@deftai/directive-core 0.108.0 → 0.109.0

package/dist/hooks/dispatcher.js

@@ -16,15 +16,17 @@ import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js"
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
 import { formatRitualRecoveryInstruction, inspectSessionRitual, verifySessionRitual, WRITE_GATED_REQUIRED_STEPS, writeGateRitualOptions, } from "../session/verify-session-ritual.js";
-import { hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, inspectExactLifecycleCommand, missingToolNameMessage, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
-import { classifyProductDestForms, payloadWithInjectedWriteTarget } from "./dest-form.js";
+import { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, missingToolNameMessage, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
+import { classifyGitDestructive, classifyProductDestForms, payloadWithInjectedWriteTarget, } from "./dest-form.js";
+import { appendGitDestructiveRecord, GIT_DESTRUCTIVE_LOG_ENV } from "./git-destructive-log.js";
 import { isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
 import { inspectActiveScope } from "./scope.js";
+import { classifyShellWriteTargets, isInRepoShellWritePath } from "./shell-write-targets.js";
 import { isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool } from "./tools.js";
 // Pure parse/classify helpers are defined in ./classify/ and re-exported from
 // ./index.ts (#2950). Dispatcher is orchestration: classify → policy → decision.
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export const HOOK_HOSTS = ["claude", "grok", "cursor", "codex"];
 export const HOOK_EVENTS = ["session.start", "session.compact", "tool.before"];
 /** Hosts that receive compact/resume hook deposits via init/update (#2113). */
@@ -104,6 +106,66 @@ export function isProposedLifecycleWrite(projectRoot, targetPath) {
         return false;
     return posix.startsWith("xbrief/proposed/") || posix.startsWith("vbrief/proposed/");
 }
+/**
+ * ApplyPatch body present but no mutation header could be classified.
+ * Fail closed rather than authorizing the declared path alone (#3614).
+ */
+function applyPatchBodyUnclassified(payload) {
+    const text = hookApplyPatchBodyText(payload);
+    return text !== null && hookApplyPatchBodyPaths(payload).length === 0;
+}
+/**
+ * Proposed-lifecycle exemption is universally quantified over every mutated
+ * path, not the declared write target alone (#3614).
+ */
+function allMutationTargetsAreProposedLifecycleWrites(projectRoot, payload) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0)
+        return false;
+    return targets.every((target) => isProposedLifecycleWrite(projectRoot, target));
+}
+function authzForMutationTargets(input, toolName, seams, options) {
+    const targets = hookMutationTargetPaths(input.payload);
+    const paths = targets.length > 0 ? targets : [null];
+    const pendingConsume = [];
+    for (const target of paths) {
+        const relPath = target !== null ? toProjectRelativePosix(options.projectRoot, target) : null;
+        const denied = authzForMutation(input, toolName, seams, {
+            isDirectWrite: options.isDirectWrite,
+            relPath,
+            scopePath: options.scopePath,
+            runGit: options.runGit,
+            consumeSingleUse: false,
+            pendingConsume,
+        });
+        if (denied !== null)
+            return denied;
+    }
+    const seen = new Set();
+    for (const ref of pendingConsume) {
+        if (seen.has(ref))
+            continue;
+        seen.add(ref);
+        try {
+            markGrantUsed(options.projectRoot, ref);
+        }
+        catch {
+            // Persistence failure must not flip allow after a successful check.
+        }
+    }
+    return null;
+}
+function allMutationTargetsAreAssistScratch(projectRoot, payload, environ) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0) {
+        return isAssistScratchWrite(projectRoot, hookWriteTargetPath(payload), payload, environ);
+    }
+    return targets.every((target) => isAssistScratchWrite(projectRoot, target, payload, environ));
+}
 /**
  * Canonical + gitignored assist scratch roots for low-ceremony disposable notes (#1802).
  * Path fence only — not free-text "for Obsidian" NLP. Tracked trees (src/, packages/, …)
@@ -373,19 +435,20 @@ function deny(input, code, toolName, message, scopePath = null) {
 }
 /**
  * Resolve the cooperative actor presented to the occupancy gate.
- * Supported payload hosts are payload-authoritative; ambient identity may only
- * corroborate. Grok retains the pre-#3611 environment path until its payload
- * contract is verified.
+ * A resolved host identity is authoritative; ambient identity may only
+ * corroborate. Hosts whose identity source is the hook environment fall back to
+ * the explicit owner flow when that variable is absent (#3873).
  */
 function resolveMutationActor(input, environ) {
-    const hostIdentity = resolveHookHostIdentity(input.host, input.payload);
+    const hostIdentity = resolveHookHostIdentity(input.host, input.payload, environ);
     const environmentId = environ.DEFT_SESSION_ID?.trim() || undefined;
-    if (hostIdentity.status === "unsupported") {
+    if (hostIdentity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, hostIdentity)) {
         return {
             sessionId: environmentId,
             issue: null,
             message: null,
-            payloadAuthoritative: false,
+            hostAuthoritative: false,
         };
     }
     if (hostIdentity.status === "ok" && hostIdentity.sessionId !== null) {
@@ -393,23 +456,23 @@ function resolveMutationActor(input, environ) {
             return {
                 sessionId: hostIdentity.sessionId,
                 issue: "conflict",
-                message: `Host payload owner ${hostIdentity.sessionId} conflicts with ` +
+                message: `Host owner ${hostIdentity.sessionId} conflicts with ` +
                     `DEFT_SESSION_ID ${environmentId}.`,
-                payloadAuthoritative: true,
+                hostAuthoritative: true,
             };
         }
         return {
             sessionId: hostIdentity.sessionId,
             issue: null,
             message: null,
-            payloadAuthoritative: true,
+            hostAuthoritative: true,
         };
     }
     return {
         sessionId: undefined,
         issue: hostIdentity.status === "conflict" ? "conflict" : "unavailable",
         message: hostIdentity.message,
-        payloadAuthoritative: true,
+        hostAuthoritative: true,
     };
 }
 function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath, effectiveRoot) {
@@ -448,20 +511,28 @@ function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath, effec
     // Neither layer active → allow (same as disabled runtimeAuthority historically).
     if (!fence.fenceActive)
         return null;
-    const writeTarget = hookWriteTargetPath(input.payload);
-    const relPath = writeTarget !== null ? toProjectRelativePosix(fenceRoot, writeTarget) : null;
-    const verdict = evaluateRuntimeAuthorityDirectWrite({
-        policy: fence.policy,
-        relPathPosix: relPath,
-    });
-    if (verdict.allowed)
-        return null;
     // #3794: relPath is now measured from the tree the write lands in. When that
     // differs from the payload root, a bare "outside file_scope" reason does not
     // say which tree the fence was relativised against.
     const fenceRootNote = fenceRoot === projectRoot ? "" : ` ${formatHookRootNote(projectRoot, fenceRoot)}`;
-    return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, (verdict.reason ?? "Directive denied this direct write under write fence policy.") +
-        fenceRootNote, scopePath);
+    if (applyPatchBodyUnclassified(input.payload)) {
+        return deny(input, "runtime-policy-deny-path", toolName, "Directive denied this direct write: apply_patch body named no classifiable mutation target, so the write fence cannot authorize it." +
+            fenceRootNote, scopePath);
+    }
+    const targets = hookMutationTargetPaths(input.payload);
+    const toCheck = targets.length > 0 ? targets : [null];
+    for (const target of toCheck) {
+        const relPath = target !== null ? toProjectRelativePosix(fenceRoot, target) : null;
+        const verdict = evaluateRuntimeAuthorityDirectWrite({
+            policy: fence.policy,
+            relPathPosix: relPath,
+        });
+        if (!verdict.allowed) {
+            return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, (verdict.reason ?? "Directive denied this direct write under write fence policy.") +
+                fenceRootNote, scopePath);
+        }
+    }
+    return null;
 }
 function loadAuthzContext(projectRoot, seams) {
     if (seams.loadAuthzState !== undefined) {
@@ -582,12 +653,17 @@ function authzForMutation(input, toolName, seams, options) {
         }
         // Consume single-use grants after allow (persist usedAt).
         if (shouldConsumeSingleUseGrant(decision) && decision.humanApprovalRef !== null) {
-            try {
-                markGrantUsed(projectRoot, decision.humanApprovalRef);
+            if (options.consumeSingleUse === false) {
+                options.pendingConsume?.push(decision.humanApprovalRef);
             }
-            catch {
-                // Persistence failure must not flip allow → deny after a successful check;
-                // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+            else {
+                try {
+                    markGrantUsed(projectRoot, decision.humanApprovalRef);
+                }
+                catch {
+                    // Persistence failure must not flip allow → deny after a successful check;
+                    // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+                }
             }
         }
     }
@@ -727,17 +803,15 @@ function inspectMutationGates(input, toolName, seams, options) {
     // assist/ephemeral classification skip ritual + active-scope (no fake scope:activate).
     // Tracked product paths never match the path fence. Read-only still denied upstream.
     if (!isSpawnTool(toolName)) {
-        const scratchTarget = hookWriteTargetPath(input.payload);
         // #3794 commit 2: classify against effectiveRoot. Relative to payloadRoot every
         // file in a `.deft-scratch/worktrees/<x>/` worktree read as assist scratch, so
         // assist/ephemeral worktree writes skipped ritual, occupancy and scope entirely.
-        if (isAssistScratchWrite(effectiveRoot, scratchTarget, input.payload, environ)) {
-            const relPath = scratchTarget !== null ? toProjectRelativePosix(projectRoot, scratchTarget) : null;
-            const authzDeny = authzForMutation(input, toolName, seams, {
+        if (allMutationTargetsAreAssistScratch(effectiveRoot, input.payload, environ)) {
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
                 runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -769,8 +843,8 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
         : evaluateOccupancyWriteGate(effectiveRoot, {
             sessionId: actor?.sessionId,
-            // Payload-supported hosts must not fall back to a stale ambient owner.
-            env: actor?.payloadAuthoritative === true ? {} : environ,
+            // Hosts with a resolved owner must not fall back to a stale ambient one.
+            env: actor?.hostAuthoritative === true ? {} : environ,
         });
     // #3769: occupancy decides before any ritual persist. The gated verifier
     // executes agent_hooks and rebinds a forward HEAD, and both rewrite
@@ -907,7 +981,7 @@ function inspectMutationGates(input, toolName, seams, options) {
             return null;
         const finalOccupancy = evaluateOccupancyWriteGate(effectiveRoot, {
             sessionId: actor.sessionId,
-            env: actor.payloadAuthoritative ? {} : environ,
+            env: actor.hostAuthoritative ? {} : environ,
             refresh: true,
         });
         occupancyWarning = finalOccupancy.warning;
@@ -941,15 +1015,15 @@ function inspectMutationGates(input, toolName, seams, options) {
     };
     const withOccupancyWarning = (message) => occupancyWarning === null ? message : `${message} ${occupancyWarning}`;
     if (options.proposedLifecycleExempt) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        if (isProposedLifecycleWrite(effectiveRoot, writeTarget)) {
-            const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        if (allMutationTargetsAreProposedLifecycleWrites(effectiveRoot, input.payload)) {
             // UAT still allows xbrief/proposed/** as evidence/defect capture (#2944).
-            const authzDeny = authzForMutation(input, toolName, seams, {
+            // Authz and the write fence run on every mutated path, not the declared
+            // one (#3614).
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
                 runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -993,7 +1067,9 @@ function inspectMutationGates(input, toolName, seams, options) {
         // worktree that lives outside the payload root keeps today's skip. Worktrees
         // under the payload root -- `.deft-scratch/worktrees/`, the swarm layout --
         // are inside it and are now gated on their own active scope.
-        const outsideRoot = writeTarget !== null && isOutsideProjectRootWrite(projectRoot, writeTarget);
+        const mutationTargets = hookMutationTargetPaths(input.payload);
+        const outsideRoot = mutationTargets.length > 0 &&
+            mutationTargets.every((target) => isOutsideProjectRootWrite(projectRoot, target));
         if (!outsideRoot || isSpawnTool(toolName)) {
             let proposedPathHint;
             if (isSpawnTool(toolName)) {
@@ -1054,14 +1130,12 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
     }
     if (!isSpawnTool(toolName)) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
         // Wave 1 authz (UAT lease + human-origin grant) before runtimeAuthority (#2944 / #2948 L1–L2).
-        const authzDeny = authzForMutation(input, toolName, seams, {
+        const authzDeny = authzForMutationTargets(input, toolName, seams, {
             isDirectWrite: true,
-            relPath,
             scopePath: scope.path,
             runGit: dispatchGit,
+            projectRoot,
         });
         if (authzDeny !== null)
             return authzDeny;
@@ -1083,6 +1157,100 @@ function inspectMutationGates(input, toolName, seams, options) {
         scopePath: scope.path,
     };
 }
+function gitDestructiveIsFixture(form, projectRoot) {
+    if (form.unprovable || form.relocators.length === 0)
+        return false;
+    return form.relocators.every((raw) => {
+        const path = raw.trim();
+        if (path.length === 0 || !isAbsolute(path))
+            return false;
+        return isOutsideProjectRootWrite(projectRoot, path);
+    });
+}
+const GIT_DESTRUCTIVE_REMEDIATION = "Tree-wide destructive git (reset --hard, clean -f, checkout -f / switch -f, " +
+    "stash drop/clear) is fail-closed when aimed at this checkout. Rewrite as a " +
+    "non-destructive command, or run it against an absolute out-of-root fixture " +
+    "(`git -C /abs/fixture reset --hard`). This is a guard, not a root-cause claim.";
+/**
+ * Always-on recognition for tree-wide destructive git (#3917). Independent of
+ * `shellDestForms`. Records a durable JSONL line outside the repository so the
+ * next occurrence names its actor even if reflogs are gone.
+ */
+function decideGitDestructive(input, toolName) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const forms = classifyGitDestructive(command);
+    if (forms.length === 0)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    const env = input.environ ?? process.env;
+    const actor = env.DEFT_SESSION_ID?.trim() || env.GROK_SESSION_ID?.trim() || "";
+    const logPath = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim() || undefined;
+    let anyProjectAimed = false;
+    for (const form of forms) {
+        const fixture = gitDestructiveIsFixture(form, projectRoot);
+        if (!fixture)
+            anyProjectAimed = true;
+        appendGitDestructiveRecord({
+            ts: new Date().toISOString(),
+            kind: form.kind,
+            disposition: fixture ? "allow-fixture" : "deny",
+            command,
+            projectRoot,
+            host: input.host,
+            toolName,
+            actor,
+            pid: process.pid,
+            relocators: form.relocators,
+            unprovable: form.unprovable,
+        }, { env, logPath });
+    }
+    if (!anyProjectAimed) {
+        return {
+            verdict: "allow",
+            code: "git-destructive-fixture",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `Directive allowed ${toolName}: destructive git is aimed at an out-of-root fixture.`,
+            scopePath: null,
+        };
+    }
+    return deny(input, "git-destructive-deny", toolName, `Directive denied ${toolName}: ${GIT_DESTRUCTIVE_REMEDIATION}`);
+}
+/**
+ * Authorize recognized in-repo Shell file-write dests through inspectMutationGates (#3983 / #3987).
+ * Deny is returned; allow falls through so dest-forms and push/merge still run.
+ */
+function decideShellWriteReissue(input, toolName, seams) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    for (const dest of classifyShellWriteTargets(command)) {
+        if (dest.unprovable === true) {
+            if (!isInRepoShellWritePath(projectRoot, dest.path))
+                continue;
+            return deny(input, "scope-not-ready", toolName, "Directive denied " +
+                toolName +
+                ": Shell write dest is not reconstructable (compound command). Use one simple command or Edit/Write.");
+        }
+        if (!isInRepoShellWritePath(projectRoot, dest.path))
+            continue;
+        const destInput = {
+            ...input,
+            payload: payloadWithInjectedWriteTarget(input.payload, dest.path),
+        };
+        const destDecision = inspectMutationGates(destInput, toolName, seams, {
+            proposedLifecycleExempt: true,
+        });
+        if (destDecision.verdict === "deny")
+            return destDecision;
+    }
+    return null;
+}
 /**
  * Route recognized Shell dest-forms through inspectMutationGates, then push/merge.
  * Dest-form allow is kept when runtime authority has nothing classifiable.
@@ -1205,6 +1373,18 @@ function lifecycleExecutionRootCheck(payload, projectRoot, realpath, platform) {
     }
     return { aligned: true, message: "execution directory is project-root aligned" };
 }
+/**
+ * Hosts whose PreToolUse wire format can carry a rewritten tool input.
+ *
+ * `renderHostDecision` reads the same list, so the bridge cannot offer -- or
+ * deny on behalf of -- a delivery channel a host does not have (#3873). A host
+ * outside it binds its claim in the CLI instead: `resolveOccupancySessionId`
+ * resolves the same ambient host owner the write gate will present.
+ */
+const UPDATED_INPUT_WIRE_HOSTS = ["codex", "claude", "cursor"];
+function hostAcceptsUpdatedInput(host) {
+    return UPDATED_INPUT_WIRE_HOSTS.includes(host);
+}
 /**
  * Add the claim-time owner only after the existing shell decision allowed the
  * command. The host wire format must emit `allow` with updated input, so this
@@ -1213,6 +1393,8 @@ function lifecycleExecutionRootCheck(payload, projectRoot, realpath, platform) {
 function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
     if (decision.verdict !== "allow")
         return decision;
+    if (!hostAcceptsUpdatedInput(input.host))
+        return decision;
     const lifecycle = inspectExactLifecycleCommand(input.payload);
     if (lifecycle === null)
         return decision;
@@ -1222,15 +1404,20 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
         return deny(input, "occupancy-identity-conflict", toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
             "--session-id is empty, duplicated, or otherwise ambiguous.");
     }
-    const identity = resolveHookHostIdentity(input.host, input.payload);
-    if (identity.status === "unsupported")
+    const identity = resolveHookHostIdentity(input.host, input.payload, input.environ ?? process.env);
+    // #3873: an absent host-env variable is the pre-#3873 explicit-owner flow, not
+    // a broken contract. Claim binding is skipped, the command keeps ordinary host
+    // permission handling, and any owner it carries is still its own.
+    if (identity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, identity)) {
         return decision;
+    }
     if (identity.status !== "ok" || identity.sessionId === null) {
         const code = identity.status === "conflict"
             ? "occupancy-identity-conflict"
             : "occupancy-identity-unavailable";
         return deny(input, code, toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
-            `${identity.message ?? "host payload identity is unavailable"}. ` +
+            `${identity.message ?? "host session identity is unavailable"}. ` +
             "Directive cannot bind the occupancy claim without a stable host owner; " +
             "manual callers must pass --session-id explicitly outside the host rewrite path.");
     }
@@ -1238,12 +1425,12 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
     if (environmentId !== undefined &&
         environmentId.length > 0 &&
         environmentId !== identity.sessionId) {
-        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: host payload owner ${identity.sessionId} conflicts with ` +
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: host owner ${identity.sessionId} conflicts with ` +
             `DEFT_SESSION_ID ${environmentId}; refusing an auto-approved lifecycle rewrite.`);
     }
     if (lifecycle.sessionIdStatus === "present" && lifecycle.sessionId !== identity.sessionId) {
         return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: lifecycle command ${lifecycle.verb} names ` +
-            `${lifecycle.sessionId ?? "<missing>"}, but the host payload owner is ` +
+            `${lifecycle.sessionId ?? "<missing>"}, but the host owner is ` +
             `${identity.sessionId}.`);
     }
     const sourceTask = !lifecycle.task ||
@@ -1472,10 +1659,19 @@ export function decideHook(input, seams = {}) {
         }
         return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: false });
     }
-    // Shell dest-forms (#3438): recognized product mutations share inspectMutationGates
+    // Tree-wide destructive git (#3917): always-on, independent of shellDestForms.
+    // Dest-forms (#3438): recognized product mutations share inspectMutationGates
     // with Edit/Write (assist/scratch, proposed lifecycle, file_scope). Push/merge stay
     // on runtimeAuthority (#2711). Non-dest unclassifiable shell (git status) fail-open.
     if (isShellTool(toolName)) {
+        const destructive = decideGitDestructive(input, toolName);
+        if (destructive !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, destructive, seams);
+        }
+        const writeReissue = decideShellWriteReissue(input, toolName, seams);
+        if (writeReissue !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, writeReissue, seams);
+        }
         const decision = decideShellDestFormsThenRuntimeAuthority(input, toolName, seams);
         return attachLifecycleIdentityRewrite(input, toolName, decision, seams);
     }
@@ -1532,7 +1728,9 @@ function softAgentsRebindWireText(decision) {
  */
 export function renderHostDecision(host, decision) {
     if (decision.verdict === "allow") {
-        if (decision.event === "tool.before" && decision.updatedInput !== undefined) {
+        if (decision.event === "tool.before" &&
+            decision.updatedInput !== undefined &&
+            hostAcceptsUpdatedInput(host)) {
             if (host === "cursor") {
                 return JSON.stringify({
                     permission: "allow",
@@ -1540,15 +1738,13 @@ export function renderHostDecision(host, decision) {
                     updated_input: decision.updatedInput,
                 });
             }
-            if (host === "claude" || host === "codex") {
-                return JSON.stringify({
-                    hookSpecificOutput: {
-                        hookEventName: "PreToolUse",
-                        permissionDecision: "allow",
-                        updatedInput: decision.updatedInput,
-                    },
-                });
-            }
+            return JSON.stringify({
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "allow",
+                    updatedInput: decision.updatedInput,
+                },
+            });
         }
         const soft = softAgentsRebindWireText(decision);
         if (host === "cursor") {

package/dist/hooks/fixtures/cases.d.ts

@@ -19,6 +19,12 @@ export interface HookFixtureCase {
     readonly payload?: unknown;
     /** Raw stdin when testing BOM / free-form ApplyPatch parse. */
     readonly raw?: string;
+    /**
+     * Hook process environment for `host-env` identity providers (#3873).
+     * Identity assertions resolve against this instead of the ambient
+     * environment, so a corpus case cannot pass or fail by where it runs.
+     */
+    readonly environ?: Readonly<Record<string, string>>;
     readonly expected: {
         readonly toolName: string | null;
         readonly writeIntent: HookWriteIntent;

package/dist/hooks/fixtures/cases.js

@@ -702,6 +702,59 @@ export const HOOK_FIXTURE_CASES = [
             hostIdentity: { status: "invalid", sessionId: null },
         },
     },
+    // --- Host-env session identity (#3873) ---
+    {
+        // The claim side of the loop: without this rewrite the lease is claimed
+        // under a minted UUID that the later write gate can never present.
+        id: "grok-posix-shell-host-env-lifecycle-rewrite",
+        host: "grok",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3873", "#3611"],
+        payload: {
+            tool_name: "Bash",
+            tool_input: { command: "deft session:start" },
+        },
+        environ: { GROK_SESSION_ID: "grok-session-a" },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                resultKind: "rewrite",
+                rewrittenCommand: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                updatedInput: {
+                    command: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                },
+            },
+        },
+    },
+    {
+        id: "grok-posix-write-payload-session-id-untrusted",
+        host: "grok",
+        os: "posix",
+        tool: "Write",
+        regression: ["#3873"],
+        payload: {
+            tool_name: "Write",
+            session_id: "payload-owner",
+            tool_input: { content: "x", file_path: "src/app.ts" },
+        },
+        environ: {},
+        expected: {
+            toolName: "Write",
+            writeIntent: "direct-write",
+            writeTargetPath: "src/app.ts",
+            hostIdentity: { status: "missing", sessionId: null },
+        },
+        notes: "Grok's payload session_id contract is unverified; only the host variable is read",
+    },
     // --- Regression: empty / missing tool name ---
     {
         id: "cursor-posix-stdin-empty",

package/dist/hooks/git-destructive-log.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import type { GitDestructiveKind } from "./dest-form.js";
+export declare const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export type GitDestructiveDisposition = "deny" | "allow-fixture";
+export interface GitDestructiveRecord {
+    readonly ts: string;
+    readonly kind: GitDestructiveKind;
+    readonly disposition: GitDestructiveDisposition;
+    readonly command: string;
+    readonly projectRoot: string;
+    readonly host: string;
+    readonly toolName: string | null;
+    readonly actor: string;
+    readonly pid: number;
+    readonly relocators: readonly string[];
+    readonly unprovable: boolean;
+}
+export declare function resolveGitDestructiveLogPath(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDir?: string): string;
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export declare function appendGitDestructiveRecord(record: GitDestructiveRecord, options?: {
+    readonly logPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly append?: (path: string, line: string) => void;
+}): void;
+//# sourceMappingURL=git-destructive-log.d.ts.map

package/dist/hooks/git-destructive-log.js

@@ -0,0 +1,46 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { platformUserConfigDir } from "../user-config/resolve-user-md.js";
+export const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export function resolveGitDestructiveLogPath(env = process.env, platform = process.platform, homeDir = homedir()) {
+    const override = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim();
+    if (override !== undefined && override.length > 0) {
+        return resolve(override);
+    }
+    return join(platformUserConfigDir(platform, env, homeDir), "logs", "git-destructive.jsonl");
+}
+function defaultAppend(path, line) {
+    const targetAbs = resolve(path);
+    const parent = dirname(targetAbs);
+    mkdirSync(parent, { recursive: true });
+    containedWrite({
+        root: parent,
+        target: targetAbs,
+        data: line,
+        mode: "append",
+        mkdir: false,
+        mutation: false,
+    });
+}
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export function appendGitDestructiveRecord(record, options = {}) {
+    try {
+        const path = options.logPath ?? resolveGitDestructiveLogPath(options.env ?? process.env);
+        const line = `${JSON.stringify(record)}\n`;
+        (options.append ?? defaultAppend)(path, line);
+    }
+    catch {
+        // Attribution is best-effort; the fail-closed deny still stands.
+    }
+}
+//# sourceMappingURL=git-destructive-log.js.map