@deftai/directive-core 0.108.0 → 0.109.0

package/dist/hooks/dest-form.js

@@ -12,7 +12,10 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
@@ -113,13 +116,14 @@ export function classifyProductDestForms(command) {
     // bypass.
     //
     // ⊗ Recognition is NOT total either, and this is not a security boundary.
-    // Only four verbs are recognized, and a non-literal verb (`\rm`, `rm${IFS}x`)
-    // defeats the tokenizer, so the fail-closed branch below only fires when the
-    // verb is still legible. Unrecognized mutators (`git reset --hard`,
-    // `git clean`, `git checkout` without `--`, `mv`, `sed -i`, `>` redirection)
-    // and interpreters (`bash -c`, `python -c`) are fail-OPEN. See the threat
-    // model in content/contracts/path-write-fence.md: this is a guardrail for
-    // careless agents, not a boundary against adversarial ones.
+    // Only four dest-form verbs are recognized, and a non-literal verb (`\rm`,
+    // `rm${IFS}x`) defeats the tokenizer, so the fail-closed branch below only
+    // fires when the verb is still legible. Tree-wide destructive git is handled
+    // by classifyGitDestructive (always-on). Remaining fail-OPEN mutators:
+    // `git checkout` without `--` or `-f`, `mv`, `sed -i`, `>` redirection, and
+    // interpreters (`bash -c`, `python -c`). See the threat model in
+    // content/contracts/path-write-fence.md: this is a guardrail for careless
+    // agents, not a boundary against adversarial ones.
     if (segments.length === 1 && !hasUnsupportedSyntax(cmd)) {
         return classifySimpleDestForms(segments[0] ?? "");
     }
@@ -136,6 +140,29 @@ export function classifyProductDestForms(command) {
         expansion: true,
     }));
 }
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export function classifyGitDestructive(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitCommandSegments(cmd);
+    const compound = segments.length > 1 || hasUnsupportedSyntax(cmd);
+    const found = [];
+    const seen = new Set();
+    for (const seg of segments) {
+        const form = classifyGitDestructiveSegment(seg);
+        if (form === null)
+            continue;
+        if (seen.has(form.kind))
+            continue;
+        seen.add(form.kind);
+        found.push(compound ? { ...form, unprovable: true } : form);
+    }
+    return found;
+}
 /** Classify one command with no operators, no grouping, and no substitution. */
 function classifySimpleDestForms(segment) {
     const found = [];
@@ -334,9 +361,33 @@ function isGitWorkTreeAssign(token) {
     // A config FILE override can set core.worktree out of sight.
     return key === "GIT_CONFIG" || key === "GIT_CONFIG_GLOBAL" || key === "GIT_CONFIG_SYSTEM";
 }
+function gitDirOrWorkTreeValue(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return null;
+    const key = token.slice(0, eq);
+    const value = token.slice(eq + 1);
+    if ((key === "GIT_WORK_TREE" || key === "GIT_DIR") && value.length > 0)
+        return value;
+    return null;
+}
 function skipPrefix(tokens) {
     let i = 0;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
+    const noteAssign = (tok) => {
+        const reloc = gitDirOrWorkTreeValue(tok);
+        if (reloc !== null) {
+            gitContext = true;
+            relocators.push(reloc);
+            return;
+        }
+        if (isGitWorkTreeAssign(tok)) {
+            gitContext = true;
+            opaqueContext = true;
+        }
+    };
     const consumeAssigns = () => {
         while (i < tokens.length) {
             const tok = tokens[i];
@@ -351,8 +402,7 @@ function skipPrefix(tokens) {
             }
             if (!isEnvAssign(tok))
                 break;
-            if (isGitWorkTreeAssign(tok))
-                gitContext = true;
+            noteAssign(tok);
             i++;
         }
     };
@@ -380,15 +430,14 @@ function skipPrefix(tokens) {
                 continue;
             }
             if (isEnvAssign(tok)) {
-                if (isGitWorkTreeAssign(tok))
-                    gitContext = true;
+                noteAssign(tok);
                 i++;
                 continue;
             }
             break;
         }
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 /**
  * Skip git's global options, reporting whether any of them RELOCATES the work
@@ -400,31 +449,51 @@ function skipPrefix(tokens) {
 function skipGitGlobals(tokens, start) {
     let i = start;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
     while (i < tokens.length) {
         const t = tokens[i];
         if (t === undefined || !t.startsWith("-"))
-            return { i, gitContext };
+            return { i, gitContext, relocators, opaqueContext };
         if (t === "-c" || t === "--config-env") {
-            if (isCoreWorkTreeConfig(tokens[i + 1]))
+            if (isCoreWorkTreeConfig(tokens[i + 1])) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i += 2;
             continue;
         }
         if (t.startsWith("--config-env=")) {
-            if (isCoreWorkTreeConfig(t.slice("--config-env=".length)))
+            if (isCoreWorkTreeConfig(t.slice("--config-env=".length))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         if (t === "-C" || t === "--work-tree" || t === "--git-dir") {
             gitContext = true;
+            const val = tokens[i + 1];
+            if (val !== undefined)
+                relocators.push(val);
             i += 2;
             continue;
         }
-        if (t.startsWith("--work-tree=") ||
-            t.startsWith("--git-dir=") ||
-            (t.startsWith("-C") && t.length > 2)) {
+        if (t.startsWith("--work-tree=")) {
+            gitContext = true;
+            relocators.push(t.slice("--work-tree=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("--git-dir=")) {
             gitContext = true;
+            relocators.push(t.slice("--git-dir=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("-C") && t.length > 2) {
+            gitContext = true;
+            relocators.push(t.slice(2));
             i++;
             continue;
         }
@@ -437,14 +506,16 @@ function skipGitGlobals(tokens, start) {
             continue;
         }
         if (t.startsWith("-c")) {
-            if (isCoreWorkTreeConfig(t.slice(2)))
+            if (isCoreWorkTreeConfig(t.slice(2))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         i++;
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 function pathsAfterDashDash(tokens, start) {
     const dash = tokens.indexOf("--", start);
@@ -469,6 +540,72 @@ function dests(kind, paths, unsafe = false) {
         .filter((path) => path.length > 0)
         .map((path) => (unsafe ? { kind, path, expansion: true } : { kind, path }));
 }
+function tokensHaveFlag(tokens, start, names) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined)
+            break;
+        if (names.has(t))
+            return true;
+        for (const name of names) {
+            if (name.startsWith("--") && t.startsWith(`${name}=`))
+                return true;
+        }
+    }
+    return false;
+}
+function tokensHaveShortForce(tokens, start) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined || t === "--")
+            break;
+        if (t === "-f" || t === "-B")
+            return true;
+        if (t.startsWith("-") && !t.startsWith("--") && t.includes("f"))
+            return true;
+    }
+    return false;
+}
+function classifyGitDestructiveSegment(segment) {
+    const tokens = tokenizeSegment(segment.trim());
+    const prefixSkip = skipPrefix(tokens);
+    let i = prefixSkip.i;
+    const binRaw = tokens[i];
+    if (binRaw === undefined)
+        return null;
+    const bin = binRaw.replace(/^[({!]+/, "").toLowerCase();
+    if (bin !== "git" && bin !== "git.exe")
+        return null;
+    const skipped = skipGitGlobals(tokens, i + 1);
+    i = skipped.i;
+    const sub = tokens[i]?.toLowerCase();
+    if (sub === undefined)
+        return null;
+    let kind = null;
+    if (sub === "reset" && tokensHaveFlag(tokens, i + 1, new Set(["--hard"]))) {
+        kind = "git-reset-hard";
+    }
+    else if (sub === "clean" &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-clean";
+    }
+    else if ((sub === "checkout" || sub === "switch") &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f", "-B"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-checkout-force";
+    }
+    else if (sub === "stash") {
+        const action = tokens[i + 1]?.toLowerCase();
+        if (action === "drop" || action === "clear")
+            kind = "git-stash-drop";
+    }
+    if (kind === null)
+        return null;
+    const relocators = [...prefixSkip.relocators, ...skipped.relocators];
+    const opaque = prefixSkip.opaqueContext || skipped.opaqueContext;
+    return { kind, relocators, unprovable: opaque };
+}
 /**
  * `-c core.workTree=...` / `--config-env` relocates the work tree through git
  * config. Resolution depends on the git dir, which this classifier does not

package/dist/hooks/dispatcher.d.ts

@@ -7,7 +7,7 @@ import { type DetectWorkSelection, type RitualRunner, type VerifyResult } from "
 import { type HookPayloadContext } from "./classify/index.js";
 import { type ActiveScopeInspection } from "./scope.js";
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export declare const HOOK_HOSTS: readonly ["claude", "grok", "cursor", "codex"];
 export type HookHost = (typeof HOOK_HOSTS)[number];
 export declare const HOOK_EVENTS: readonly ["session.start", "session.compact", "tool.before"];
@@ -44,7 +44,11 @@ export type HookDecisionCode = "session-start" | "session-start-disabled" | "ses
 /** UAT lease / human-origin grant denial (#2944). */
  | "authz-uat-deny" | "authz-grant-missing" | "authz-grant-origin-reject" | "authz-grant-scope-deny" | "authz-grant-expired" | "authz-grant-revoked" | "authz-grant-single-use-spent"
 /** Slash-command intent ceiling denial (#1193). */
- | "intent-ceiling-deny";
+ | "intent-ceiling-deny"
+/** Tree-wide destructive git aimed at this checkout (#3917). */
+ | "git-destructive-deny"
+/** Tree-wide destructive git aimed at an absolute out-of-root fixture (#3917). */
+ | "git-destructive-fixture";
 export interface HookDecision {
     readonly verdict: HookVerdict;
     readonly code: HookDecisionCode;