@deftai/directive-core 0.108.0 → 0.109.1

package/dist/hooks/classify/stdin.js

@@ -2,6 +2,7 @@
  * Pure stdin → payload parse for hook-dispatch (#2734 / #2738 / #2950).
  * No process I/O — operates on an already-read string.
  */
+import { firstString, record, toolInputRecord } from "./payload.js";
 const UTF8_BOM = "\uFEFF";
 const APPLY_PATCH_BEGIN_MARKER = "*** Begin Patch";
 /** Single-file Add/Update only — other *** … File: ops must fail closed (#2738 Greptile). */
@@ -9,8 +10,9 @@ const APPLY_PATCH_MUTATION_LINE_RE = /^\*\*\* (Add File|Update File|Delete File|
 /**
  * Canonical apply_patch spells a rename as `*** Update File:` followed by
  * `*** Move to:`. The destination is a mutation target in its own right, so it
- * must reach root admission; kept separate from the header regex above so the
- * single-mutation #2738 synthesis contract is unchanged (#3794).
+ * must reach root admission. Synthesis refuses when applyPatchMutationPaths
+ * reports more than one unique path, so a Move-to destination is not dropped
+ * from the single-target contract (#3614 / #3794).
  */
 const APPLY_PATCH_MOVE_DESTINATION_RE = /^\*\*\* Move to: (.+)$/gm;
 export function stripUtf8Bom(raw) {
@@ -49,6 +51,10 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
     }
     if (mutations.length !== 1)
         return null;
+    // Count headers plus Move-to destinations so a rename cannot collapse to one
+    // checked path (#3614 / #3794). Reuses applyPatchMutationPaths; no second parser.
+    if (applyPatchMutationPaths(normalized).length !== 1)
+        return null;
     const sole = mutations[0];
     if (sole === undefined || (sole.op !== "Add File" && sole.op !== "Update File"))
         return null;
@@ -63,6 +69,65 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
         context: {},
     };
 }
+function declaredWritePathFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.file_path,
+        toolInput?.filePath,
+        toolInput?.path,
+        input.file_path,
+        input.filePath,
+        input.path,
+    ]);
+}
+function applyPatchBodyTextFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.patch,
+        toolInput?.unified_diff,
+        toolInput?.diff,
+        input.patch,
+        input.unified_diff,
+        input.diff,
+    ]);
+}
+function withToolInputPath(parsed, path) {
+    const input = record(parsed);
+    if (input === null)
+        return parsed;
+    for (const key of ["tool_input", "toolInput", "input", "arguments"]) {
+        const nested = record(input[key]);
+        if (nested !== null) {
+            return { ...input, [key]: { ...nested, path } };
+        }
+    }
+    return { ...input, tool_input: { path } };
+}
+/**
+ * Valid-JSON hosts (Codex) never hit the JSON.parse catch arm, so the free-form
+ * extractor was unreached. Call it on the patch body when no path was declared.
+ * Does not replace the parsed payload; only fills tool_input.path.
+ */
+function attachSynthesizedApplyPatchPath(parsed) {
+    if (declaredWritePathFromParsed(parsed) !== null)
+        return parsed;
+    const patch = applyPatchBodyTextFromParsed(parsed);
+    if (patch === null)
+        return parsed;
+    const synthesized = trySynthesizeFreeFormApplyPatch(patch);
+    if (synthesized === null)
+        return parsed;
+    const synthesizedPath = declaredWritePathFromParsed(synthesized.payload);
+    if (synthesizedPath === null)
+        return parsed;
+    return withToolInputPath(parsed, synthesizedPath);
+}
 /**
  * Parse host hook stdin text into a payload + parse context.
  * Empty → stdinEmpty; invalid JSON without free-form ApplyPatch → parseFailed.
@@ -76,7 +141,8 @@ export function parseHookStdin(raw) {
         return { payload: {}, context: { stdinEmpty: true } };
     }
     try {
-        return { payload: JSON.parse(normalized), context: {} };
+        const parsed = JSON.parse(normalized);
+        return { payload: attachSynthesizedApplyPatchPath(parsed), context: {} };
     }
     catch {
         const synthesized = trySynthesizeFreeFormApplyPatch(normalized);

package/dist/hooks/dest-form.d.ts

@@ -12,13 +12,27 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
  * verified by a literal token search, so wrapping it silently fails the gate.
  */
 export type ProductDestFormKind = "git-checkout" | "git-restore" | "rm" | "rmdir";
+export type GitDestructiveKind = "git-reset-hard" | "git-clean" | "git-checkout-force" | "git-stash-drop";
+export interface GitDestructiveForm {
+    readonly kind: GitDestructiveKind;
+    /** Relocating context paths from `-C` / `--git-dir` / `--work-tree` / `GIT_DIR` / `GIT_WORK_TREE`. */
+    readonly relocators: readonly string[];
+    /**
+     * True when the command is compound or the relocator is opaque (`GIT_CONFIG*`,
+     * `-c core.workTree`). The dispatcher denies these; it cannot prove a fixture.
+     */
+    readonly unprovable: boolean;
+}
 export interface ProductDestForm {
     readonly kind: ProductDestFormKind;
     readonly path: string;
@@ -43,4 +57,9 @@ export declare function payloadWithInjectedWriteTarget(payload: unknown, destPat
  */
 export declare function destFormHasExpansion(path: string): boolean;
 export declare function classifyProductDestForms(command: string): ProductDestForm[];
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export declare function classifyGitDestructive(command: string): GitDestructiveForm[];
 //# sourceMappingURL=dest-form.d.ts.map

package/dist/hooks/dest-form.js

@@ -12,7 +12,10 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
@@ -113,13 +116,14 @@ export function classifyProductDestForms(command) {
     // bypass.
     //
     // ⊗ Recognition is NOT total either, and this is not a security boundary.
-    // Only four verbs are recognized, and a non-literal verb (`\rm`, `rm${IFS}x`)
-    // defeats the tokenizer, so the fail-closed branch below only fires when the
-    // verb is still legible. Unrecognized mutators (`git reset --hard`,
-    // `git clean`, `git checkout` without `--`, `mv`, `sed -i`, `>` redirection)
-    // and interpreters (`bash -c`, `python -c`) are fail-OPEN. See the threat
-    // model in content/contracts/path-write-fence.md: this is a guardrail for
-    // careless agents, not a boundary against adversarial ones.
+    // Only four dest-form verbs are recognized, and a non-literal verb (`\rm`,
+    // `rm${IFS}x`) defeats the tokenizer, so the fail-closed branch below only
+    // fires when the verb is still legible. Tree-wide destructive git is handled
+    // by classifyGitDestructive (always-on). Remaining fail-OPEN mutators:
+    // `git checkout` without `--` or `-f`, `mv`, `sed -i`, `>` redirection, and
+    // interpreters (`bash -c`, `python -c`). See the threat model in
+    // content/contracts/path-write-fence.md: this is a guardrail for careless
+    // agents, not a boundary against adversarial ones.
     if (segments.length === 1 && !hasUnsupportedSyntax(cmd)) {
         return classifySimpleDestForms(segments[0] ?? "");
     }
@@ -136,6 +140,29 @@ export function classifyProductDestForms(command) {
         expansion: true,
     }));
 }
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export function classifyGitDestructive(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitCommandSegments(cmd);
+    const compound = segments.length > 1 || hasUnsupportedSyntax(cmd);
+    const found = [];
+    const seen = new Set();
+    for (const seg of segments) {
+        const form = classifyGitDestructiveSegment(seg);
+        if (form === null)
+            continue;
+        if (seen.has(form.kind))
+            continue;
+        seen.add(form.kind);
+        found.push(compound ? { ...form, unprovable: true } : form);
+    }
+    return found;
+}
 /** Classify one command with no operators, no grouping, and no substitution. */
 function classifySimpleDestForms(segment) {
     const found = [];
@@ -334,9 +361,33 @@ function isGitWorkTreeAssign(token) {
     // A config FILE override can set core.worktree out of sight.
     return key === "GIT_CONFIG" || key === "GIT_CONFIG_GLOBAL" || key === "GIT_CONFIG_SYSTEM";
 }
+function gitDirOrWorkTreeValue(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return null;
+    const key = token.slice(0, eq);
+    const value = token.slice(eq + 1);
+    if ((key === "GIT_WORK_TREE" || key === "GIT_DIR") && value.length > 0)
+        return value;
+    return null;
+}
 function skipPrefix(tokens) {
     let i = 0;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
+    const noteAssign = (tok) => {
+        const reloc = gitDirOrWorkTreeValue(tok);
+        if (reloc !== null) {
+            gitContext = true;
+            relocators.push(reloc);
+            return;
+        }
+        if (isGitWorkTreeAssign(tok)) {
+            gitContext = true;
+            opaqueContext = true;
+        }
+    };
     const consumeAssigns = () => {
         while (i < tokens.length) {
             const tok = tokens[i];
@@ -351,8 +402,7 @@ function skipPrefix(tokens) {
             }
             if (!isEnvAssign(tok))
                 break;
-            if (isGitWorkTreeAssign(tok))
-                gitContext = true;
+            noteAssign(tok);
             i++;
         }
     };
@@ -380,15 +430,14 @@ function skipPrefix(tokens) {
                 continue;
             }
             if (isEnvAssign(tok)) {
-                if (isGitWorkTreeAssign(tok))
-                    gitContext = true;
+                noteAssign(tok);
                 i++;
                 continue;
             }
             break;
         }
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 /**
  * Skip git's global options, reporting whether any of them RELOCATES the work
@@ -400,31 +449,51 @@ function skipPrefix(tokens) {
 function skipGitGlobals(tokens, start) {
     let i = start;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
     while (i < tokens.length) {
         const t = tokens[i];
         if (t === undefined || !t.startsWith("-"))
-            return { i, gitContext };
+            return { i, gitContext, relocators, opaqueContext };
         if (t === "-c" || t === "--config-env") {
-            if (isCoreWorkTreeConfig(tokens[i + 1]))
+            if (isCoreWorkTreeConfig(tokens[i + 1])) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i += 2;
             continue;
         }
         if (t.startsWith("--config-env=")) {
-            if (isCoreWorkTreeConfig(t.slice("--config-env=".length)))
+            if (isCoreWorkTreeConfig(t.slice("--config-env=".length))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         if (t === "-C" || t === "--work-tree" || t === "--git-dir") {
             gitContext = true;
+            const val = tokens[i + 1];
+            if (val !== undefined)
+                relocators.push(val);
             i += 2;
             continue;
         }
-        if (t.startsWith("--work-tree=") ||
-            t.startsWith("--git-dir=") ||
-            (t.startsWith("-C") && t.length > 2)) {
+        if (t.startsWith("--work-tree=")) {
+            gitContext = true;
+            relocators.push(t.slice("--work-tree=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("--git-dir=")) {
             gitContext = true;
+            relocators.push(t.slice("--git-dir=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("-C") && t.length > 2) {
+            gitContext = true;
+            relocators.push(t.slice(2));
             i++;
             continue;
         }
@@ -437,14 +506,16 @@ function skipGitGlobals(tokens, start) {
             continue;
         }
         if (t.startsWith("-c")) {
-            if (isCoreWorkTreeConfig(t.slice(2)))
+            if (isCoreWorkTreeConfig(t.slice(2))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         i++;
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 function pathsAfterDashDash(tokens, start) {
     const dash = tokens.indexOf("--", start);
@@ -469,6 +540,72 @@ function dests(kind, paths, unsafe = false) {
         .filter((path) => path.length > 0)
         .map((path) => (unsafe ? { kind, path, expansion: true } : { kind, path }));
 }
+function tokensHaveFlag(tokens, start, names) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined)
+            break;
+        if (names.has(t))
+            return true;
+        for (const name of names) {
+            if (name.startsWith("--") && t.startsWith(`${name}=`))
+                return true;
+        }
+    }
+    return false;
+}
+function tokensHaveShortForce(tokens, start) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined || t === "--")
+            break;
+        if (t === "-f" || t === "-B")
+            return true;
+        if (t.startsWith("-") && !t.startsWith("--") && t.includes("f"))
+            return true;
+    }
+    return false;
+}
+function classifyGitDestructiveSegment(segment) {
+    const tokens = tokenizeSegment(segment.trim());
+    const prefixSkip = skipPrefix(tokens);
+    let i = prefixSkip.i;
+    const binRaw = tokens[i];
+    if (binRaw === undefined)
+        return null;
+    const bin = binRaw.replace(/^[({!]+/, "").toLowerCase();
+    if (bin !== "git" && bin !== "git.exe")
+        return null;
+    const skipped = skipGitGlobals(tokens, i + 1);
+    i = skipped.i;
+    const sub = tokens[i]?.toLowerCase();
+    if (sub === undefined)
+        return null;
+    let kind = null;
+    if (sub === "reset" && tokensHaveFlag(tokens, i + 1, new Set(["--hard"]))) {
+        kind = "git-reset-hard";
+    }
+    else if (sub === "clean" &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-clean";
+    }
+    else if ((sub === "checkout" || sub === "switch") &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f", "-B"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-checkout-force";
+    }
+    else if (sub === "stash") {
+        const action = tokens[i + 1]?.toLowerCase();
+        if (action === "drop" || action === "clear")
+            kind = "git-stash-drop";
+    }
+    if (kind === null)
+        return null;
+    const relocators = [...prefixSkip.relocators, ...skipped.relocators];
+    const opaque = prefixSkip.opaqueContext || skipped.opaqueContext;
+    return { kind, relocators, unprovable: opaque };
+}
 /**
  * `-c core.workTree=...` / `--config-env` relocates the work tree through git
  * config. Resolution depends on the git dir, which this classifier does not

package/dist/hooks/dispatcher.d.ts

@@ -5,9 +5,10 @@ import { type RuntimeAuthorityPolicy } from "../policy/runtime-authority.js";
 import { type GitRunner } from "../session/git.js";
 import { type DetectWorkSelection, type RitualRunner, type VerifyResult } from "../session/verify-session-ritual.js";
 import { type HookPayloadContext } from "./classify/index.js";
+import { type OwnerLivenessInput, type OwnerLivenessOutcome } from "./owner-liveness.js";
 import { type ActiveScopeInspection } from "./scope.js";
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, HOST_TOOL_SURFACE_AUDIT, type HostMutationToolCatalog, type HostToolSurfaceAudit, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export declare const HOOK_HOSTS: readonly ["claude", "grok", "cursor", "codex"];
 export type HookHost = (typeof HOOK_HOSTS)[number];
 export declare const HOOK_EVENTS: readonly ["session.start", "session.compact", "tool.before"];
@@ -44,7 +45,11 @@ export type HookDecisionCode = "session-start" | "session-start-disabled" | "ses
 /** UAT lease / human-origin grant denial (#2944). */
  | "authz-uat-deny" | "authz-grant-missing" | "authz-grant-origin-reject" | "authz-grant-scope-deny" | "authz-grant-expired" | "authz-grant-revoked" | "authz-grant-single-use-spent"
 /** Slash-command intent ceiling denial (#1193). */
- | "intent-ceiling-deny";
+ | "intent-ceiling-deny"
+/** Tree-wide destructive git aimed at this checkout (#3917). */
+ | "git-destructive-deny"
+/** Tree-wide destructive git aimed at an absolute out-of-root fixture (#3917). */
+ | "git-destructive-fixture";
 export interface HookDecision {
     readonly verdict: HookVerdict;
     readonly code: HookDecisionCode;
@@ -122,6 +127,8 @@ export interface HookPolicySeams {
     readonly realpathLifecycleExecutionRoot?: (path: string) => string;
     /** Test seam for Windows drive-only execution-root payloads (#2787). */
     readonly lifecycleExecutionPlatform?: NodeJS.Platform;
+    /** Test seam for the #3987 post-decision owner-liveness re-stamp. */
+    readonly restampOwnerLiveness?: (input: OwnerLivenessInput) => OwnerLivenessOutcome;
 }
 /** POSIX-ish project-relative path for lifecycle matching. */
 export declare function toProjectRelativePosix(projectRoot: string, targetPath: string): string;
@@ -196,6 +203,19 @@ export interface EffectiveHookRootAdmission {
  * target that resolved to some other toplevel whose identity cannot be read, is
  * a question asked and left unanswered — that fails closed rather than
  * inheriting payloadRoot's occupancy and ritual state (#3794).
+ *
+ * The `candidateRaw === null` fallback below — a target whose nearest existing
+ * ancestor has no Git toplevel at all (OS temp, a home file, anything outside
+ * every checkout) — is the third case and is deliberate, not a gap (#4013).
+ * `effectiveRoot` selects occupancy, ritual, active scope, the write fence and
+ * assist-scratch, so returning no root would drop all of them for an
+ * out-of-tree write, not just the lease; occupancy and ritual are cross-checked
+ * and the allow path re-stamps the lease, so exempting the lease alone is not a
+ * complete state transition; and `admitMutationTargetSet` demands one unique
+ * root, so a member contributing none has no defined combining rule and an
+ * untrusted patch path would become an authority-selection input. Gate-by-gate
+ * disposition, the three-surface matrix and the relative-target
+ * canonicalization limitation (#4023): content/docs/hook-root-admission.md.
  */
 export declare function admitEffectiveHookRoot(payloadRoot: string, writeTarget: string | null, runGit: GitRunner): EffectiveHookRootAdmission;
 /**