@deftai/directive-core 0.108.0 → 0.109.1

package/dist/hooks/dispatcher.js

@@ -16,15 +16,18 @@ import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js"
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
 import { formatRitualRecoveryInstruction, inspectSessionRitual, verifySessionRitual, WRITE_GATED_REQUIRED_STEPS, writeGateRitualOptions, } from "../session/verify-session-ritual.js";
-import { hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, inspectExactLifecycleCommand, missingToolNameMessage, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
-import { classifyProductDestForms, payloadWithInjectedWriteTarget } from "./dest-form.js";
+import { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, missingToolNameMessage, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
+import { classifyGitDestructive, classifyProductDestForms, payloadWithInjectedWriteTarget, } from "./dest-form.js";
+import { appendGitDestructiveRecord, GIT_DESTRUCTIVE_LOG_ENV } from "./git-destructive-log.js";
+import { restampOwnerLivenessOnHookEvent, } from "./owner-liveness.js";
 import { isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
 import { inspectActiveScope } from "./scope.js";
+import { classifyShellWriteTargets, isInRepoShellWritePath } from "./shell-write-targets.js";
 import { isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool } from "./tools.js";
 // Pure parse/classify helpers are defined in ./classify/ and re-exported from
 // ./index.ts (#2950). Dispatcher is orchestration: classify → policy → decision.
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, HOST_TOOL_SURFACE_AUDIT, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export const HOOK_HOSTS = ["claude", "grok", "cursor", "codex"];
 export const HOOK_EVENTS = ["session.start", "session.compact", "tool.before"];
 /** Hosts that receive compact/resume hook deposits via init/update (#2113). */
@@ -104,6 +107,66 @@ export function isProposedLifecycleWrite(projectRoot, targetPath) {
         return false;
     return posix.startsWith("xbrief/proposed/") || posix.startsWith("vbrief/proposed/");
 }
+/**
+ * ApplyPatch body present but no mutation header could be classified.
+ * Fail closed rather than authorizing the declared path alone (#3614).
+ */
+function applyPatchBodyUnclassified(payload) {
+    const text = hookApplyPatchBodyText(payload);
+    return text !== null && hookApplyPatchBodyPaths(payload).length === 0;
+}
+/**
+ * Proposed-lifecycle exemption is universally quantified over every mutated
+ * path, not the declared write target alone (#3614).
+ */
+function allMutationTargetsAreProposedLifecycleWrites(projectRoot, payload) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0)
+        return false;
+    return targets.every((target) => isProposedLifecycleWrite(projectRoot, target));
+}
+function authzForMutationTargets(input, toolName, seams, options) {
+    const targets = hookMutationTargetPaths(input.payload);
+    const paths = targets.length > 0 ? targets : [null];
+    const pendingConsume = [];
+    for (const target of paths) {
+        const relPath = target !== null ? toProjectRelativePosix(options.projectRoot, target) : null;
+        const denied = authzForMutation(input, toolName, seams, {
+            isDirectWrite: options.isDirectWrite,
+            relPath,
+            scopePath: options.scopePath,
+            runGit: options.runGit,
+            consumeSingleUse: false,
+            pendingConsume,
+        });
+        if (denied !== null)
+            return denied;
+    }
+    const seen = new Set();
+    for (const ref of pendingConsume) {
+        if (seen.has(ref))
+            continue;
+        seen.add(ref);
+        try {
+            markGrantUsed(options.projectRoot, ref);
+        }
+        catch {
+            // Persistence failure must not flip allow after a successful check.
+        }
+    }
+    return null;
+}
+function allMutationTargetsAreAssistScratch(projectRoot, payload, environ) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0) {
+        return isAssistScratchWrite(projectRoot, hookWriteTargetPath(payload), payload, environ);
+    }
+    return targets.every((target) => isAssistScratchWrite(projectRoot, target, payload, environ));
+}
 /**
  * Canonical + gitignored assist scratch roots for low-ceremony disposable notes (#1802).
  * Path fence only — not free-text "for Obsidian" NLP. Tracked trees (src/, packages/, …)
@@ -268,6 +331,19 @@ function admitPayload(payload, candidate) {
  * target that resolved to some other toplevel whose identity cannot be read, is
  * a question asked and left unanswered — that fails closed rather than
  * inheriting payloadRoot's occupancy and ritual state (#3794).
+ *
+ * The `candidateRaw === null` fallback below — a target whose nearest existing
+ * ancestor has no Git toplevel at all (OS temp, a home file, anything outside
+ * every checkout) — is the third case and is deliberate, not a gap (#4013).
+ * `effectiveRoot` selects occupancy, ritual, active scope, the write fence and
+ * assist-scratch, so returning no root would drop all of them for an
+ * out-of-tree write, not just the lease; occupancy and ritual are cross-checked
+ * and the allow path re-stamps the lease, so exempting the lease alone is not a
+ * complete state transition; and `admitMutationTargetSet` demands one unique
+ * root, so a member contributing none has no defined combining rule and an
+ * untrusted patch path would become an authority-selection input. Gate-by-gate
+ * disposition, the three-surface matrix and the relative-target
+ * canonicalization limitation (#4023): content/docs/hook-root-admission.md.
  */
 export function admitEffectiveHookRoot(payloadRoot, writeTarget, runGit) {
     const payload = normalizeHookProjectRoot(payloadRoot);
@@ -373,19 +449,20 @@ function deny(input, code, toolName, message, scopePath = null) {
 }
 /**
  * Resolve the cooperative actor presented to the occupancy gate.
- * Supported payload hosts are payload-authoritative; ambient identity may only
- * corroborate. Grok retains the pre-#3611 environment path until its payload
- * contract is verified.
+ * A resolved host identity is authoritative; ambient identity may only
+ * corroborate. Hosts whose identity source is the hook environment fall back to
+ * the explicit owner flow when that variable is absent (#3873).
  */
 function resolveMutationActor(input, environ) {
-    const hostIdentity = resolveHookHostIdentity(input.host, input.payload);
+    const hostIdentity = resolveHookHostIdentity(input.host, input.payload, environ);
     const environmentId = environ.DEFT_SESSION_ID?.trim() || undefined;
-    if (hostIdentity.status === "unsupported") {
+    if (hostIdentity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, hostIdentity)) {
         return {
             sessionId: environmentId,
             issue: null,
             message: null,
-            payloadAuthoritative: false,
+            hostAuthoritative: false,
         };
     }
     if (hostIdentity.status === "ok" && hostIdentity.sessionId !== null) {
@@ -393,23 +470,23 @@ function resolveMutationActor(input, environ) {
             return {
                 sessionId: hostIdentity.sessionId,
                 issue: "conflict",
-                message: `Host payload owner ${hostIdentity.sessionId} conflicts with ` +
+                message: `Host owner ${hostIdentity.sessionId} conflicts with ` +
                     `DEFT_SESSION_ID ${environmentId}.`,
-                payloadAuthoritative: true,
+                hostAuthoritative: true,
             };
         }
         return {
             sessionId: hostIdentity.sessionId,
             issue: null,
             message: null,
-            payloadAuthoritative: true,
+            hostAuthoritative: true,
         };
     }
     return {
         sessionId: undefined,
         issue: hostIdentity.status === "conflict" ? "conflict" : "unavailable",
         message: hostIdentity.message,
-        payloadAuthoritative: true,
+        hostAuthoritative: true,
     };
 }
 function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath, effectiveRoot) {
@@ -448,20 +525,28 @@ function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath, effec
     // Neither layer active → allow (same as disabled runtimeAuthority historically).
     if (!fence.fenceActive)
         return null;
-    const writeTarget = hookWriteTargetPath(input.payload);
-    const relPath = writeTarget !== null ? toProjectRelativePosix(fenceRoot, writeTarget) : null;
-    const verdict = evaluateRuntimeAuthorityDirectWrite({
-        policy: fence.policy,
-        relPathPosix: relPath,
-    });
-    if (verdict.allowed)
-        return null;
     // #3794: relPath is now measured from the tree the write lands in. When that
     // differs from the payload root, a bare "outside file_scope" reason does not
     // say which tree the fence was relativised against.
     const fenceRootNote = fenceRoot === projectRoot ? "" : ` ${formatHookRootNote(projectRoot, fenceRoot)}`;
-    return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, (verdict.reason ?? "Directive denied this direct write under write fence policy.") +
-        fenceRootNote, scopePath);
+    if (applyPatchBodyUnclassified(input.payload)) {
+        return deny(input, "runtime-policy-deny-path", toolName, "Directive denied this direct write: apply_patch body named no classifiable mutation target, so the write fence cannot authorize it." +
+            fenceRootNote, scopePath);
+    }
+    const targets = hookMutationTargetPaths(input.payload);
+    const toCheck = targets.length > 0 ? targets : [null];
+    for (const target of toCheck) {
+        const relPath = target !== null ? toProjectRelativePosix(fenceRoot, target) : null;
+        const verdict = evaluateRuntimeAuthorityDirectWrite({
+            policy: fence.policy,
+            relPathPosix: relPath,
+        });
+        if (!verdict.allowed) {
+            return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, (verdict.reason ?? "Directive denied this direct write under write fence policy.") +
+                fenceRootNote, scopePath);
+        }
+    }
+    return null;
 }
 function loadAuthzContext(projectRoot, seams) {
     if (seams.loadAuthzState !== undefined) {
@@ -582,12 +667,17 @@ function authzForMutation(input, toolName, seams, options) {
         }
         // Consume single-use grants after allow (persist usedAt).
         if (shouldConsumeSingleUseGrant(decision) && decision.humanApprovalRef !== null) {
-            try {
-                markGrantUsed(projectRoot, decision.humanApprovalRef);
+            if (options.consumeSingleUse === false) {
+                options.pendingConsume?.push(decision.humanApprovalRef);
             }
-            catch {
-                // Persistence failure must not flip allow → deny after a successful check;
-                // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+            else {
+                try {
+                    markGrantUsed(projectRoot, decision.humanApprovalRef);
+                }
+                catch {
+                    // Persistence failure must not flip allow → deny after a successful check;
+                    // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+                }
             }
         }
     }
@@ -711,6 +801,13 @@ function inspectMutationGates(input, toolName, seams, options) {
         ? { root: payloadRoot, foreign: false, candidate: null, refusal: null }
         : admitMutationTargetSet(payloadRoot, mutationTargets, dispatchGit);
     const effectiveRoot = admission.root;
+    if (options.observation !== undefined) {
+        if (!options.observation.effectiveRoots.includes(effectiveRoot)) {
+            options.observation.effectiveRoots.push(effectiveRoot);
+        }
+        if (admission.foreign)
+            options.observation.foreignTarget = true;
+    }
     const rootsNote = ` ${formatHookRootNote(payloadRoot, effectiveRoot)}`;
     if (admission.foreign) {
         const candidate = admission.candidate ?? "<none>";
@@ -727,17 +824,15 @@ function inspectMutationGates(input, toolName, seams, options) {
     // assist/ephemeral classification skip ritual + active-scope (no fake scope:activate).
     // Tracked product paths never match the path fence. Read-only still denied upstream.
     if (!isSpawnTool(toolName)) {
-        const scratchTarget = hookWriteTargetPath(input.payload);
         // #3794 commit 2: classify against effectiveRoot. Relative to payloadRoot every
         // file in a `.deft-scratch/worktrees/<x>/` worktree read as assist scratch, so
         // assist/ephemeral worktree writes skipped ritual, occupancy and scope entirely.
-        if (isAssistScratchWrite(effectiveRoot, scratchTarget, input.payload, environ)) {
-            const relPath = scratchTarget !== null ? toProjectRelativePosix(projectRoot, scratchTarget) : null;
-            const authzDeny = authzForMutation(input, toolName, seams, {
+        if (allMutationTargetsAreAssistScratch(effectiveRoot, input.payload, environ)) {
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
                 runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -769,8 +864,8 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
         : evaluateOccupancyWriteGate(effectiveRoot, {
             sessionId: actor?.sessionId,
-            // Payload-supported hosts must not fall back to a stale ambient owner.
-            env: actor?.payloadAuthoritative === true ? {} : environ,
+            // Hosts with a resolved owner must not fall back to a stale ambient one.
+            env: actor?.hostAuthoritative === true ? {} : environ,
         });
     // #3769: occupancy decides before any ritual persist. The gated verifier
     // executes agent_hooks and rebinds a forward HEAD, and both rewrite
@@ -907,7 +1002,7 @@ function inspectMutationGates(input, toolName, seams, options) {
             return null;
         const finalOccupancy = evaluateOccupancyWriteGate(effectiveRoot, {
             sessionId: actor.sessionId,
-            env: actor.payloadAuthoritative ? {} : environ,
+            env: actor.hostAuthoritative ? {} : environ,
             refresh: true,
         });
         occupancyWarning = finalOccupancy.warning;
@@ -941,15 +1036,15 @@ function inspectMutationGates(input, toolName, seams, options) {
     };
     const withOccupancyWarning = (message) => occupancyWarning === null ? message : `${message} ${occupancyWarning}`;
     if (options.proposedLifecycleExempt) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        if (isProposedLifecycleWrite(effectiveRoot, writeTarget)) {
-            const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        if (allMutationTargetsAreProposedLifecycleWrites(effectiveRoot, input.payload)) {
             // UAT still allows xbrief/proposed/** as evidence/defect capture (#2944).
-            const authzDeny = authzForMutation(input, toolName, seams, {
+            // Authz and the write fence run on every mutated path, not the declared
+            // one (#3614).
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
                 runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -993,7 +1088,9 @@ function inspectMutationGates(input, toolName, seams, options) {
         // worktree that lives outside the payload root keeps today's skip. Worktrees
         // under the payload root -- `.deft-scratch/worktrees/`, the swarm layout --
         // are inside it and are now gated on their own active scope.
-        const outsideRoot = writeTarget !== null && isOutsideProjectRootWrite(projectRoot, writeTarget);
+        const mutationTargets = hookMutationTargetPaths(input.payload);
+        const outsideRoot = mutationTargets.length > 0 &&
+            mutationTargets.every((target) => isOutsideProjectRootWrite(projectRoot, target));
         if (!outsideRoot || isSpawnTool(toolName)) {
             let proposedPathHint;
             if (isSpawnTool(toolName)) {
@@ -1054,14 +1151,12 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
     }
     if (!isSpawnTool(toolName)) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
         // Wave 1 authz (UAT lease + human-origin grant) before runtimeAuthority (#2944 / #2948 L1–L2).
-        const authzDeny = authzForMutation(input, toolName, seams, {
+        const authzDeny = authzForMutationTargets(input, toolName, seams, {
             isDirectWrite: true,
-            relPath,
             scopePath: scope.path,
             runGit: dispatchGit,
+            projectRoot,
         });
         if (authzDeny !== null)
             return authzDeny;
@@ -1083,11 +1178,106 @@ function inspectMutationGates(input, toolName, seams, options) {
         scopePath: scope.path,
     };
 }
+function gitDestructiveIsFixture(form, projectRoot) {
+    if (form.unprovable || form.relocators.length === 0)
+        return false;
+    return form.relocators.every((raw) => {
+        const path = raw.trim();
+        if (path.length === 0 || !isAbsolute(path))
+            return false;
+        return isOutsideProjectRootWrite(projectRoot, path);
+    });
+}
+const GIT_DESTRUCTIVE_REMEDIATION = "Tree-wide destructive git (reset --hard, clean -f, checkout -f / switch -f, " +
+    "stash drop/clear) is fail-closed when aimed at this checkout. Rewrite as a " +
+    "non-destructive command, or run it against an absolute out-of-root fixture " +
+    "(`git -C /abs/fixture reset --hard`). This is a guard, not a root-cause claim.";
+/**
+ * Always-on recognition for tree-wide destructive git (#3917). Independent of
+ * `shellDestForms`. Records a durable JSONL line outside the repository so the
+ * next occurrence names its actor even if reflogs are gone.
+ */
+function decideGitDestructive(input, toolName) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const forms = classifyGitDestructive(command);
+    if (forms.length === 0)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    const env = input.environ ?? process.env;
+    const actor = env.DEFT_SESSION_ID?.trim() || env.GROK_SESSION_ID?.trim() || "";
+    const logPath = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim() || undefined;
+    let anyProjectAimed = false;
+    for (const form of forms) {
+        const fixture = gitDestructiveIsFixture(form, projectRoot);
+        if (!fixture)
+            anyProjectAimed = true;
+        appendGitDestructiveRecord({
+            ts: new Date().toISOString(),
+            kind: form.kind,
+            disposition: fixture ? "allow-fixture" : "deny",
+            command,
+            projectRoot,
+            host: input.host,
+            toolName,
+            actor,
+            pid: process.pid,
+            relocators: form.relocators,
+            unprovable: form.unprovable,
+        }, { env, logPath });
+    }
+    if (!anyProjectAimed) {
+        return {
+            verdict: "allow",
+            code: "git-destructive-fixture",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `Directive allowed ${toolName}: destructive git is aimed at an out-of-root fixture.`,
+            scopePath: null,
+        };
+    }
+    return deny(input, "git-destructive-deny", toolName, `Directive denied ${toolName}: ${GIT_DESTRUCTIVE_REMEDIATION}`);
+}
+/**
+ * Authorize recognized in-repo Shell file-write dests through inspectMutationGates (#3983 / #3987).
+ * Deny is returned; allow falls through so dest-forms and push/merge still run.
+ */
+function decideShellWriteReissue(input, toolName, seams, observation) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    for (const dest of classifyShellWriteTargets(command)) {
+        if (dest.unprovable === true) {
+            if (!isInRepoShellWritePath(projectRoot, dest.path))
+                continue;
+            return deny(input, "scope-not-ready", toolName, "Directive denied " +
+                toolName +
+                ": Shell write dest is not reconstructable (compound command). Use one simple command or Edit/Write.");
+        }
+        if (!isInRepoShellWritePath(projectRoot, dest.path))
+            continue;
+        const destInput = {
+            ...input,
+            payload: payloadWithInjectedWriteTarget(input.payload, dest.path),
+        };
+        const destDecision = inspectMutationGates(destInput, toolName, seams, {
+            proposedLifecycleExempt: true,
+            observation,
+        });
+        if (destDecision.verdict === "deny")
+            return destDecision;
+    }
+    return null;
+}
 /**
  * Route recognized Shell dest-forms through inspectMutationGates, then push/merge.
  * Dest-form allow is kept when runtime authority has nothing classifiable.
  */
-function decideShellDestFormsThenRuntimeAuthority(input, toolName, seams) {
+function decideShellDestFormsThenRuntimeAuthority(input, toolName, seams, observation) {
     const command = hookShellCommand(input.payload);
     let destAllow = null;
     let expansionDeny = null;
@@ -1119,6 +1309,7 @@ function decideShellDestFormsThenRuntimeAuthority(input, toolName, seams) {
             };
             const destDecision = inspectMutationGates(destInput, toolName, seams, {
                 proposedLifecycleExempt: true,
+                observation,
             });
             if (destDecision.verdict === "deny")
                 return destDecision;
@@ -1205,6 +1396,18 @@ function lifecycleExecutionRootCheck(payload, projectRoot, realpath, platform) {
     }
     return { aligned: true, message: "execution directory is project-root aligned" };
 }
+/**
+ * Hosts whose PreToolUse wire format can carry a rewritten tool input.
+ *
+ * `renderHostDecision` reads the same list, so the bridge cannot offer -- or
+ * deny on behalf of -- a delivery channel a host does not have (#3873). A host
+ * outside it binds its claim in the CLI instead: `resolveOccupancySessionId`
+ * resolves the same ambient host owner the write gate will present.
+ */
+const UPDATED_INPUT_WIRE_HOSTS = ["codex", "claude", "cursor"];
+function hostAcceptsUpdatedInput(host) {
+    return UPDATED_INPUT_WIRE_HOSTS.includes(host);
+}
 /**
  * Add the claim-time owner only after the existing shell decision allowed the
  * command. The host wire format must emit `allow` with updated input, so this
@@ -1213,6 +1416,8 @@ function lifecycleExecutionRootCheck(payload, projectRoot, realpath, platform) {
 function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
     if (decision.verdict !== "allow")
         return decision;
+    if (!hostAcceptsUpdatedInput(input.host))
+        return decision;
     const lifecycle = inspectExactLifecycleCommand(input.payload);
     if (lifecycle === null)
         return decision;
@@ -1222,15 +1427,20 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
         return deny(input, "occupancy-identity-conflict", toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
             "--session-id is empty, duplicated, or otherwise ambiguous.");
     }
-    const identity = resolveHookHostIdentity(input.host, input.payload);
-    if (identity.status === "unsupported")
+    const identity = resolveHookHostIdentity(input.host, input.payload, input.environ ?? process.env);
+    // #3873: an absent host-env variable is the pre-#3873 explicit-owner flow, not
+    // a broken contract. Claim binding is skipped, the command keeps ordinary host
+    // permission handling, and any owner it carries is still its own.
+    if (identity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, identity)) {
         return decision;
+    }
     if (identity.status !== "ok" || identity.sessionId === null) {
         const code = identity.status === "conflict"
             ? "occupancy-identity-conflict"
             : "occupancy-identity-unavailable";
         return deny(input, code, toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
-            `${identity.message ?? "host payload identity is unavailable"}. ` +
+            `${identity.message ?? "host session identity is unavailable"}. ` +
             "Directive cannot bind the occupancy claim without a stable host owner; " +
             "manual callers must pass --session-id explicitly outside the host rewrite path.");
     }
@@ -1238,12 +1448,12 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
     if (environmentId !== undefined &&
         environmentId.length > 0 &&
         environmentId !== identity.sessionId) {
-        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: host payload owner ${identity.sessionId} conflicts with ` +
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: host owner ${identity.sessionId} conflicts with ` +
             `DEFT_SESSION_ID ${environmentId}; refusing an auto-approved lifecycle rewrite.`);
     }
     if (lifecycle.sessionIdStatus === "present" && lifecycle.sessionId !== identity.sessionId) {
         return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: lifecycle command ${lifecycle.verb} names ` +
-            `${lifecycle.sessionId ?? "<missing>"}, but the host payload owner is ` +
+            `${lifecycle.sessionId ?? "<missing>"}, but the host owner is ` +
             `${identity.sessionId}.`);
     }
     const sourceTask = !lifecycle.task ||
@@ -1276,8 +1486,55 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
     }
     return { ...decision, updatedInput: rewrite.updatedInput };
 }
+/**
+ * Renew the owner's occupancy lease from a hook event that already proved the
+ * owner is present (#3987).
+ *
+ * Deliberately runs AFTER the decision and never feeds it. Two reasons: a
+ * liveness re-stamp must not be able to change a verdict, and re-stamping first
+ * would reset the shared age floor and so suppress the mutation gate's own
+ * `markWrite = true` refresh — leaving an actively-writing owner recorded as
+ * having no recorded write. Failure is swallowed: liveness is bookkeeping, and
+ * a lease that cannot be renewed simply ages out as it did before.
+ */
+function restampOwnerLiveness(input, seams, observation) {
+    if (input.event !== "tool.before")
+        return;
+    // A refused admission proves no tree at all, so there is nothing to renew.
+    if (observation.foreignTarget)
+        return;
+    try {
+        const actor = resolveMutationActor(input, input.environ ?? process.env);
+        const restamp = seams.restampOwnerLiveness ?? restampOwnerLivenessOnHookEvent;
+        // The trees occupancy was authorized against, not the payload root. Each
+        // was admitted on its own, so each is renewed on its own.
+        const roots = observation.effectiveRoots.length > 0
+            ? observation.effectiveRoots
+            : [resolve(input.projectRoot)];
+        for (const projectRoot of roots) {
+            restamp({
+                projectRoot,
+                ownerSessionId: actor.sessionId,
+                hostAuthoritative: actor.hostAuthoritative && actor.issue === null,
+            });
+        }
+    }
+    catch {
+        /* liveness is best-effort bookkeeping; never let it affect a verdict */
+    }
+}
 /** Decide a normalized event using only the P0 direct-write policy. */
 export function decideHook(input, seams = {}) {
+    const observation = { effectiveRoots: [], foreignTarget: false };
+    const decision = routeHookDecision(input, seams, observation);
+    // Skipped for the #3039 kill-switch and #2926 opt-out, which short-circuit
+    // before any Directive enforcement runs — including this bookkeeping.
+    if (decision.code !== "directive-disabled" && decision.code !== "session-start-disabled") {
+        restampOwnerLiveness(input, seams, observation);
+    }
+    return decision;
+}
+function routeHookDecision(input, seams, observation) {
     const projectRoot = resolve(input.projectRoot);
     // #3039: local (untracked) `.deft-directive-disable` wins for enforcement
     // short-circuit (SessionStart / compact / PreToolUse). Deposit may remain.
@@ -1470,13 +1727,25 @@ export function decideHook(input, seams = {}) {
                 scopePath: null,
             };
         }
-        return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: false });
+        return inspectMutationGates(input, toolName, seams, {
+            proposedLifecycleExempt: false,
+            observation,
+        });
     }
-    // Shell dest-forms (#3438): recognized product mutations share inspectMutationGates
+    // Tree-wide destructive git (#3917): always-on, independent of shellDestForms.
+    // Dest-forms (#3438): recognized product mutations share inspectMutationGates
     // with Edit/Write (assist/scratch, proposed lifecycle, file_scope). Push/merge stay
     // on runtimeAuthority (#2711). Non-dest unclassifiable shell (git status) fail-open.
     if (isShellTool(toolName)) {
-        const decision = decideShellDestFormsThenRuntimeAuthority(input, toolName, seams);
+        const destructive = decideGitDestructive(input, toolName);
+        if (destructive !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, destructive, seams);
+        }
+        const writeReissue = decideShellWriteReissue(input, toolName, seams, observation);
+        if (writeReissue !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, writeReissue, seams);
+        }
+        const decision = decideShellDestFormsThenRuntimeAuthority(input, toolName, seams, observation);
         return attachLifecycleIdentityRewrite(input, toolName, decision, seams);
     }
     // Classifiable MCP: enforce scopes.push / scopes.merge (#2711).
@@ -1497,7 +1766,10 @@ export function decideHook(input, seams = {}) {
             scopePath: null,
         };
     }
-    return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: true });
+    return inspectMutationGates(input, toolName, seams, {
+        proposedLifecycleExempt: true,
+        observation,
+    });
 }
 /**
  * Soft AGENTS re-bind text for host injection when decision carries soft path (#3171).
@@ -1532,7 +1804,9 @@ function softAgentsRebindWireText(decision) {
  */
 export function renderHostDecision(host, decision) {
     if (decision.verdict === "allow") {
-        if (decision.event === "tool.before" && decision.updatedInput !== undefined) {
+        if (decision.event === "tool.before" &&
+            decision.updatedInput !== undefined &&
+            hostAcceptsUpdatedInput(host)) {
             if (host === "cursor") {
                 return JSON.stringify({
                     permission: "allow",
@@ -1540,15 +1814,13 @@ export function renderHostDecision(host, decision) {
                     updated_input: decision.updatedInput,
                 });
             }
-            if (host === "claude" || host === "codex") {
-                return JSON.stringify({
-                    hookSpecificOutput: {
-                        hookEventName: "PreToolUse",
-                        permissionDecision: "allow",
-                        updatedInput: decision.updatedInput,
-                    },
-                });
-            }
+            return JSON.stringify({
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "allow",
+                    updatedInput: decision.updatedInput,
+                },
+            });
         }
         const soft = softAgentsRebindWireText(decision);
         if (host === "cursor") {

package/dist/hooks/fixtures/cases.d.ts

@@ -19,6 +19,12 @@ export interface HookFixtureCase {
     readonly payload?: unknown;
     /** Raw stdin when testing BOM / free-form ApplyPatch parse. */
     readonly raw?: string;
+    /**
+     * Hook process environment for `host-env` identity providers (#3873).
+     * Identity assertions resolve against this instead of the ambient
+     * environment, so a corpus case cannot pass or fail by where it runs.
+     */
+    readonly environ?: Readonly<Record<string, string>>;
     readonly expected: {
         readonly toolName: string | null;
         readonly writeIntent: HookWriteIntent;