipWs(command, at + needle.length);
+        const ch = command[j];
+        if (ch === "r" || ch === "R")
+            j = skipWs(command, j + 1);
+        const extracted = extractQuoted(command, j);
+        if (pathlibWriteFollows(command, extracted.next)) {
+            pushUnique(out, "python-pathlib", extracted.value);
+        }
+        from = at + needle.length;
+    }
+}
+function extractIoWrite(command, out) {
+    const i = skipWs(command, 0);
+    if (command[i] !== "[")
+        return;
+    const needles = ["WriteAllText(", "WriteAllBytes("];
+    for (const needle of needles) {
+        const at = command.indexOf(needle, i);
+        if (at < 0)
+            continue;
+        const j = skipWs(command, at + needle.length);
+        const extracted = extractQuoted(command, j);
+        pushUnique(out, "io-writealltext", extracted.value);
+    }
+}
+function classifySimpleWrite(command) {
+    const out = [];
+    extractAfterVerb(command, "Set-Content", "set-content", out);
+    extractAfterVerb(command, "Add-Content", "add-content", out);
+    extractAfterVerb(command, "Out-File", "out-file", out);
+    extractPythonPathlib(command, out);
+    extractIoWrite(command, out);
+    return out;
+}
+export function classifyShellWriteTargets(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitWriteSegments(cmd);
+    if (segments.length === 1)
+        return classifySimpleWrite(segments[0] ?? cmd);
+    const found = [];
+    for (const seg of segments)
+        found.push(...classifySimpleWrite(seg));
+    if (found.length === 0)
+        return [];
+    return found.map((d) => ({ ...d, unprovable: true }));
+}
+export function isInRepoShellWritePath(projectRoot, dest) {
+    const path = dest.trim();
+    if (path.length === 0)
+        return false;
+    if (path.includes("*") || path.includes("?") || path.includes("$"))
+        return false;
+    const root = resolve(projectRoot);
+    const abs = isAbsolute(path) ? resolve(path) : resolve(root, path);
+    const rel = relative(root, abs);
+    if (rel.length === 0)
+        return false;
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    return true;
+}
+//# sourceMappingURL=shell-write-targets.js.map