@deftai/directive-core 0.108.0 → 0.109.0

package/dist/hooks/index.d.ts

@@ -3,5 +3,7 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/hooks/index.js

@@ -3,5 +3,7 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.js.map

package/dist/hooks/shell-write-targets.d.ts

@@ -0,0 +1,10 @@
+export declare const SHELL_WRITE_KINDS: readonly ["set-content", "out-file", "add-content", "python-pathlib", "io-writealltext"];
+export type ShellWriteKind = (typeof SHELL_WRITE_KINDS)[number];
+export interface ShellWriteTarget {
+    readonly kind: ShellWriteKind;
+    readonly path: string;
+    readonly unprovable?: boolean;
+}
+export declare function classifyShellWriteTargets(command: string): ShellWriteTarget[];
+export declare function isInRepoShellWritePath(projectRoot: string, dest: string): boolean;
+//# sourceMappingURL=shell-write-targets.d.ts.map

package/dist/hooks/shell-write-targets.js

@@ -0,0 +1,274 @@
+/** Recognized in-repo Shell file-write dests (#3983 / #3987). */
+import { isAbsolute, relative, resolve } from "node:path";
+export const SHELL_WRITE_KINDS = [
+    "set-content",
+    "out-file",
+    "add-content",
+    "python-pathlib",
+    "io-writealltext",
+];
+const DQ = String.fromCharCode(34);
+const AQ = String.fromCharCode(39);
+function stripQuotes(token) {
+    const t = token.trim();
+    if (t.length < 2)
+        return t;
+    const a = t[0];
+    const b = t[t.length - 1];
+    if ((a === DQ && b === DQ) || (a === AQ && b === AQ))
+        return t.slice(1, -1);
+    return t;
+}
+function pushUnique(out, kind, raw) {
+    const path = stripQuotes(raw).trim();
+    if (path.length === 0)
+        return;
+    if (out.some((d) => d.kind === kind && d.path === path))
+        return;
+    out.push({ kind, path });
+}
+function extractQuoted(command, start) {
+    if (start >= command.length)
+        return { value: "", next: start };
+    const q = command[start];
+    if (q !== DQ && q !== AQ) {
+        let i = start;
+        while (i < command.length) {
+            const c = command[i];
+            if (c === undefined)
+                break;
+            if (c === " " || c === "	" || c === "," || c === ")")
+                break;
+            i += 1;
+        }
+        return { value: command.slice(start, i), next: i };
+    }
+    let i = start + 1;
+    while (i < command.length && command[i] !== q)
+        i += 1;
+    return { value: command.slice(start + 1, i), next: i + 1 };
+}
+function skipWs(command, start) {
+    let i = start;
+    while (i < command.length) {
+        const code = command.charCodeAt(i);
+        if (code !== 32 && code !== 9 && code !== 10 && code !== 13)
+            break;
+        i += 1;
+    }
+    return i;
+}
+function startsWithVerb(segment, verb) {
+    const i = skipWs(segment, 0);
+    if (segment.slice(i, i + verb.length).toLowerCase() !== verb.toLowerCase())
+        return false;
+    const next = segment[i + verb.length];
+    return next === undefined || next === " " || next === "	" || next === "-";
+}
+function splitWriteSegments(command) {
+    const segs = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        if (c === DQ || c === AQ) {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        const code = command.charCodeAt(i);
+        const next = command.charCodeAt(i + 1);
+        if ((code === 38 && next === 38) || (code === 124 && next === 124)) {
+            segs.push(cur);
+            cur = "";
+            i += 1;
+            continue;
+        }
+        if (code === 124 || code === 38 || code === 59 || code === 10 || code === 13) {
+            segs.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segs.push(cur);
+    return segs.map((seg) => seg.trim()).filter((seg) => seg.length > 0);
+}
+const PATH_PARAM_NAMES = ["path", "literalpath", "filepath"];
+function uniqueNamedParam(flag, names) {
+    const f = flag.replace(/^-+/, "").toLowerCase();
+    if (f.length === 0)
+        return null;
+    const hits = names.filter((n) => n.startsWith(f));
+    return hits.length === 1 ? (hits[0] ?? null) : null;
+}
+function parseFlag(token) {
+    if (!token.startsWith("-"))
+        return null;
+    const colon = token.indexOf(":");
+    if (colon <= 0)
+        return { flag: token, attached: null };
+    return { flag: token.slice(0, colon), attached: token.slice(colon + 1) };
+}
+function extractAfterVerb(command, verb, kind, out) {
+    if (!startsWithVerb(command, verb))
+        return;
+    const i = skipWs(command, 0);
+    let j = skipWs(command, i + verb.length);
+    let named = null;
+    let positional = null;
+    while (j < command.length) {
+        const extracted = extractQuoted(command, j);
+        if (extracted.value.length === 0)
+            break;
+        j = skipWs(command, extracted.next);
+        const parsed = parseFlag(extracted.value);
+        if (parsed === null) {
+            if (positional === null)
+                positional = extracted.value;
+            continue;
+        }
+        let arg = parsed.attached;
+        if (arg === null || arg.length === 0) {
+            const next = extractQuoted(command, j);
+            if (next.value.length > 0 && !next.value.startsWith("-")) {
+                arg = next.value;
+                j = skipWs(command, next.next);
+            }
+            else {
+                arg = null;
+            }
+        }
+        if (uniqueNamedParam(parsed.flag, PATH_PARAM_NAMES) !== null) {
+            if (arg !== null && arg.length > 0 && !arg.startsWith("-"))
+                named = arg;
+        }
+    }
+    const dest = named ?? positional;
+    if (dest !== null && !dest.startsWith("-"))
+        pushUnique(out, kind, dest);
+}
+function pathlibWriteFollows(command, afterPathArgs) {
+    let i = skipWs(command, afterPathArgs);
+    if (command[i] === ")")
+        i = skipWs(command, i + 1);
+    while (i < command.length) {
+        if (command[i] === ";")
+            return false;
+        i = skipWs(command, i);
+        if (command[i] !== ".")
+            return false;
+        i += 1;
+        const start = i;
+        while (i < command.length) {
+            const c = command.charCodeAt(i);
+            if ((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95) {
+                i += 1;
+                continue;
+            }
+            break;
+        }
+        const name = command.slice(start, i);
+        i = skipWs(command, i);
+        if (command[i] !== "(")
+            return false;
+        if (name === "write_text")
+            return true;
+        if (name === "write_bytes")
+            return true;
+        i += 1;
+        let depth = 1;
+        while (i < command.length && depth > 0) {
+            const ch = command[i];
+            if (ch === "(")
+                depth += 1;
+            else if (ch === ")")
+                depth -= 1;
+            i += 1;
+        }
+    }
+    return false;
+}
+function extractPythonPathlib(command, out) {
+    const i = skipWs(command, 0);
+    const head = command.slice(i, i + 10).toLowerCase();
+    if (!head.startsWith("python") && !head.startsWith("py ") && !head.startsWith("py.exe"))
+        return;
+    const needle = "Path(";
+    let from = i;
+    while (from < command.length) {
+        const at = command.indexOf(needle, from);
+        if (at < 0)
+            return;
+        let j = skipWs(command, at + needle.length);
+        const ch = command[j];
+        if (ch === "r" || ch === "R")
+            j = skipWs(command, j + 1);
+        const extracted = extractQuoted(command, j);
+        if (pathlibWriteFollows(command, extracted.next)) {
+            pushUnique(out, "python-pathlib", extracted.value);
+        }
+        from = at + needle.length;
+    }
+}
+function extractIoWrite(command, out) {
+    const i = skipWs(command, 0);
+    if (command[i] !== "[")
+        return;
+    const needles = ["WriteAllText(", "WriteAllBytes("];
+    for (const needle of needles) {
+        const at = command.indexOf(needle, i);
+        if (at < 0)
+            continue;
+        const j = skipWs(command, at + needle.length);
+        const extracted = extractQuoted(command, j);
+        pushUnique(out, "io-writealltext", extracted.value);
+    }
+}
+function classifySimpleWrite(command) {
+    const out = [];
+    extractAfterVerb(command, "Set-Content", "set-content", out);
+    extractAfterVerb(command, "Add-Content", "add-content", out);
+    extractAfterVerb(command, "Out-File", "out-file", out);
+    extractPythonPathlib(command, out);
+    extractIoWrite(command, out);
+    return out;
+}
+export function classifyShellWriteTargets(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitWriteSegments(cmd);
+    if (segments.length === 1)
+        return classifySimpleWrite(segments[0] ?? cmd);
+    const found = [];
+    for (const seg of segments)
+        found.push(...classifySimpleWrite(seg));
+    if (found.length === 0)
+        return [];
+    return found.map((d) => ({ ...d, unprovable: true }));
+}
+export function isInRepoShellWritePath(projectRoot, dest) {
+    const path = dest.trim();
+    if (path.length === 0)
+        return false;
+    if (path.includes("*") || path.includes("?") || path.includes("$"))
+        return false;
+    const root = resolve(projectRoot);
+    const abs = isAbsolute(path) ? resolve(path) : resolve(root, path);
+    const rel = relative(root, abs);
+    if (rel.length === 0)
+        return false;
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    return true;
+}
+//# sourceMappingURL=shell-write-targets.js.map

package/dist/hooks/tools.d.ts

@@ -1,12 +1,12 @@
 /** Host spellings that install-time matchers and runtime classification share. */
-export declare const DIRECT_WRITE_TOOL_NAMES: readonly ["Edit", "Write", "WriteFile", "CreateFile", "MultiEdit", "NotebookEdit", "StrReplace", "SearchReplace", "Delete", "DeleteFile", "ApplyPatch", "apply_patch"];
+export declare const DIRECT_WRITE_TOOL_NAMES: readonly ["Edit", "Write", "WriteFile", "CreateFile", "MultiEdit", "NotebookEdit", "StrReplace", "SearchReplace", "Delete", "DeleteFile", "ApplyPatch", "apply_patch", "write", "search_replace"];
 /** PreToolUse spawn / sub-agent dispatch tools (#1185 / #2437). */
 export declare const SPAWN_TOOL_NAMES: readonly ["Task", "SubagentStart", "spawn_subagent", "start_agent", "CreateAgent"];
 /**
  * Host spellings for Shell/Bash execution tools (#2711).
  * Used for runtimeAuthority scopes.push / scopes.merge classification.
  */
-export declare const SHELL_TOOL_NAMES: readonly ["Shell", "Bash", "BashTool", "shell", "bash"];
+export declare const SHELL_TOOL_NAMES: readonly ["Shell", "Bash", "BashTool", "shell", "bash", "run_terminal_command"];
 /** Env override forcing hook-level read-only write denial (#1185). */
 export declare const READ_ONLY_HOOK_ENV = "DEFT_HOOK_READ_ONLY";
 export declare function isDirectWriteTool(toolName: string): boolean;
@@ -32,6 +32,24 @@ export declare const MCP_PUSH_MERGE_BARE_NAMES: readonly ["merge_pull_request",
 export declare const DIRECT_WRITE_HOOK_MATCHER: string;
 export declare const SPAWN_HOOK_MATCHER: string;
 export declare const SHELL_HOOK_MATCHER: string;
+/** Known mutation tool names per host. Deposited matchers must cover each name (#3987). */
+export declare const GROK_MUTATION_TOOL_CATALOG: {
+    readonly directWrite: readonly ["write", "search_replace"];
+    readonly shell: readonly ["run_terminal_command"];
+    readonly spawn: readonly ["spawn_subagent"];
+};
+/** Tools on this host that are intentionally not mutation-gated. */
+export declare const GROK_NON_MUTATION_TOOLS: {
+    readonly read_file: "read";
+    readonly grep: "read";
+    readonly list_dir: "read";
+    readonly todo_write: "session-local non-product scratch";
+    readonly get_command_or_subagent_output: "poll, not a mutation; elapsed bound is evaluateInFlight";
+    readonly kill_command_or_subagent: "process control";
+    readonly search_tool: "read";
+    readonly web_search: "read";
+};
+export declare function matcherHasLiteralToken(matcher: string, toolName: string): boolean;
 /**
  * PreToolUse matcher for MCP-class push/merge tools (#2711).
  * Regex-friendly for Claude/nested hosts. Prefer broad install match +

package/dist/hooks/tools.js

@@ -12,6 +12,8 @@ export const DIRECT_WRITE_TOOL_NAMES = [
     "DeleteFile",
     "ApplyPatch",
     "apply_patch",
+    "write",
+    "search_replace",
 ];
 /** PreToolUse spawn / sub-agent dispatch tools (#1185 / #2437). */
 export const SPAWN_TOOL_NAMES = [
@@ -25,7 +27,14 @@ export const SPAWN_TOOL_NAMES = [
  * Host spellings for Shell/Bash execution tools (#2711).
  * Used for runtimeAuthority scopes.push / scopes.merge classification.
  */
-export const SHELL_TOOL_NAMES = ["Shell", "Bash", "BashTool", "shell", "bash"];
+export const SHELL_TOOL_NAMES = [
+    "Shell",
+    "Bash",
+    "BashTool",
+    "shell",
+    "bash",
+    "run_terminal_command",
+];
 /** Env override forcing hook-level read-only write denial (#1185). */
 export const READ_ONLY_HOOK_ENV = "DEFT_HOOK_READ_ONLY";
 function normalizedToolName(toolName) {
@@ -87,6 +96,26 @@ export const MCP_PUSH_MERGE_BARE_NAMES = [
 export const DIRECT_WRITE_HOOK_MATCHER = DIRECT_WRITE_TOOL_NAMES.join("|");
 export const SPAWN_HOOK_MATCHER = SPAWN_TOOL_NAMES.join("|");
 export const SHELL_HOOK_MATCHER = SHELL_TOOL_NAMES.join("|");
+/** Known mutation tool names per host. Deposited matchers must cover each name (#3987). */
+export const GROK_MUTATION_TOOL_CATALOG = {
+    directWrite: ["write", "search_replace"],
+    shell: ["run_terminal_command"],
+    spawn: ["spawn_subagent"],
+};
+/** Tools on this host that are intentionally not mutation-gated. */
+export const GROK_NON_MUTATION_TOOLS = {
+    read_file: "read",
+    grep: "read",
+    list_dir: "read",
+    todo_write: "session-local non-product scratch",
+    get_command_or_subagent_output: "poll, not a mutation; elapsed bound is evaluateInFlight",
+    kill_command_or_subagent: "process control",
+    search_tool: "read",
+    web_search: "read",
+};
+export function matcherHasLiteralToken(matcher, toolName) {
+    return matcher.split("|").includes(toolName);
+}
 /**
  * PreToolUse matcher for MCP-class push/merge tools (#2711).
  * Regex-friendly for Claude/nested hosts. Prefer broad install match +

package/dist/init-deposit/gitignore.d.ts

@@ -25,6 +25,13 @@ export interface ReconstituteDepositResult {
     readonly reconstituted: boolean;
 }
 export type GitLsFiles = (projectDir: string, paths: readonly string[]) => string | null;
+/**
+ * Strip leading/trailing slashes so `.deft/cache/` and `.deft/cache` match.
+ * Globs are not expanded: a writer covered only by a glob fails closed (#3612).
+ */
+export declare function normalizeGitignorePath(p: string): string;
+export declare function gitignoreRuleCoversPath(rule: string, relPath: string): boolean;
+export declare function ignoreSetCoversPath(rules: readonly string[], relPath: string): boolean;
 /**
  * Reports whether `.deft/core` is tracked in git. Returns `null` when git is
  * unavailable or the tree is not a repository (treated as greenfield).

package/dist/init-deposit/gitignore.js

@@ -31,6 +31,13 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     ".deft/last-session.json",
     ".deft/occupancy.json",
     ".deft/routing.local.json",
+    // #3612: remaining runtime writer roots kept at historical names (on-disk
+    // contracts). Relocating them would break existing consumer state.
+    ".deft/authz/",
+    ".deft/delivery-attempts/",
+    ".deft/metrics/",
+    ".deft/escalations/",
+    ".deft/approved-scope/",
     // Agent-host working state (#3502). Selective, NEVER blanket `.claude/`:
     // `.claude/settings.json`, `.claude/skills/` and `.claude/commands/` are
     // MANAGED DEPOSITS (agent-hooks.ts / skill-discovery-hosts.ts) and must stay
@@ -105,6 +112,23 @@ function gitignoreCoversLine(present, line) {
     }
     return false;
 }
+/**
+ * Strip leading/trailing slashes so `.deft/cache/` and `.deft/cache` match.
+ * Globs are not expanded: a writer covered only by a glob fails closed (#3612).
+ */
+export function normalizeGitignorePath(p) {
+    return p.replaceAll("\\", "/").replace(/^\/+/, "").replace(/\/+$/, "");
+}
+export function gitignoreRuleCoversPath(rule, relPath) {
+    const r = normalizeGitignorePath(stripGitignoreInlineComment(rule));
+    const p = normalizeGitignorePath(relPath);
+    if (!r || r.startsWith("#"))
+        return false;
+    return r === p || p.startsWith(`${r}/`);
+}
+export function ignoreSetCoversPath(rules, relPath) {
+    return rules.some((rule) => gitignoreRuleCoversPath(rule, relPath));
+}
 function collectPresentGitignoreLines(existing) {
     const present = new Set();
     for (const raw of existing.split("\n")) {

package/dist/init-deposit/init-deposit.js

@@ -10,6 +10,7 @@ import { homedir, platform } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
 import { copyTree } from "../deposit/copy-tree.js";
+import { assertLiveProcedureDepositClean } from "../deposit/live-procedure-targets.js";
 import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
@@ -173,8 +174,10 @@ export async function runInitDeposit(args, io, seams = {}) {
     const resolveContent = seams.resolveContentRoot ?? resolveInstalledContentRoot;
     const copyContent = seams.copyContent ?? copyTree;
     const contentRoot = await resolveContent();
+    assertLiveProcedureDepositClean(contentRoot);
     await reconstituteDepositFromContent(contentRoot, deftDir, copyContent);
     await prunePythonArtifactsFromDeposit(deftDir, projectDir, io);
+    assertLiveProcedureDepositClean(deftDir);
     ensureInitGitignoreLines(projectDir, io);
     ensurePrettierIgnoreLines(projectDir, io);
     const nowIso = seams.nowIso ?? (() => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));

package/dist/init-deposit/refresh.js

@@ -13,6 +13,7 @@ import { platform as osPlatform } from "node:os";
 import { join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
 import { replaceTree } from "../deposit/copy-tree.js";
+import { assertLiveProcedureDepositClean } from "../deposit/live-procedure-targets.js";
 import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { manifestTagToVersion, parseInstallManifest } from "../doctor/manifest.js";
@@ -476,9 +477,12 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     const strategy = alreadyCurrent ? "no-op" : "file-swap";
     if (alreadyCurrent) {
         io.printf("[deft update] Framework payload already current; skipping payload copy.\n");
+        // C3 even when VERSION matches: skip-copy is not skip-validation (#3602).
+        assertLiveProcedureDepositClean(contentRoot);
         // #2913: still fail-closed reconcile so dst-only leftovers cannot linger when
         // VERSION already matches (e.g. pre-#2804 additive deposits). Does not re-stamp.
         await reconcileDepositToContentPackage(deftDir, contentRoot, io);
+        assertLiveProcedureDepositClean(deftDir);
         migrateLegacyInstallManifest(projectDir, join(deftDir, "VERSION"));
         // #3117: ensure a readable live generation token exists without advancing
         // when the payload did not swap (already-current). stampLiveGeneration is a
@@ -504,8 +508,11 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     }
     else {
         // Full-tree replace (or injected seam). Additive copy is no longer the default.
+        // C3 the incoming package BEFORE replace so a reject cannot leave a broken deposit.
+        assertLiveProcedureDepositClean(contentRoot);
         await copyContent(contentRoot, deftDir);
         await prunePythonArtifactsFromDeposit(deftDir, projectDir, io);
+        assertLiveProcedureDepositClean(deftDir);
         // #2913 / #2804 / #2347: fail-closed delete-not-in-source BEFORE VERSION stamp.
         // replaceTree already drops dst-only paths; reconcile verifies and covers
         // additive seams. Throws => no VERSION rewrite (refuse stamp until clean).

package/dist/init-deposit/runtime-writers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Runtime writer paths that land in a consumer working tree (#3612).
+ *
+ * The ignore baselines and this list are coupled: every exported writer path
+ * constant MUST appear here, and a fail-closed test asserts the ignore set
+ * covers each entry on both shipped surfaces. New writers join this registry;
+ * they do not get a silent extra .deft/ name.
+ */
+/**
+ * Imported writer path constants. Order is the lockstep contract with
+ * runtime-writer-paths.json (Go reads that file).
+ */
+export declare const RUNTIME_WRITER_PATHS: readonly string[];
+//# sourceMappingURL=runtime-writers.d.ts.map

package/dist/init-deposit/runtime-writers.js

@@ -0,0 +1,33 @@
+/**
+ * Runtime writer paths that land in a consumer working tree (#3612).
+ *
+ * The ignore baselines and this list are coupled: every exported writer path
+ * constant MUST appear here, and a fail-closed test asserts the ignore set
+ * covers each entry on both shipped surfaces. New writers join this registry;
+ * they do not get a silent extra .deft/ name.
+ */
+import { AUTHZ_DIR } from "../authz/types.js";
+import { DEFAULT_TASK_CACHE_ROOT } from "../cache/task-cache/constants.js";
+import { SESSION_COMPLETED_MARKER_REL } from "../check/session-completed-ac.js";
+import { DELIVERY_ATTEMPT_DIR } from "../delivery-attempt/types.js";
+import { ESCALATION_DIR } from "../escalation/types.js";
+import { PROJECT_LOCAL_METRICS_DIR } from "../metrics/resolve-metrics-home.js";
+import { APPROVED_SCOPE_DIR } from "../scope-provenance/digest.js";
+import { AC_PASS_BANK_DIR } from "../session/ac-pass-banking.js";
+import { VERIFY_AC_SESSION_CACHE_DIR } from "../session/verify-ac-session-cache.js";
+/**
+ * Imported writer path constants. Order is the lockstep contract with
+ * runtime-writer-paths.json (Go reads that file).
+ */
+export const RUNTIME_WRITER_PATHS = Object.freeze([
+    AC_PASS_BANK_DIR,
+    VERIFY_AC_SESSION_CACHE_DIR,
+    SESSION_COMPLETED_MARKER_REL.join("/"),
+    AUTHZ_DIR,
+    DELIVERY_ATTEMPT_DIR,
+    PROJECT_LOCAL_METRICS_DIR,
+    ESCALATION_DIR,
+    APPROVED_SCOPE_DIR,
+    DEFAULT_TASK_CACHE_ROOT,
+]);
+//# sourceMappingURL=runtime-writers.js.map

package/dist/intake/issue-ingest.d.ts

@@ -1,5 +1,5 @@
 import { type ScanFlag } from "../cache/scanner.js";
-import { type IssueComment as ShapeIssueComment } from "../umbrella-current-shape/index.js";
+import { type CurrentShapeNullReason, type IssueComment as ShapeIssueComment } from "../umbrella-current-shape/index.js";
 import { LEGACY_ARTIFACT_SUFFIX, LEGACY_INFO_ROOT_KEY, MIGRATED_ARTIFACT_SUFFIX, MIGRATED_INFO_ROOT_KEY } from "../xbrief-migrate/constants.js";
 import { type ScmCallFn } from "./reconcile-issues.js";
 /** Reference type pointing at the canonical current-shape comment permalink (#1870). */
@@ -42,6 +42,11 @@ export declare function mapIngestCommentsToShapeComments(comments: readonly Issu
 export declare function selectIngestCurrentShape(comments: readonly IssueComment[]): (ShapeIssueComment & {
     pass: number;
 }) | null;
+/**
+ * Classify why `selectIngestCurrentShape` returned null so ingest can report a
+ * reason instead of silently omitting the CurrentShape narrative (#3934).
+ */
+export declare function describeIngestCurrentShapeNull(comments: readonly IssueComment[]): CurrentShapeNullReason;
 /** Count maintainer current-shape comments (lint surface for !=1). */
 export declare function countIngestCurrentShapeComments(comments: readonly IssueComment[]): number;
 export declare function bodyControlCharacterLabels(body: string): string[];

package/dist/intake/issue-ingest.js

@@ -11,7 +11,7 @@ import { stampAcceptanceFromLiteralCapture } from "../product-first-done-gate/in
 import { call } from "../scm/call.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveProjectRepo } from "../slice/project-context.js";
-import { countMaintainerCurrentShapeComments, mapIssueCommentEntry, RAW_ISSUE_COMMENTS_KEY, selectCurrentShapeComment, } from "../umbrella-current-shape/index.js";
+import { countMaintainerCurrentShapeComments, describeCurrentShapeNull, mapIssueCommentEntry, RAW_ISSUE_COMMENTS_KEY, selectCurrentShapeComment, } from "../umbrella-current-shape/index.js";
 import { slugify, TODAY } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
 import { stampDerivedClausesOnAcceptance } from "../verify-ac/clauses.js";
@@ -66,6 +66,13 @@ export function mapIngestCommentsToShapeComments(comments) {
 export function selectIngestCurrentShape(comments) {
     return selectCurrentShapeComment(mapIngestCommentsToShapeComments(comments));
 }
+/**
+ * Classify why `selectIngestCurrentShape` returned null so ingest can report a
+ * reason instead of silently omitting the CurrentShape narrative (#3934).
+ */
+export function describeIngestCurrentShapeNull(comments) {
+    return describeCurrentShapeNull(mapIngestCommentsToShapeComments(comments));
+}
 /** Count maintainer current-shape comments (lint surface for !=1). */
 export function countIngestCurrentShapeComments(comments) {
     return countMaintainerCurrentShapeComments(mapIngestCommentsToShapeComments(comments));
@@ -409,6 +416,17 @@ export function buildIssueVbrief(issue, status, repoUrl, options = {}) {
         // Scan shape body under the same fail-closed contract as Overview (#2306).
         narratives.CurrentShape = scanUntrustedIngestText(number, currentShape.body);
     }
+    else {
+        // #3934: a thread whose only shape comments failed the #2307 authorship
+        // filter is otherwise indistinguishable from a thread that never had one,
+        // so a cache-reading agent falls back to the stale body. The note is
+        // framework-authored and carries comment ids plus normalized author
+        // associations only -- no comment text -- so it needs no quarantine scan.
+        const shapeNullReason = describeIngestCurrentShapeNull(commentThread);
+        if (shapeNullReason.kind === "non-maintainer-shape") {
+            narratives.CurrentShapeUnavailable = shapeNullReason.message;
+        }
+    }
     if (labelNames.length > 0) {
         narratives.Labels = labelNames.join(", ");
     }
@@ -640,7 +658,8 @@ export function fetchSingleIssue(repo, number, options = {}) {
         return null;
     }
     if (result.returncode !== 0) {
-        process.stderr.write(`Error: gh CLI failed fetching #${number}: ${result.stderr.trim()}\n`);
+        const invoked = result.args?.[0] ?? "gh";
+        process.stderr.write(`Error: ${invoked} failed fetching #${number}: ${result.stderr.trim()}\n`);
         return null;
     }
     try {