@deftai/directive-core 0.108.0 → 0.109.0

package/dist/deposit/stage-content-pack.js

@@ -0,0 +1,91 @@
+/**
+ * Stage the @deftai/directive-content pack the same way prepack does, then
+ * rewrite relative markdown links onto the flattened deposit layout (#3937).
+ *
+ * Must not write into the source tree: destDir is the pack root (packages/content
+ * during prepack, or an out-of-tree temp dir in tests).
+ */
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, } from "node:fs";
+import { join, relative } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { rewriteMarkdownDepositLinks, sourceRelForPackRel } from "./rewrite-deposit-links.js";
+const ENGINE_ENTRIES = [".githooks", "Taskfile.yml", "tasks"];
+const HARNESS_ENTRIES = ["main.md", "SKILL.md"];
+function keepCopy(src) {
+    return !src.includes("__pycache__") && !src.endsWith(".pyc") && !src.endsWith(".py");
+}
+function rewriteStagedMarkdown(destDir) {
+    let filesRewritten = 0;
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile() || !entry.name.endsWith(".md"))
+                continue;
+            const packRel = relative(destDir, full).replace(/\\/g, "/");
+            const original = readFileSync(full, "utf8");
+            const { content, rewriteCount } = rewriteMarkdownDepositLinks({
+                content: original,
+                sourceFileRel: sourceRelForPackRel(packRel),
+                packFileRel: packRel,
+            });
+            if (rewriteCount > 0 && content !== original) {
+                containedWrite({
+                    root: destDir,
+                    target: packRel,
+                    data: content,
+                    mode: "replace",
+                });
+                filesRewritten += 1;
+            }
+        }
+    };
+    walk(destDir);
+    return filesRewritten;
+}
+/** Copy content/ + harness + engine entries, then rewrite markdown links. */
+export function stageContentPack(options) {
+    const { repoRoot, destDir } = options;
+    mkdirSync(destDir, { recursive: true });
+    const contentSrc = join(repoRoot, "content");
+    for (const name of readdirSync(contentSrc)) {
+        const from = join(contentSrc, name);
+        const to = join(destDir, name);
+        if (existsSync(to))
+            rmSync(to, { recursive: true, force: true });
+        cpSync(from, to, { recursive: true, filter: (src) => keepCopy(src) });
+    }
+    for (const name of ENGINE_ENTRIES) {
+        const from = join(repoRoot, name);
+        if (!existsSync(from))
+            continue;
+        const to = join(destDir, name);
+        if (existsSync(to))
+            rmSync(to, { recursive: true, force: true });
+        cpSync(from, to, { recursive: true, filter: (src) => keepCopy(src) });
+    }
+    for (const name of HARNESS_ENTRIES) {
+        const from = join(repoRoot, name);
+        if (!existsSync(from))
+            continue;
+        cpSync(from, join(destDir, name));
+    }
+    const filesRewritten = rewriteStagedMarkdown(destDir);
+    return { filesRewritten };
+}
+/** prepack cwd is packages/content. */
+export function runPrepackFromContentPackage(pkgDir) {
+    const repoRoot = join(pkgDir, "..", "..");
+    stageContentPack({ repoRoot, destDir: pkgDir });
+}
+//# sourceMappingURL=stage-content-pack.js.map

package/dist/design-critique/citation-grammar.d.ts

@@ -44,6 +44,13 @@ export type CitationScan = {
 };
 /** The published closed set, in the order the contract lists it. */
 export declare const ACCEPTED_CITATION_FORMS: readonly string[];
+/**
+ * Refused positions are exactly the five published classes. An indented code
+ * block and an HTML comment are deliberately not classified: a four-space
+ * indent is also ordinary list-continuation content, so refusing it would block
+ * valid records more often than it would catch example text.
+ */
+export declare function classifyPosition(body: string, offset: number): CitationRejectionClass | null;
 /**
  * Parse the closed citation grammar out of one comment body. Refused positions
  * are reported rather than dropped so a block detail can echo the observation

package/dist/design-critique/citation-grammar.js

@@ -239,7 +239,7 @@ function blockPosition(body, offset) {
  * indent is also ordinary list-continuation content, so refusing it would block
  * valid records more often than it would catch example text.
  */
-function classifyPosition(body, offset) {
+export function classifyPosition(body, offset) {
     const block = blockPosition(body, offset);
     if (block.insideFence)
         return "code-fence";

package/dist/design-critique/completed-arc-record.d.ts

@@ -15,7 +15,7 @@ export type ThreadComment = {
     readonly id: number;
     readonly body: string;
 };
-export type CompletedArcBlockReason = "missing-record" | "lone-shape" | "cite-not-lean" | "missing-table-cite";
+export type CompletedArcBlockReason = "missing-record" | "lone-shape" | "cite-not-lean" | "missing-table-cite" | "ambiguous-table-cite";
 export type CompletedArcVerdict = {
     readonly status: "not-in-arc";
 } | {

package/dist/design-critique/completed-arc-record.js

@@ -126,6 +126,61 @@ function resolveCitedLean(citations, byCommentId, latestLean) {
         .map((row) => byCommentId.get(row.id))
         .find((row) => row !== undefined && isSuccessorLeanBody(row.body));
 }
+/**
+ * Table resolution precedence (#3932).
+ *
+ * A typed `verified-claims table <id>` citation is the synthesis naming its own
+ * table, so it decides resolution: a generic citation neither satisfies it nor
+ * masks it. Scanning every citation for the first table-shaped body -- what
+ * this did before -- let an unrelated table-shaped comment clear a record whose
+ * claimed table is not a table, because the `missing-table-cite` refusal ran
+ * only after that untyped search failed.
+ *
+ * Cardinality rule: every table-kind claim must resolve to the same
+ * verified-claims table artifact. One valid typed claim must not launder an
+ * invalid one -- filtering to typed citations and then taking the first
+ * table-shaped body finds the real table in a valid-plus-ghost pair and never
+ * examines the ghost. `scanCitations` deduplicates on `(id, kind)`, so naming
+ * one table id twice is a single claim, while two distinct typed ids are two
+ * claims and cannot both be this record's table.
+ *
+ * With no typed claim the generic scan stands unchanged: permalink and bare
+ * `comment` citations scan as kind `comment`, and that is the published form
+ * these records use. Narrowing the citation contract so a table must be named
+ * by keyword is a separate decision needing its own migration criteria.
+ */
+function resolveCitedTable(citations, byCommentId) {
+    const claimed = citations.filter((row) => row.kind === "table");
+    if (claimed.length === 0) {
+        return {
+            ok: true,
+            table: citations
+                .map((row) => byCommentId.get(row.id))
+                .find((row) => row !== undefined && isVerifiedClaimsTableBody(row.body)),
+        };
+    }
+    const resolved = claimed.map((row) => ({ id: row.id, cited: byCommentId.get(row.id) }));
+    const unresolved = resolved.filter((row) => row.cited === undefined || !isVerifiedClaimsTableBody(row.cited.body));
+    if (unresolved.length > 0) {
+        return {
+            ok: false,
+            reason: "missing-table-cite",
+            detail: "synthesis cites a verified-claims table id that is not a table on this thread: " +
+                renderIds(unresolved.map((row) => row.id)),
+        };
+    }
+    const distinct = [...new Set(claimed.map((row) => row.id))];
+    if (distinct.length > 1) {
+        return {
+            ok: false,
+            reason: "ambiguous-table-cite",
+            detail: "synthesis claims more than one verified-claims table; every table citation must name " +
+                "the same table: " +
+                renderIds(distinct),
+        };
+    }
+    return { ok: true, table: resolved.find((row) => row.cited !== undefined)?.cited };
+}
 function verdictForSynthesis(comment, comments) {
     const scan = scanCitations(comment.body);
     const citations = scan.citations;
@@ -146,25 +201,15 @@ function verdictForSynthesis(comment, comments) {
                 renderIds(citations.map((row) => row.id)),
         };
     }
-    const citedTable = citations
-        .map((row) => byCommentId.get(row.id))
-        .find((row) => row !== undefined && isVerifiedClaimsTableBody(row.body));
-    if (citedTable === undefined) {
-        const claimed = citations.filter((row) => row.kind === "table");
-        if (claimed.length > 0) {
-            return {
-                status: "blocked",
-                reason: "missing-table-cite",
-                detail: "synthesis cites a verified-claims table id that is not a table on this thread: " +
-                    renderIds(claimed.map((row) => row.id)),
-            };
-        }
+    const citedTable = resolveCitedTable(citations, byCommentId);
+    if (!citedTable.ok) {
+        return { status: "blocked", reason: citedTable.reason, detail: citedTable.detail };
     }
     return {
         status: "complete",
         synthesisCommentId: comment.id,
         citedLeanId: citedLean.id,
-        citedTableId: citedTable?.id ?? null,
+        citedTableId: citedTable.table?.id ?? null,
     };
 }
 /**

package/dist/hooks/classify/host-session-identity.d.ts

@@ -1,12 +1,14 @@
 /**
  * Cooperative host-session identity and exact lifecycle-command rewriting (#3611).
  *
- * This is payload classification, not authentication. Host hook JSON is locally
- * forgeable under the occupancy model's cooperating-process assumption.
+ * This is payload/environment classification, not authentication. Host hook JSON
+ * is locally forgeable under the occupancy model's cooperating-process
+ * assumption. The provider table and the canonical owner form live in
+ * `session/host-session-owner.ts` because the CLI claim path resolves the same
+ * owner from the same host (#3873).
  */
-export declare const HOST_IDENTITY_PROVIDERS: readonly ["codex", "claude", "cursor"];
-export type HookHostIdentityProvider = (typeof HOST_IDENTITY_PROVIDERS)[number];
-export declare const MAX_HOOK_HOST_IDENTITY_UTF8_BYTES = 512;
+import { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentitySource, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES } from "../../session/host-session-owner.js";
+export { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentitySource, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, };
 export type HookHostIdentityStatus = "ok" | "missing" | "invalid" | "conflict" | "unsupported";
 export type HookHostIdentityResolution = {
     readonly status: "ok";
@@ -24,12 +26,24 @@ export type HookHostIdentityResolution = {
 /**
  * Resolve the stable conversation/session-family key documented by each host.
  *
- * - Codex: `session_id` (parent and subagents share it).
- * - Claude Code: `session_id` (`agent_id` is deliberately not the owner key).
- * - Cursor: `conversation_id`; simultaneous `session_id` must agree.
- * - Grok/unknown: no guessed payload identity; callers keep explicit/env flow.
+ * - Codex: payload `session_id` (parent and subagents share it).
+ * - Claude Code: payload `session_id` (`agent_id` is not the owner key).
+ * - Cursor: payload `conversation_id`; simultaneous `session_id` must agree.
+ * - Grok: hook process `GROK_SESSION_ID` (#3873). The payload `session_id` is
+ *   deliberately not read -- that contract is unverified.
+ * - Unknown hosts: no guessed identity; callers keep the explicit/env flow.
  */
-export declare function resolveHookHostIdentity(host: string, payload: unknown): HookHostIdentityResolution;
+export declare function resolveHookHostIdentity(host: string, payload: unknown, environ?: NodeJS.ProcessEnv): HookHostIdentityResolution;
+/**
+ * True when a `host-env` provider simply did not publish its variable (#3873).
+ *
+ * Absence is the pre-#3873 state rather than a broken contract, so callers keep
+ * the documented explicit `--session-id` / `DEFT_SESSION_ID` flow instead of
+ * failing a host that never had a hook identity to begin with. It is never an
+ * admission: with no explicit owner the actor stays unset and the write gate
+ * still denies. A present-but-malformed variable is `invalid` and fails closed.
+ */
+export declare function hostIdentityFallsBackToExplicitOwner(host: string, resolution: HookHostIdentityResolution): boolean;
 export declare const EXACT_LIFECYCLE_VERBS: readonly ["session:start", "session:ready", "session:end", "occupancy:steal", "occupancy:release", "occupancy:heartbeat", "swarm:launch"];
 export type ExactLifecycleVerb = (typeof EXACT_LIFECYCLE_VERBS)[number];
 export interface ExactLifecycleCommandRewrite {
@@ -72,5 +86,4 @@ export declare function inspectExactLifecycleCommand(payload: unknown): ExactLif
  * operator input.
  */
 export declare function rewriteExactLifecycleCommand(payload: unknown, sessionId: string): ExactLifecycleCommandResult;
-export {};
 //# sourceMappingURL=host-session-identity.d.ts.map

package/dist/hooks/classify/host-session-identity.js

@@ -1,47 +1,22 @@
 /**
  * Cooperative host-session identity and exact lifecycle-command rewriting (#3611).
  *
- * This is payload classification, not authentication. Host hook JSON is locally
- * forgeable under the occupancy model's cooperating-process assumption.
+ * This is payload/environment classification, not authentication. Host hook JSON
+ * is locally forgeable under the occupancy model's cooperating-process
+ * assumption. The provider table and the canonical owner form live in
+ * `session/host-session-owner.ts` because the CLI claim path resolves the same
+ * owner from the same host (#3873).
  */
+import { ambientHostSessionOwner, canonicalHostSessionId, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, isUsableHostSessionId, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, readHostEnvIdentity, } from "../../session/host-session-owner.js";
 import { isShellTool } from "../tools.js";
 import { record, toolInputRecord } from "./payload.js";
 import { hookToolName } from "./tool-name.js";
-export const HOST_IDENTITY_PROVIDERS = ["codex", "claude", "cursor"];
-export const MAX_HOOK_HOST_IDENTITY_UTF8_BYTES = 512;
-function hasControlCharacter(value) {
-    for (let index = 0; index < value.length; index += 1) {
-        const unit = value.charCodeAt(index);
-        if (unit <= 0x1f || (unit >= 0x7f && unit <= 0x9f))
-            return true;
-    }
-    return false;
-}
-function hasUnpairedUtf16Surrogate(value) {
-    for (let index = 0; index < value.length; index += 1) {
-        const unit = value.charCodeAt(index);
-        if (unit >= 0xd800 && unit <= 0xdbff) {
-            const next = value.charCodeAt(index + 1);
-            if (!(next >= 0xdc00 && next <= 0xdfff))
-                return true;
-            index += 1;
-            continue;
-        }
-        if (unit >= 0xdc00 && unit <= 0xdfff)
-            return true;
-    }
-    return false;
-}
+export { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, };
 function identityField(input, fieldName) {
     if (!(fieldName in input))
         return { status: "missing", value: null };
     const raw = input[fieldName];
-    if (typeof raw !== "string" ||
-        raw.length === 0 ||
-        raw !== raw.trim() ||
-        hasControlCharacter(raw) ||
-        hasUnpairedUtf16Surrogate(raw) ||
-        Buffer.byteLength(raw, "utf8") > MAX_HOOK_HOST_IDENTITY_UTF8_BYTES) {
+    if (typeof raw !== "string" || !isUsableHostSessionId(raw)) {
         return { status: "invalid", value: null };
     }
     return { status: "ok", value: raw };
@@ -49,10 +24,6 @@ function identityField(input, fieldName) {
 function unresolvedHostIdentity(status, provider, message) {
     return { status, provider, rawSessionId: null, sessionId: null, message };
 }
-function canonicalHostSessionId(provider, rawSessionId) {
-    const encoded = Buffer.from(rawSessionId, "utf8").toString("base64url");
-    return `host:${provider}:v1:${encoded}`;
-}
 function resolvedHostIdentity(provider, rawSessionId) {
     return {
         status: "ok",
@@ -65,28 +36,39 @@ function resolvedHostIdentity(provider, rawSessionId) {
 /**
  * Resolve the stable conversation/session-family key documented by each host.
  *
- * - Codex: `session_id` (parent and subagents share it).
- * - Claude Code: `session_id` (`agent_id` is deliberately not the owner key).
- * - Cursor: `conversation_id`; simultaneous `session_id` must agree.
- * - Grok/unknown: no guessed payload identity; callers keep explicit/env flow.
+ * - Codex: payload `session_id` (parent and subagents share it).
+ * - Claude Code: payload `session_id` (`agent_id` is not the owner key).
+ * - Cursor: payload `conversation_id`; simultaneous `session_id` must agree.
+ * - Grok: hook process `GROK_SESSION_ID` (#3873). The payload `session_id` is
+ *   deliberately not read -- that contract is unverified.
+ * - Unknown hosts: no guessed identity; callers keep the explicit/env flow.
  */
-export function resolveHookHostIdentity(host, payload) {
-    if (!HOST_IDENTITY_PROVIDERS.includes(host)) {
-        return unresolvedHostIdentity("unsupported", host, `Host ${host || "<empty>"} has no verified payload identity contract.`);
+export function resolveHookHostIdentity(host, payload, environ = process.env) {
+    const source = hookHostIdentitySource(host);
+    if (source === null) {
+        return unresolvedHostIdentity("unsupported", host, `Host ${host || "<empty>"} has no verified session identity contract.`);
     }
     const provider = host;
+    if (source.kind === "host-env") {
+        const value = readHostEnvIdentity(environ, source.variable);
+        if (value.status !== "ok") {
+            return unresolvedHostIdentity(value.status, provider, `${provider} hook process environment ` +
+                `${value.status === "missing" ? "omits" : "has invalid"} ${source.variable}.`);
+        }
+        return resolvedHostIdentity(provider, value.rawSessionId);
+    }
     const input = record(payload);
     if (input === null) {
         return unresolvedHostIdentity("invalid", provider, `${provider} hook payload is not an object.`);
     }
-    if (provider === "codex" || provider === "claude") {
-        const session = identityField(input, "session_id");
+    if (provider !== "cursor") {
+        const session = identityField(input, source.field);
         if (session.status !== "ok") {
-            return unresolvedHostIdentity(session.status, provider, `${provider} hook payload ${session.status === "missing" ? "omits" : "has invalid"} session_id.`);
+            return unresolvedHostIdentity(session.status, provider, `${provider} hook payload ${session.status === "missing" ? "omits" : "has invalid"} ${source.field}.`);
         }
         return resolvedHostIdentity(provider, session.value);
     }
-    const conversation = identityField(input, "conversation_id");
+    const conversation = identityField(input, source.field);
     if (conversation.status !== "ok") {
         return unresolvedHostIdentity(conversation.status, provider, `Cursor hook payload ${conversation.status === "missing" ? "omits" : "has invalid"} conversation_id.`);
     }
@@ -99,6 +81,18 @@ export function resolveHookHostIdentity(host, payload) {
     }
     return resolvedHostIdentity(provider, conversation.value);
 }
+/**
+ * True when a `host-env` provider simply did not publish its variable (#3873).
+ *
+ * Absence is the pre-#3873 state rather than a broken contract, so callers keep
+ * the documented explicit `--session-id` / `DEFT_SESSION_ID` flow instead of
+ * failing a host that never had a hook identity to begin with. It is never an
+ * admission: with no explicit owner the actor stays unset and the write gate
+ * still denies. A present-but-malformed variable is `invalid` and fails closed.
+ */
+export function hostIdentityFallsBackToExplicitOwner(host, resolution) {
+    return resolution.status === "missing" && hookHostIdentitySource(host)?.kind === "host-env";
+}
 export const EXACT_LIFECYCLE_VERBS = [
     "session:start",
     "session:ready",
@@ -117,7 +111,10 @@ const DIRECT_LIFECYCLE_VERBS = {
     "occupancy:heartbeat": "occupancy:heartbeat",
     "swarm-launch": "swarm:launch",
 };
-const CANONICAL_OWNER_PATTERN = /^host:(?:codex|claude|cursor):v1:[A-Za-z0-9_-]+$/;
+// Derived from the provider list so the rewrite surface cannot drift from the
+// identity surface: a provider added to one is added to both (#3873). Provider
+// ids are lowercase ASCII words, so the alternation needs no escaping.
+const CANONICAL_OWNER_PATTERN = new RegExp(`^host:(?:${HOST_IDENTITY_PROVIDERS.join("|")}):v1:[A-Za-z0-9_-]+$`);
 // Shell expansion markers are deliberately absent: `$`/backticks for POSIX,
 // `@` splatting for PowerShell, and `%NAME%` expansion for command shells.
 // Backslashes are inspectable so Windows path-bearing lifecycle commands fail

package/dist/hooks/classify/index.d.ts

@@ -5,8 +5,8 @@
  * Policy / ritual / scope / permission emission stay in dispatcher + CLI adapter.
  */
 export { classifyHookPayload } from "./classify.js";
-export { EXACT_LIFECYCLE_VERBS, type ExactLifecycleCommandConflict, type ExactLifecycleCommandInspection, type ExactLifecycleCommandResult, type ExactLifecycleCommandRewrite, type ExactLifecycleVerb, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentityResolution, type HookHostIdentityStatus, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
-export { hookApplyPatchBodyPaths, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
+export { EXACT_LIFECYCLE_VERBS, type ExactLifecycleCommandConflict, type ExactLifecycleCommandInspection, type ExactLifecycleCommandResult, type ExactLifecycleCommandRewrite, type ExactLifecycleVerb, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentityResolution, type HookHostIdentitySource, type HookHostIdentityStatus, hookHostIdentitySource, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
+export { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
 export { fieldPresent, fieldString, firstString, hookPayloadTopLevelKeys, record, toolInputRecord, } from "./payload.js";
 export { applyPatchMutationPaths, parseHookStdin, stripUtf8Bom } from "./stdin.js";
 export { hookToolName, inferCursorDirectWriteToolName, type MissingToolNameInput, missingToolNameMessage, } from "./tool-name.js";

package/dist/hooks/classify/index.js

@@ -5,8 +5,8 @@
  * Policy / ritual / scope / permission emission stay in dispatcher + CLI adapter.
  */
 export { classifyHookPayload } from "./classify.js";
-export { EXACT_LIFECYCLE_VERBS, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
-export { hookApplyPatchBodyPaths, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
+export { EXACT_LIFECYCLE_VERBS, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
+export { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
 export { fieldPresent, fieldString, firstString, hookPayloadTopLevelKeys, record, toolInputRecord, } from "./payload.js";
 export { applyPatchMutationPaths, parseHookStdin, stripUtf8Bom } from "./stdin.js";
 export { hookToolName, inferCursorDirectWriteToolName, missingToolNameMessage, } from "./tool-name.js";

package/dist/hooks/classify/paths.d.ts

@@ -7,6 +7,8 @@
  * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
  */
 export declare function hookWriteTargetPath(payload: unknown): string | null;
+/** Raw ApplyPatch body text from patch / unified_diff / diff fields. */
+export declare function hookApplyPatchBodyText(payload: unknown): string | null;
 /** ApplyPatch body paths from patch / unified_diff / diff fields. */
 export declare function hookApplyPatchBodyPaths(payload: unknown): string[];
 /**

package/dist/hooks/classify/paths.js

@@ -22,13 +22,13 @@ export function hookWriteTargetPath(payload) {
         input.path,
     ]);
 }
-/** ApplyPatch body paths from patch / unified_diff / diff fields. */
-export function hookApplyPatchBodyPaths(payload) {
+/** Raw ApplyPatch body text from patch / unified_diff / diff fields. */
+export function hookApplyPatchBodyText(payload) {
     const input = record(payload);
     if (input === null)
-        return [];
+        return null;
     const toolInput = toolInputRecord(input);
-    const patch = firstString([
+    return firstString([
         toolInput?.patch,
         toolInput?.unified_diff,
         toolInput?.diff,
@@ -36,6 +36,10 @@ export function hookApplyPatchBodyPaths(payload) {
         input.unified_diff,
         input.diff,
     ]);
+}
+/** ApplyPatch body paths from patch / unified_diff / diff fields. */
+export function hookApplyPatchBodyPaths(payload) {
+    const patch = hookApplyPatchBodyText(payload);
     return patch === null ? [] : applyPatchMutationPaths(patch);
 }
 /**

package/dist/hooks/classify/stdin.js

@@ -2,6 +2,7 @@
  * Pure stdin → payload parse for hook-dispatch (#2734 / #2738 / #2950).
  * No process I/O — operates on an already-read string.
  */
+import { firstString, record, toolInputRecord } from "./payload.js";
 const UTF8_BOM = "\uFEFF";
 const APPLY_PATCH_BEGIN_MARKER = "*** Begin Patch";
 /** Single-file Add/Update only — other *** … File: ops must fail closed (#2738 Greptile). */
@@ -9,8 +10,9 @@ const APPLY_PATCH_MUTATION_LINE_RE = /^\*\*\* (Add File|Update File|Delete File|
 /**
  * Canonical apply_patch spells a rename as `*** Update File:` followed by
  * `*** Move to:`. The destination is a mutation target in its own right, so it
- * must reach root admission; kept separate from the header regex above so the
- * single-mutation #2738 synthesis contract is unchanged (#3794).
+ * must reach root admission. Synthesis refuses when applyPatchMutationPaths
+ * reports more than one unique path, so a Move-to destination is not dropped
+ * from the single-target contract (#3614 / #3794).
  */
 const APPLY_PATCH_MOVE_DESTINATION_RE = /^\*\*\* Move to: (.+)$/gm;
 export function stripUtf8Bom(raw) {
@@ -49,6 +51,10 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
     }
     if (mutations.length !== 1)
         return null;
+    // Count headers plus Move-to destinations so a rename cannot collapse to one
+    // checked path (#3614 / #3794). Reuses applyPatchMutationPaths; no second parser.
+    if (applyPatchMutationPaths(normalized).length !== 1)
+        return null;
     const sole = mutations[0];
     if (sole === undefined || (sole.op !== "Add File" && sole.op !== "Update File"))
         return null;
@@ -63,6 +69,65 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
         context: {},
     };
 }
+function declaredWritePathFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.file_path,
+        toolInput?.filePath,
+        toolInput?.path,
+        input.file_path,
+        input.filePath,
+        input.path,
+    ]);
+}
+function applyPatchBodyTextFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.patch,
+        toolInput?.unified_diff,
+        toolInput?.diff,
+        input.patch,
+        input.unified_diff,
+        input.diff,
+    ]);
+}
+function withToolInputPath(parsed, path) {
+    const input = record(parsed);
+    if (input === null)
+        return parsed;
+    for (const key of ["tool_input", "toolInput", "input", "arguments"]) {
+        const nested = record(input[key]);
+        if (nested !== null) {
+            return { ...input, [key]: { ...nested, path } };
+        }
+    }
+    return { ...input, tool_input: { path } };
+}
+/**
+ * Valid-JSON hosts (Codex) never hit the JSON.parse catch arm, so the free-form
+ * extractor was unreached. Call it on the patch body when no path was declared.
+ * Does not replace the parsed payload; only fills tool_input.path.
+ */
+function attachSynthesizedApplyPatchPath(parsed) {
+    if (declaredWritePathFromParsed(parsed) !== null)
+        return parsed;
+    const patch = applyPatchBodyTextFromParsed(parsed);
+    if (patch === null)
+        return parsed;
+    const synthesized = trySynthesizeFreeFormApplyPatch(patch);
+    if (synthesized === null)
+        return parsed;
+    const synthesizedPath = declaredWritePathFromParsed(synthesized.payload);
+    if (synthesizedPath === null)
+        return parsed;
+    return withToolInputPath(parsed, synthesizedPath);
+}
 /**
  * Parse host hook stdin text into a payload + parse context.
  * Empty → stdinEmpty; invalid JSON without free-form ApplyPatch → parseFailed.
@@ -76,7 +141,8 @@ export function parseHookStdin(raw) {
         return { payload: {}, context: { stdinEmpty: true } };
     }
     try {
-        return { payload: JSON.parse(normalized), context: {} };
+        const parsed = JSON.parse(normalized);
+        return { payload: attachSynthesizedApplyPatchPath(parsed), context: {} };
     }
     catch {
         const synthesized = trySynthesizeFreeFormApplyPatch(normalized);

package/dist/hooks/dest-form.d.ts

@@ -12,13 +12,27 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
  * verified by a literal token search, so wrapping it silently fails the gate.
  */
 export type ProductDestFormKind = "git-checkout" | "git-restore" | "rm" | "rmdir";
+export type GitDestructiveKind = "git-reset-hard" | "git-clean" | "git-checkout-force" | "git-stash-drop";
+export interface GitDestructiveForm {
+    readonly kind: GitDestructiveKind;
+    /** Relocating context paths from `-C` / `--git-dir` / `--work-tree` / `GIT_DIR` / `GIT_WORK_TREE`. */
+    readonly relocators: readonly string[];
+    /**
+     * True when the command is compound or the relocator is opaque (`GIT_CONFIG*`,
+     * `-c core.workTree`). The dispatcher denies these; it cannot prove a fixture.
+     */
+    readonly unprovable: boolean;
+}
 export interface ProductDestForm {
     readonly kind: ProductDestFormKind;
     readonly path: string;
@@ -43,4 +57,9 @@ export declare function payloadWithInjectedWriteTarget(payload: unknown, destPat
  */
 export declare function destFormHasExpansion(path: string): boolean;
 export declare function classifyProductDestForms(command: string): ProductDestForm[];
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export declare function classifyGitDestructive(command: string): GitDestructiveForm[];
 //# sourceMappingURL=dest-form.d.ts.map