@deftai/directive-core 0.108.0 → 0.109.1

package/dist/deposit/stage-content-pack.js

@@ -0,0 +1,91 @@
+/**
+ * Stage the @deftai/directive-content pack the same way prepack does, then
+ * rewrite relative markdown links onto the flattened deposit layout (#3937).
+ *
+ * Must not write into the source tree: destDir is the pack root (packages/content
+ * during prepack, or an out-of-tree temp dir in tests).
+ */
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, } from "node:fs";
+import { join, relative } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { rewriteMarkdownDepositLinks, sourceRelForPackRel } from "./rewrite-deposit-links.js";
+const ENGINE_ENTRIES = [".githooks", "Taskfile.yml", "tasks"];
+const HARNESS_ENTRIES = ["main.md", "SKILL.md"];
+function keepCopy(src) {
+    return !src.includes("__pycache__") && !src.endsWith(".pyc") && !src.endsWith(".py");
+}
+function rewriteStagedMarkdown(destDir) {
+    let filesRewritten = 0;
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile() || !entry.name.endsWith(".md"))
+                continue;
+            const packRel = relative(destDir, full).replace(/\\/g, "/");
+            const original = readFileSync(full, "utf8");
+            const { content, rewriteCount } = rewriteMarkdownDepositLinks({
+                content: original,
+                sourceFileRel: sourceRelForPackRel(packRel),
+                packFileRel: packRel,
+            });
+            if (rewriteCount > 0 && content !== original) {
+                containedWrite({
+                    root: destDir,
+                    target: packRel,
+                    data: content,
+                    mode: "replace",
+                });
+                filesRewritten += 1;
+            }
+        }
+    };
+    walk(destDir);
+    return filesRewritten;
+}
+/** Copy content/ + harness + engine entries, then rewrite markdown links. */
+export function stageContentPack(options) {
+    const { repoRoot, destDir } = options;
+    mkdirSync(destDir, { recursive: true });
+    const contentSrc = join(repoRoot, "content");
+    for (const name of readdirSync(contentSrc)) {
+        const from = join(contentSrc, name);
+        const to = join(destDir, name);
+        if (existsSync(to))
+            rmSync(to, { recursive: true, force: true });
+        cpSync(from, to, { recursive: true, filter: (src) => keepCopy(src) });
+    }
+    for (const name of ENGINE_ENTRIES) {
+        const from = join(repoRoot, name);
+        if (!existsSync(from))
+            continue;
+        const to = join(destDir, name);
+        if (existsSync(to))
+            rmSync(to, { recursive: true, force: true });
+        cpSync(from, to, { recursive: true, filter: (src) => keepCopy(src) });
+    }
+    for (const name of HARNESS_ENTRIES) {
+        const from = join(repoRoot, name);
+        if (!existsSync(from))
+            continue;
+        cpSync(from, join(destDir, name));
+    }
+    const filesRewritten = rewriteStagedMarkdown(destDir);
+    return { filesRewritten };
+}
+/** prepack cwd is packages/content. */
+export function runPrepackFromContentPackage(pkgDir) {
+    const repoRoot = join(pkgDir, "..", "..");
+    stageContentPack({ repoRoot, destDir: pkgDir });
+}
+//# sourceMappingURL=stage-content-pack.js.map

package/dist/design-critique/citation-grammar.d.ts

@@ -44,6 +44,13 @@ export type CitationScan = {
 };
 /** The published closed set, in the order the contract lists it. */
 export declare const ACCEPTED_CITATION_FORMS: readonly string[];
+/**
+ * Refused positions are exactly the five published classes. An indented code
+ * block and an HTML comment are deliberately not classified: a four-space
+ * indent is also ordinary list-continuation content, so refusing it would block
+ * valid records more often than it would catch example text.
+ */
+export declare function classifyPosition(body: string, offset: number): CitationRejectionClass | null;
 /**
  * Parse the closed citation grammar out of one comment body. Refused positions
  * are reported rather than dropped so a block detail can echo the observation

package/dist/design-critique/citation-grammar.js

@@ -239,7 +239,7 @@ function blockPosition(body, offset) {
  * indent is also ordinary list-continuation content, so refusing it would block
  * valid records more often than it would catch example text.
  */
-function classifyPosition(body, offset) {
+export function classifyPosition(body, offset) {
     const block = blockPosition(body, offset);
     if (block.insideFence)
         return "code-fence";

package/dist/design-critique/completed-arc-record.d.ts

@@ -15,7 +15,14 @@ export type ThreadComment = {
     readonly id: number;
     readonly body: string;
 };
-export type CompletedArcBlockReason = "missing-record" | "lone-shape" | "cite-not-lean" | "missing-table-cite";
+/**
+ * Closed reason set, published in `content/contracts/design-critique.md`
+ * `### One parser, set membership, observed diagnostics`. The union is derived
+ * from this array so a member added here without a contract row fails the
+ * content-contract suite (#3942).
+ */
+export declare const COMPLETED_ARC_BLOCK_REASONS: readonly ["missing-record", "lone-shape", "cite-not-lean", "missing-table-cite", "unshaped-table-cite", "ambiguous-table-cite"];
+export type CompletedArcBlockReason = (typeof COMPLETED_ARC_BLOCK_REASONS)[number];
 export type CompletedArcVerdict = {
     readonly status: "not-in-arc";
 } | {

package/dist/design-critique/completed-arc-record.js

@@ -13,6 +13,20 @@
  */
 import { ACCEPTED_CITATION_FORMS, scanCitations, } from "./citation-grammar.js";
 import { DESIGN_CRITIQUE_CATALOG_CHIPS } from "./exclusive-chip.js";
+/**
+ * Closed reason set, published in `content/contracts/design-critique.md`
+ * `### One parser, set membership, observed diagnostics`. The union is derived
+ * from this array so a member added here without a contract row fails the
+ * content-contract suite (#3942).
+ */
+export const COMPLETED_ARC_BLOCK_REASONS = [
+    "missing-record",
+    "lone-shape",
+    "cite-not-lean",
+    "missing-table-cite",
+    "unshaped-table-cite",
+    "ambiguous-table-cite",
+];
 const SYNTHESIS_SHAPE_RE = /(?:^|\n)\s*design-critique:\s*synthesis accepted,\s*because\b/i;
 const LEAN_HEADING_RE = /(?:^|\n)\s*\*{0,2}Lean:\*{0,2}/;
 const TABLE_HEADING_RE = /(?:^|\n)\s*##\s+Verified-claims table\b/;
@@ -126,6 +140,86 @@ function resolveCitedLean(citations, byCommentId, latestLean) {
         .map((row) => byCommentId.get(row.id))
         .find((row) => row !== undefined && isSuccessorLeanBody(row.body));
 }
+/**
+ * Table resolution precedence (#3932).
+ *
+ * A typed `verified-claims table <id>` citation is the synthesis naming its own
+ * table, so it decides resolution: a generic citation neither satisfies it nor
+ * masks it. Scanning every citation for the first table-shaped body -- what
+ * this did before -- let an unrelated table-shaped comment clear a record whose
+ * claimed table is not a table, because the `missing-table-cite` refusal ran
+ * only after that untyped search failed.
+ *
+ * Cardinality rule: every table-kind claim must resolve to the same
+ * verified-claims table artifact. One valid typed claim must not launder an
+ * invalid one -- filtering to typed citations and then taking the first
+ * table-shaped body finds the real table in a valid-plus-ghost pair and never
+ * examines the ghost. `scanCitations` deduplicates on `(id, kind)`, so naming
+ * one table id twice is a single claim, while two distinct typed ids are two
+ * claims and cannot both be this record's table.
+ *
+ * With no typed claim the generic scan stands unchanged: permalink and bare
+ * `comment` citations scan as kind `comment`, and that is the published form
+ * these records use. Narrowing the citation contract so a table must be named
+ * by keyword is a separate decision needing its own migration criteria.
+ *
+ * Refusal partition (#3942). A typed claim fails in two states, and only one of
+ * them is fixed by adding the heading: the id is not a comment on this thread,
+ * or it is a comment whose body fails `isVerifiedClaimsTableBody`. One reason
+ * and one detail for both asserted the first in either case, so an author whose
+ * table is on the thread read a true citation being called false and had no
+ * path to the missing heading. Absent ids rank first because a body that is not
+ * there cannot be given a heading.
+ */
+function resolveCitedTable(citations, byCommentId) {
+    const claimed = citations.filter((row) => row.kind === "table");
+    if (claimed.length === 0) {
+        return {
+            ok: true,
+            table: citations
+                .map((row) => byCommentId.get(row.id))
+                .find((row) => row !== undefined && isVerifiedClaimsTableBody(row.body)),
+        };
+    }
+    const resolved = claimed.map((row) => ({ id: row.id, cited: byCommentId.get(row.id) }));
+    const absent = resolved.filter((row) => row.cited === undefined).map((row) => row.id);
+    const unshaped = resolved
+        .filter((row) => row.cited !== undefined && !isVerifiedClaimsTableBody(row.cited.body))
+        .map((row) => row.id);
+    if (absent.length > 0) {
+        return {
+            ok: false,
+            reason: "missing-table-cite",
+            detail: "synthesis cites a verified-claims table id that is not a comment on this thread: " +
+                renderIds(absent) +
+                (unshaped.length > 0
+                    ? "; also cited, on this thread and carrying no verified-claims-table heading: " +
+                        renderIds(unshaped)
+                    : ""),
+        };
+    }
+    if (unshaped.length > 0) {
+        return {
+            ok: false,
+            reason: "unshaped-table-cite",
+            detail: "synthesis cites a verified-claims table id that is a comment on this thread but " +
+                "opens no line with the `## Verified-claims table` heading: " +
+                renderIds(unshaped) +
+                "; add that heading to the cited comment",
+        };
+    }
+    const distinct = [...new Set(claimed.map((row) => row.id))];
+    if (distinct.length > 1) {
+        return {
+            ok: false,
+            reason: "ambiguous-table-cite",
+            detail: "synthesis claims more than one verified-claims table; every table citation must name " +
+                "the same table: " +
+                renderIds(distinct),
+        };
+    }
+    return { ok: true, table: resolved.find((row) => row.cited !== undefined)?.cited };
+}
 function verdictForSynthesis(comment, comments) {
     const scan = scanCitations(comment.body);
     const citations = scan.citations;
@@ -146,25 +240,15 @@ function verdictForSynthesis(comment, comments) {
                 renderIds(citations.map((row) => row.id)),
         };
     }
-    const citedTable = citations
-        .map((row) => byCommentId.get(row.id))
-        .find((row) => row !== undefined && isVerifiedClaimsTableBody(row.body));
-    if (citedTable === undefined) {
-        const claimed = citations.filter((row) => row.kind === "table");
-        if (claimed.length > 0) {
-            return {
-                status: "blocked",
-                reason: "missing-table-cite",
-                detail: "synthesis cites a verified-claims table id that is not a table on this thread: " +
-                    renderIds(claimed.map((row) => row.id)),
-            };
-        }
+    const citedTable = resolveCitedTable(citations, byCommentId);
+    if (!citedTable.ok) {
+        return { status: "blocked", reason: citedTable.reason, detail: citedTable.detail };
     }
     return {
         status: "complete",
         synthesisCommentId: comment.id,
         citedLeanId: citedLean.id,
-        citedTableId: citedTable?.id ?? null,
+        citedTableId: citedTable.table?.id ?? null,
     };
 }
 /**

package/dist/hooks/classify/host-session-identity.d.ts

@@ -1,12 +1,14 @@
 /**
  * Cooperative host-session identity and exact lifecycle-command rewriting (#3611).
  *
- * This is payload classification, not authentication. Host hook JSON is locally
- * forgeable under the occupancy model's cooperating-process assumption.
+ * This is payload/environment classification, not authentication. Host hook JSON
+ * is locally forgeable under the occupancy model's cooperating-process
+ * assumption. The provider table and the canonical owner form live in
+ * `session/host-session-owner.ts` because the CLI claim path resolves the same
+ * owner from the same host (#3873).
  */
-export declare const HOST_IDENTITY_PROVIDERS: readonly ["codex", "claude", "cursor"];
-export type HookHostIdentityProvider = (typeof HOST_IDENTITY_PROVIDERS)[number];
-export declare const MAX_HOOK_HOST_IDENTITY_UTF8_BYTES = 512;
+import { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentitySource, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES } from "../../session/host-session-owner.js";
+export { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentitySource, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, };
 export type HookHostIdentityStatus = "ok" | "missing" | "invalid" | "conflict" | "unsupported";
 export type HookHostIdentityResolution = {
     readonly status: "ok";
@@ -24,13 +26,25 @@ export type HookHostIdentityResolution = {
 /**
  * Resolve the stable conversation/session-family key documented by each host.
  *
- * - Codex: `session_id` (parent and subagents share it).
- * - Claude Code: `session_id` (`agent_id` is deliberately not the owner key).
- * - Cursor: `conversation_id`; simultaneous `session_id` must agree.
- * - Grok/unknown: no guessed payload identity; callers keep explicit/env flow.
+ * - Codex: payload `session_id` (parent and subagents share it).
+ * - Claude Code: payload `session_id` (`agent_id` is not the owner key).
+ * - Cursor: payload `conversation_id`; simultaneous `session_id` must agree.
+ * - Grok: hook process `GROK_SESSION_ID` (#3873). The payload `session_id` is
+ *   deliberately not read -- that contract is unverified.
+ * - Unknown hosts: no guessed identity; callers keep the explicit/env flow.
  */
-export declare function resolveHookHostIdentity(host: string, payload: unknown): HookHostIdentityResolution;
-export declare const EXACT_LIFECYCLE_VERBS: readonly ["session:start", "session:ready", "session:end", "occupancy:steal", "occupancy:release", "occupancy:heartbeat", "swarm:launch"];
+export declare function resolveHookHostIdentity(host: string, payload: unknown, environ?: NodeJS.ProcessEnv): HookHostIdentityResolution;
+/**
+ * True when a `host-env` provider simply did not publish its variable (#3873).
+ *
+ * Absence is the pre-#3873 state rather than a broken contract, so callers keep
+ * the documented explicit `--session-id` / `DEFT_SESSION_ID` flow instead of
+ * failing a host that never had a hook identity to begin with. It is never an
+ * admission: with no explicit owner the actor stays unset and the write gate
+ * still denies. A present-but-malformed variable is `invalid` and fails closed.
+ */
+export declare function hostIdentityFallsBackToExplicitOwner(host: string, resolution: HookHostIdentityResolution): boolean;
+export declare const EXACT_LIFECYCLE_VERBS: readonly ["session:start", "session:ready", "session:end", "occupancy:steal", "occupancy:release", "occupancy:heartbeat", "occupancy:grant", "swarm:launch"];
 export type ExactLifecycleVerb = (typeof EXACT_LIFECYCLE_VERBS)[number];
 export interface ExactLifecycleCommandRewrite {
     readonly kind: "rewrite";
@@ -72,5 +86,4 @@ export declare function inspectExactLifecycleCommand(payload: unknown): ExactLif
  * operator input.
  */
 export declare function rewriteExactLifecycleCommand(payload: unknown, sessionId: string): ExactLifecycleCommandResult;
-export {};
 //# sourceMappingURL=host-session-identity.d.ts.map

package/dist/hooks/classify/host-session-identity.js

@@ -1,47 +1,22 @@
 /**
  * Cooperative host-session identity and exact lifecycle-command rewriting (#3611).
  *
- * This is payload classification, not authentication. Host hook JSON is locally
- * forgeable under the occupancy model's cooperating-process assumption.
+ * This is payload/environment classification, not authentication. Host hook JSON
+ * is locally forgeable under the occupancy model's cooperating-process
+ * assumption. The provider table and the canonical owner form live in
+ * `session/host-session-owner.ts` because the CLI claim path resolves the same
+ * owner from the same host (#3873).
  */
+import { ambientHostSessionOwner, CANONICAL_OWNER_PATTERN, canonicalHostSessionId, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, isUsableHostSessionId, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, readHostEnvIdentity, } from "../../session/host-session-owner.js";
 import { isShellTool } from "../tools.js";
 import { record, toolInputRecord } from "./payload.js";
 import { hookToolName } from "./tool-name.js";
-export const HOST_IDENTITY_PROVIDERS = ["codex", "claude", "cursor"];
-export const MAX_HOOK_HOST_IDENTITY_UTF8_BYTES = 512;
-function hasControlCharacter(value) {
-    for (let index = 0; index < value.length; index += 1) {
-        const unit = value.charCodeAt(index);
-        if (unit <= 0x1f || (unit >= 0x7f && unit <= 0x9f))
-            return true;
-    }
-    return false;
-}
-function hasUnpairedUtf16Surrogate(value) {
-    for (let index = 0; index < value.length; index += 1) {
-        const unit = value.charCodeAt(index);
-        if (unit >= 0xd800 && unit <= 0xdbff) {
-            const next = value.charCodeAt(index + 1);
-            if (!(next >= 0xdc00 && next <= 0xdfff))
-                return true;
-            index += 1;
-            continue;
-        }
-        if (unit >= 0xdc00 && unit <= 0xdfff)
-            return true;
-    }
-    return false;
-}
+export { ambientHostSessionOwner, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, };
 function identityField(input, fieldName) {
     if (!(fieldName in input))
         return { status: "missing", value: null };
     const raw = input[fieldName];
-    if (typeof raw !== "string" ||
-        raw.length === 0 ||
-        raw !== raw.trim() ||
-        hasControlCharacter(raw) ||
-        hasUnpairedUtf16Surrogate(raw) ||
-        Buffer.byteLength(raw, "utf8") > MAX_HOOK_HOST_IDENTITY_UTF8_BYTES) {
+    if (typeof raw !== "string" || !isUsableHostSessionId(raw)) {
         return { status: "invalid", value: null };
     }
     return { status: "ok", value: raw };
@@ -49,10 +24,6 @@ function identityField(input, fieldName) {
 function unresolvedHostIdentity(status, provider, message) {
     return { status, provider, rawSessionId: null, sessionId: null, message };
 }
-function canonicalHostSessionId(provider, rawSessionId) {
-    const encoded = Buffer.from(rawSessionId, "utf8").toString("base64url");
-    return `host:${provider}:v1:${encoded}`;
-}
 function resolvedHostIdentity(provider, rawSessionId) {
     return {
         status: "ok",
@@ -65,28 +36,39 @@ function resolvedHostIdentity(provider, rawSessionId) {
 /**
  * Resolve the stable conversation/session-family key documented by each host.
  *
- * - Codex: `session_id` (parent and subagents share it).
- * - Claude Code: `session_id` (`agent_id` is deliberately not the owner key).
- * - Cursor: `conversation_id`; simultaneous `session_id` must agree.
- * - Grok/unknown: no guessed payload identity; callers keep explicit/env flow.
+ * - Codex: payload `session_id` (parent and subagents share it).
+ * - Claude Code: payload `session_id` (`agent_id` is not the owner key).
+ * - Cursor: payload `conversation_id`; simultaneous `session_id` must agree.
+ * - Grok: hook process `GROK_SESSION_ID` (#3873). The payload `session_id` is
+ *   deliberately not read -- that contract is unverified.
+ * - Unknown hosts: no guessed identity; callers keep the explicit/env flow.
  */
-export function resolveHookHostIdentity(host, payload) {
-    if (!HOST_IDENTITY_PROVIDERS.includes(host)) {
-        return unresolvedHostIdentity("unsupported", host, `Host ${host || "<empty>"} has no verified payload identity contract.`);
+export function resolveHookHostIdentity(host, payload, environ = process.env) {
+    const source = hookHostIdentitySource(host);
+    if (source === null) {
+        return unresolvedHostIdentity("unsupported", host, `Host ${host || "<empty>"} has no verified session identity contract.`);
     }
     const provider = host;
+    if (source.kind === "host-env") {
+        const value = readHostEnvIdentity(environ, source.variable);
+        if (value.status !== "ok") {
+            return unresolvedHostIdentity(value.status, provider, `${provider} hook process environment ` +
+                `${value.status === "missing" ? "omits" : "has invalid"} ${source.variable}.`);
+        }
+        return resolvedHostIdentity(provider, value.rawSessionId);
+    }
     const input = record(payload);
     if (input === null) {
         return unresolvedHostIdentity("invalid", provider, `${provider} hook payload is not an object.`);
     }
-    if (provider === "codex" || provider === "claude") {
-        const session = identityField(input, "session_id");
+    if (provider !== "cursor") {
+        const session = identityField(input, source.field);
         if (session.status !== "ok") {
-            return unresolvedHostIdentity(session.status, provider, `${provider} hook payload ${session.status === "missing" ? "omits" : "has invalid"} session_id.`);
+            return unresolvedHostIdentity(session.status, provider, `${provider} hook payload ${session.status === "missing" ? "omits" : "has invalid"} ${source.field}.`);
         }
         return resolvedHostIdentity(provider, session.value);
     }
-    const conversation = identityField(input, "conversation_id");
+    const conversation = identityField(input, source.field);
     if (conversation.status !== "ok") {
         return unresolvedHostIdentity(conversation.status, provider, `Cursor hook payload ${conversation.status === "missing" ? "omits" : "has invalid"} conversation_id.`);
     }
@@ -99,6 +81,18 @@ export function resolveHookHostIdentity(host, payload) {
     }
     return resolvedHostIdentity(provider, conversation.value);
 }
+/**
+ * True when a `host-env` provider simply did not publish its variable (#3873).
+ *
+ * Absence is the pre-#3873 state rather than a broken contract, so callers keep
+ * the documented explicit `--session-id` / `DEFT_SESSION_ID` flow instead of
+ * failing a host that never had a hook identity to begin with. It is never an
+ * admission: with no explicit owner the actor stays unset and the write gate
+ * still denies. A present-but-malformed variable is `invalid` and fails closed.
+ */
+export function hostIdentityFallsBackToExplicitOwner(host, resolution) {
+    return resolution.status === "missing" && hookHostIdentitySource(host)?.kind === "host-env";
+}
 export const EXACT_LIFECYCLE_VERBS = [
     "session:start",
     "session:ready",
@@ -106,6 +100,10 @@ export const EXACT_LIFECYCLE_VERBS = [
     "occupancy:steal",
     "occupancy:release",
     "occupancy:heartbeat",
+    // #3954 item 2: `occupancy:grant` (and its `--revoke` arm) was the only
+    // occupancy lifecycle verb absent from this table, so the one verb that must
+    // be run by the occupant had no way to be told who the occupant is.
+    "occupancy:grant",
     "swarm:launch",
 ];
 const DIRECT_LIFECYCLE_VERBS = {
@@ -115,9 +113,9 @@ const DIRECT_LIFECYCLE_VERBS = {
     "occupancy:steal": "occupancy:steal",
     "occupancy:release": "occupancy:release",
     "occupancy:heartbeat": "occupancy:heartbeat",
+    "occupancy:grant": "occupancy:grant",
     "swarm-launch": "swarm:launch",
 };
-const CANONICAL_OWNER_PATTERN = /^host:(?:codex|claude|cursor):v1:[A-Za-z0-9_-]+$/;
 // Shell expansion markers are deliberately absent: `$`/backticks for POSIX,
 // `@` splatting for PowerShell, and `%NAME%` expansion for command shells.
 // Backslashes are inspectable so Windows path-bearing lifecycle commands fail
@@ -179,6 +177,23 @@ const LIFECYCLE_ARGUMENT_POLICIES = {
         valueFlags: new Set(["--session-id", "--project-root"]),
         rewriteUnsafeFlags: new Set(["--project-root"]),
     },
+    "occupancy:grant": {
+        booleanFlags: new Set(["--revoke"]),
+        valueFlags: new Set([
+            "--session-id",
+            "--child-session-id",
+            "--role",
+            "--worktree",
+            "--ttl-minutes",
+            "--host",
+            "--address",
+            "--join-protocol",
+            "--project-root",
+        ]),
+        // `--worktree` rebinds the tree the grant covers, so it joins the
+        // path/destination flags kept outside the auto-approved rewrite surface.
+        rewriteUnsafeFlags: new Set(["--project-root", "--worktree"]),
+    },
     "swarm:launch": {
         booleanFlags: new Set([
             "--autonomous",

package/dist/hooks/classify/index.d.ts

@@ -5,8 +5,8 @@
  * Policy / ritual / scope / permission emission stay in dispatcher + CLI adapter.
  */
 export { classifyHookPayload } from "./classify.js";
-export { EXACT_LIFECYCLE_VERBS, type ExactLifecycleCommandConflict, type ExactLifecycleCommandInspection, type ExactLifecycleCommandResult, type ExactLifecycleCommandRewrite, type ExactLifecycleVerb, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentityResolution, type HookHostIdentityStatus, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
-export { hookApplyPatchBodyPaths, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
+export { EXACT_LIFECYCLE_VERBS, type ExactLifecycleCommandConflict, type ExactLifecycleCommandInspection, type ExactLifecycleCommandResult, type ExactLifecycleCommandRewrite, type ExactLifecycleVerb, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, type HookHostIdentityProvider, type HookHostIdentityResolution, type HookHostIdentitySource, type HookHostIdentityStatus, hookHostIdentitySource, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
+export { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
 export { fieldPresent, fieldString, firstString, hookPayloadTopLevelKeys, record, toolInputRecord, } from "./payload.js";
 export { applyPatchMutationPaths, parseHookStdin, stripUtf8Bom } from "./stdin.js";
 export { hookToolName, inferCursorDirectWriteToolName, type MissingToolNameInput, missingToolNameMessage, } from "./tool-name.js";

package/dist/hooks/classify/index.js

@@ -5,8 +5,8 @@
  * Policy / ritual / scope / permission emission stay in dispatcher + CLI adapter.
  */
 export { classifyHookPayload } from "./classify.js";
-export { EXACT_LIFECYCLE_VERBS, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
-export { hookApplyPatchBodyPaths, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
+export { EXACT_LIFECYCLE_VERBS, exactLifecycleCommandVerb, HOST_IDENTITY_PROVIDERS, hookHostIdentitySource, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, MAX_HOOK_HOST_IDENTITY_UTF8_BYTES, resolveHookHostIdentity, rewriteExactLifecycleCommand, } from "./host-session-identity.js";
+export { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookPathSet, hookShellCommand, hookWriteTargetPath, } from "./paths.js";
 export { fieldPresent, fieldString, firstString, hookPayloadTopLevelKeys, record, toolInputRecord, } from "./payload.js";
 export { applyPatchMutationPaths, parseHookStdin, stripUtf8Bom } from "./stdin.js";
 export { hookToolName, inferCursorDirectWriteToolName, missingToolNameMessage, } from "./tool-name.js";

package/dist/hooks/classify/paths.d.ts

@@ -7,6 +7,8 @@
  * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
  */
 export declare function hookWriteTargetPath(payload: unknown): string | null;
+/** Raw ApplyPatch body text from patch / unified_diff / diff fields. */
+export declare function hookApplyPatchBodyText(payload: unknown): string | null;
 /** ApplyPatch body paths from patch / unified_diff / diff fields. */
 export declare function hookApplyPatchBodyPaths(payload: unknown): string[];
 /**

package/dist/hooks/classify/paths.js

@@ -22,13 +22,13 @@ export function hookWriteTargetPath(payload) {
         input.path,
     ]);
 }
-/** ApplyPatch body paths from patch / unified_diff / diff fields. */
-export function hookApplyPatchBodyPaths(payload) {
+/** Raw ApplyPatch body text from patch / unified_diff / diff fields. */
+export function hookApplyPatchBodyText(payload) {
     const input = record(payload);
     if (input === null)
-        return [];
+        return null;
     const toolInput = toolInputRecord(input);
-    const patch = firstString([
+    return firstString([
         toolInput?.patch,
         toolInput?.unified_diff,
         toolInput?.diff,
@@ -36,6 +36,10 @@ export function hookApplyPatchBodyPaths(payload) {
         input.unified_diff,
         input.diff,
     ]);
+}
+/** ApplyPatch body paths from patch / unified_diff / diff fields. */
+export function hookApplyPatchBodyPaths(payload) {
+    const patch = hookApplyPatchBodyText(payload);
     return patch === null ? [] : applyPatchMutationPaths(patch);
 }
 /**