@deftai/directive-core 0.108.0 → 0.109.1

package/dist/hooks/fixtures/cases.js

@@ -702,6 +702,59 @@ export const HOOK_FIXTURE_CASES = [
             hostIdentity: { status: "invalid", sessionId: null },
         },
     },
+    // --- Host-env session identity (#3873) ---
+    {
+        // The claim side of the loop: without this rewrite the lease is claimed
+        // under a minted UUID that the later write gate can never present.
+        id: "grok-posix-shell-host-env-lifecycle-rewrite",
+        host: "grok",
+        os: "posix",
+        tool: "Shell",
+        regression: ["#3873", "#3611"],
+        payload: {
+            tool_name: "Bash",
+            tool_input: { command: "deft session:start" },
+        },
+        environ: { GROK_SESSION_ID: "grok-session-a" },
+        expected: {
+            toolName: "Bash",
+            writeIntent: "shell",
+            writeTargetPath: null,
+            hostIdentity: {
+                status: "ok",
+                sessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+            },
+            lifecycle: {
+                verb: "session:start",
+                requestedSessionId: "host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                resultKind: "rewrite",
+                rewrittenCommand: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                updatedInput: {
+                    command: "deft session:start --session-id=host:grok:v1:Z3Jvay1zZXNzaW9uLWE",
+                },
+            },
+        },
+    },
+    {
+        id: "grok-posix-write-payload-session-id-untrusted",
+        host: "grok",
+        os: "posix",
+        tool: "Write",
+        regression: ["#3873"],
+        payload: {
+            tool_name: "Write",
+            session_id: "payload-owner",
+            tool_input: { content: "x", file_path: "src/app.ts" },
+        },
+        environ: {},
+        expected: {
+            toolName: "Write",
+            writeIntent: "direct-write",
+            writeTargetPath: "src/app.ts",
+            hostIdentity: { status: "missing", sessionId: null },
+        },
+        notes: "Grok's payload session_id contract is unverified; only the host variable is read",
+    },
     // --- Regression: empty / missing tool name ---
     {
         id: "cursor-posix-stdin-empty",

package/dist/hooks/git-destructive-log.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import type { GitDestructiveKind } from "./dest-form.js";
+export declare const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export type GitDestructiveDisposition = "deny" | "allow-fixture";
+export interface GitDestructiveRecord {
+    readonly ts: string;
+    readonly kind: GitDestructiveKind;
+    readonly disposition: GitDestructiveDisposition;
+    readonly command: string;
+    readonly projectRoot: string;
+    readonly host: string;
+    readonly toolName: string | null;
+    readonly actor: string;
+    readonly pid: number;
+    readonly relocators: readonly string[];
+    readonly unprovable: boolean;
+}
+export declare function resolveGitDestructiveLogPath(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDir?: string): string;
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export declare function appendGitDestructiveRecord(record: GitDestructiveRecord, options?: {
+    readonly logPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly append?: (path: string, line: string) => void;
+}): void;
+//# sourceMappingURL=git-destructive-log.d.ts.map

package/dist/hooks/git-destructive-log.js

@@ -0,0 +1,46 @@
+/**
+ * Durable attribution log for tree-wide destructive git at the write fence (#3917).
+ *
+ * Lives outside the repository so a `reset --hard` or a worktree prune cannot
+ * erase it. This is detection, not a root-cause claim.
+ */
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { platformUserConfigDir } from "../user-config/resolve-user-md.js";
+export const GIT_DESTRUCTIVE_LOG_ENV = "DEFT_GIT_DESTRUCTIVE_LOG";
+export function resolveGitDestructiveLogPath(env = process.env, platform = process.platform, homeDir = homedir()) {
+    const override = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim();
+    if (override !== undefined && override.length > 0) {
+        return resolve(override);
+    }
+    return join(platformUserConfigDir(platform, env, homeDir), "logs", "git-destructive.jsonl");
+}
+function defaultAppend(path, line) {
+    const targetAbs = resolve(path);
+    const parent = dirname(targetAbs);
+    mkdirSync(parent, { recursive: true });
+    containedWrite({
+        root: parent,
+        target: targetAbs,
+        data: line,
+        mode: "append",
+        mkdir: false,
+        mutation: false,
+    });
+}
+/**
+ * Best-effort append. A log failure must not block the deny.
+ */
+export function appendGitDestructiveRecord(record, options = {}) {
+    try {
+        const path = options.logPath ?? resolveGitDestructiveLogPath(options.env ?? process.env);
+        const line = `${JSON.stringify(record)}\n`;
+        (options.append ?? defaultAppend)(path, line);
+    }
+    catch {
+        // Attribution is best-effort; the fail-closed deny still stands.
+    }
+}
+//# sourceMappingURL=git-destructive-log.js.map

package/dist/hooks/index.d.ts

@@ -3,5 +3,8 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
+export * from "./owner-liveness.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/hooks/index.js

@@ -3,5 +3,8 @@ export * from "./cursor-hooks.js";
 export * from "./dest-form.js";
 export * from "./dispatcher.js";
 export * from "./fixtures/index.js";
+export * from "./git-destructive-log.js";
+export * from "./owner-liveness.js";
 export * from "./scope.js";
+export * from "./shell-write-targets.js";
 //# sourceMappingURL=index.js.map

package/dist/hooks/owner-liveness.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Owner liveness on non-write hook activity (#3987).
+ *
+ * The occupancy lease renews on one signal: a gated product write
+ * (`evaluateOccupancyWriteGate`, refresh path, #3599). After #3990 widened the
+ * PreToolUse matchers, coverage is necessary and still not sufficient, because
+ * eligibility — not coverage — is what keeps shell traffic off that path. Only
+ * five write verbs are recognized, and a dest carrying `$` / `*` / `?`, a temp
+ * path, an out-of-root target, or any compound command is refused before the
+ * gate re-stamps. `cd <root>; <command>` is compound, and the mandated Windows
+ * body-file flow (#2646 / #2744) is compound, `$`-bearing and temp-targeted at
+ * once. So an owner can commit and push all session and still starve its own
+ * lease, which is the data-loss half of #3987.
+ *
+ * The remedy is the one `occupancy.ts` already names in the
+ * `OCCUPANCY_MAX_LEASE_MS` docblock: "refresh on non-write activity". The hook
+ * fires on every matched tool call and resolves the actor from the host
+ * payload, so the owner's presence is already proven there — no new identity
+ * has to travel anywhere.
+ *
+ * Bounds, each one load-bearing (5471374558 F4):
+ *
+ * - Host-authoritative actor only. An ambient inherited `DEFT_SESSION_ID` is
+ *   never enough. On Grok the owner id is a hook-sibling variable, and
+ *   publishing it so an agent shell could present it would hand lease renewal
+ *   to every descendant process — the widening the arc withdrew.
+ * - Owner only, via `heartbeatOccupancy`: it never claims, never mints, never
+ *   resurrects, and refuses a foreign or expired lease. Reusing it keeps one
+ *   renewal path with one set of refusal semantics.
+ * - `markWrite` stays false, so `last_write_at` still means "a product write
+ *   was recorded" and `no recorded write` stays honest for a would-be stealer.
+ * - Keyed on the lease's own worktree path, so a record describing another tree
+ *   is not renewed from this one. The caller supplies the tree the mutation
+ *   gates authorized against — a linked worktree, not the payload root — so a
+ *   worktree write renews the worktree's lease rather than the primary's.
+ * - `claimed_at` is untouched, so `OCCUPANCY_MAX_LEASE_MS` — 12 hours — is
+ *   unmoved. Liveness renewal cannot outlive the absolute cap.
+ * - Runs after the decision, never as an input to it. A liveness re-stamp must
+ *   not change any verdict, and re-stamping before the mutation gates would
+ *   suppress their own `markWrite = true` refresh by resetting the age floor.
+ *
+ * Bound this deliberately does not cross: a call with no write target proves
+ * only the tree the host named. `projectRootFromHookPayload` takes that from
+ * the payload's own `cwd`-class fields, so a session working inside a linked
+ * worktree names the worktree and renews it; a session whose host reports the
+ * primary checkout renews the primary. When those differ and nothing in the
+ * payload says which tree the work is in, this renews neither by guessing —
+ * keeping a lease alive for a tree nobody occupies is a widening, not a fix,
+ * and the TTL reclaiming an unused tree is the behaviour the lease exists for.
+ * `deft occupancy:heartbeat --session-id <owner>` stays the explicit path for
+ * a session whose tree the host does not report.
+ */
+import type { LockDeps } from "../slice/lock.js";
+export type OwnerLivenessSkipReason = 
+/** No host-authoritative owner resolved; ambient identity is not accepted. */
+"no-host-authoritative-owner"
+/** Nothing to renew: no lease, or the lease is expired or age-capped. */
+ | "no-live-lease"
+/** A lease exists but this actor is not its owner. */
+ | "not-owner"
+/** The lease record describes a different worktree than the one hooked. */
+ | "foreign-worktree"
+/** Younger than the shared re-stamp floor; renewing would rewrite per keystroke. */
+ | "within-refresh-floor"
+/** The lock was busy or the lease changed under us; the lease is left alone. */
+ | "refresh-unavailable";
+export type OwnerLivenessOutcome = {
+    readonly restamped: true;
+    readonly sessionId: string;
+    readonly heartbeatAt: Date;
+} | {
+    readonly restamped: false;
+    readonly reason: OwnerLivenessSkipReason;
+};
+export interface OwnerLivenessInput {
+    /** Tree the hook fired against; also the tree whose lease may be renewed. */
+    readonly projectRoot: string;
+    /** Owner id the host payload resolved to, or undefined when none did. */
+    readonly ownerSessionId: string | undefined;
+    /** False for ambient/environment identity — such an actor never renews. */
+    readonly hostAuthoritative: boolean;
+    readonly now?: Date;
+    readonly lockDeps?: LockDeps;
+}
+/**
+ * Renew the owner's lease from a hook event that proved the owner is alive.
+ *
+ * Pure side effect on `occupancy.json`: the caller's decision is already made
+ * and this never alters it. Every refusal path leaves the lease untouched.
+ */
+export declare function restampOwnerLivenessOnHookEvent(input: OwnerLivenessInput): OwnerLivenessOutcome;
+//# sourceMappingURL=owner-liveness.d.ts.map

package/dist/hooks/owner-liveness.js

@@ -0,0 +1,103 @@
+/**
+ * Owner liveness on non-write hook activity (#3987).
+ *
+ * The occupancy lease renews on one signal: a gated product write
+ * (`evaluateOccupancyWriteGate`, refresh path, #3599). After #3990 widened the
+ * PreToolUse matchers, coverage is necessary and still not sufficient, because
+ * eligibility — not coverage — is what keeps shell traffic off that path. Only
+ * five write verbs are recognized, and a dest carrying `$` / `*` / `?`, a temp
+ * path, an out-of-root target, or any compound command is refused before the
+ * gate re-stamps. `cd <root>; <command>` is compound, and the mandated Windows
+ * body-file flow (#2646 / #2744) is compound, `$`-bearing and temp-targeted at
+ * once. So an owner can commit and push all session and still starve its own
+ * lease, which is the data-loss half of #3987.
+ *
+ * The remedy is the one `occupancy.ts` already names in the
+ * `OCCUPANCY_MAX_LEASE_MS` docblock: "refresh on non-write activity". The hook
+ * fires on every matched tool call and resolves the actor from the host
+ * payload, so the owner's presence is already proven there — no new identity
+ * has to travel anywhere.
+ *
+ * Bounds, each one load-bearing (5471374558 F4):
+ *
+ * - Host-authoritative actor only. An ambient inherited `DEFT_SESSION_ID` is
+ *   never enough. On Grok the owner id is a hook-sibling variable, and
+ *   publishing it so an agent shell could present it would hand lease renewal
+ *   to every descendant process — the widening the arc withdrew.
+ * - Owner only, via `heartbeatOccupancy`: it never claims, never mints, never
+ *   resurrects, and refuses a foreign or expired lease. Reusing it keeps one
+ *   renewal path with one set of refusal semantics.
+ * - `markWrite` stays false, so `last_write_at` still means "a product write
+ *   was recorded" and `no recorded write` stays honest for a would-be stealer.
+ * - Keyed on the lease's own worktree path, so a record describing another tree
+ *   is not renewed from this one. The caller supplies the tree the mutation
+ *   gates authorized against — a linked worktree, not the payload root — so a
+ *   worktree write renews the worktree's lease rather than the primary's.
+ * - `claimed_at` is untouched, so `OCCUPANCY_MAX_LEASE_MS` — 12 hours — is
+ *   unmoved. Liveness renewal cannot outlive the absolute cap.
+ * - Runs after the decision, never as an input to it. A liveness re-stamp must
+ *   not change any verdict, and re-stamping before the mutation gates would
+ *   suppress their own `markWrite = true` refresh by resetting the age floor.
+ *
+ * Bound this deliberately does not cross: a call with no write target proves
+ * only the tree the host named. `projectRootFromHookPayload` takes that from
+ * the payload's own `cwd`-class fields, so a session working inside a linked
+ * worktree names the worktree and renews it; a session whose host reports the
+ * primary checkout renews the primary. When those differ and nothing in the
+ * payload says which tree the work is in, this renews neither by guessing —
+ * keeping a lease alive for a tree nobody occupies is a widening, not a fix,
+ * and the TTL reclaiming an unused tree is the behaviour the lease exists for.
+ * `deft occupancy:heartbeat --session-id <owner>` stays the explicit path for
+ * a session whose tree the host does not report.
+ */
+import { resolve } from "node:path";
+import { heartbeatOccupancy, isOccupancyExpired, OCCUPANCY_REFRESH_AFTER_MS, readOccupancy, } from "../session/occupancy.js";
+function skip(reason) {
+    return { restamped: false, reason };
+}
+/**
+ * Renew the owner's lease from a hook event that proved the owner is alive.
+ *
+ * Pure side effect on `occupancy.json`: the caller's decision is already made
+ * and this never alters it. Every refusal path leaves the lease untouched.
+ */
+export function restampOwnerLivenessOnHookEvent(input) {
+    if (!input.hostAuthoritative)
+        return skip("no-host-authoritative-owner");
+    const owner = input.ownerSessionId?.trim() ?? "";
+    if (owner.length === 0)
+        return skip("no-host-authoritative-owner");
+    const root = resolve(input.projectRoot);
+    const now = input.now ?? new Date();
+    const record = readOccupancy(root);
+    if (record === null || isOccupancyExpired(record, now))
+        return skip("no-live-lease");
+    // Owner only. A granted member's presence is not the owner's presence, and
+    // `heartbeatOccupancy` refuses it anyway — checking here keeps the reason honest.
+    if (record.sessionId !== owner)
+        return skip("not-owner");
+    if (resolve(record.worktreePath) !== root)
+        return skip("foreign-worktree");
+    // Same floor the write gate uses, for the same reason: the hook runs on a
+    // large fraction of tool calls, so an unconditional renew would rewrite the
+    // lease file continuously without lengthening the safe window at all.
+    if (now.getTime() - record.heartbeatAt.getTime() < OCCUPANCY_REFRESH_AFTER_MS) {
+        return skip("within-refresh-floor");
+    }
+    const beat = heartbeatOccupancy(root, {
+        sessionId: owner,
+        // Never fall back to an ambient owner: the resolved host identity is the
+        // only thing that proves who is here.
+        env: {},
+        now,
+        lockDeps: input.lockDeps,
+    });
+    if (beat.code !== 0 || beat.record === null)
+        return skip("refresh-unavailable");
+    return {
+        restamped: true,
+        sessionId: beat.record.sessionId,
+        heartbeatAt: beat.record.heartbeatAt,
+    };
+}
+//# sourceMappingURL=owner-liveness.js.map

package/dist/hooks/shell-write-targets.d.ts

@@ -0,0 +1,10 @@
+export declare const SHELL_WRITE_KINDS: readonly ["set-content", "out-file", "add-content", "python-pathlib", "io-writealltext"];
+export type ShellWriteKind = (typeof SHELL_WRITE_KINDS)[number];
+export interface ShellWriteTarget {
+    readonly kind: ShellWriteKind;
+    readonly path: string;
+    readonly unprovable?: boolean;
+}
+export declare function classifyShellWriteTargets(command: string): ShellWriteTarget[];
+export declare function isInRepoShellWritePath(projectRoot: string, dest: string): boolean;
+//# sourceMappingURL=shell-write-targets.d.ts.map

package/dist/hooks/shell-write-targets.js

@@ -0,0 +1,274 @@
+/** Recognized in-repo Shell file-write dests (#3983 / #3987). */
+import { isAbsolute, relative, resolve } from "node:path";
+export const SHELL_WRITE_KINDS = [
+    "set-content",
+    "out-file",
+    "add-content",
+    "python-pathlib",
+    "io-writealltext",
+];
+const DQ = String.fromCharCode(34);
+const AQ = String.fromCharCode(39);
+function stripQuotes(token) {
+    const t = token.trim();
+    if (t.length < 2)
+        return t;
+    const a = t[0];
+    const b = t[t.length - 1];
+    if ((a === DQ && b === DQ) || (a === AQ && b === AQ))
+        return t.slice(1, -1);
+    return t;
+}
+function pushUnique(out, kind, raw) {
+    const path = stripQuotes(raw).trim();
+    if (path.length === 0)
+        return;
+    if (out.some((d) => d.kind === kind && d.path === path))
+        return;
+    out.push({ kind, path });
+}
+function extractQuoted(command, start) {
+    if (start >= command.length)
+        return { value: "", next: start };
+    const q = command[start];
+    if (q !== DQ && q !== AQ) {
+        let i = start;
+        while (i < command.length) {
+            const c = command[i];
+            if (c === undefined)
+                break;
+            if (c === " " || c === "	" || c === "," || c === ")")
+                break;
+            i += 1;
+        }
+        return { value: command.slice(start, i), next: i };
+    }
+    let i = start + 1;
+    while (i < command.length && command[i] !== q)
+        i += 1;
+    return { value: command.slice(start + 1, i), next: i + 1 };
+}
+function skipWs(command, start) {
+    let i = start;
+    while (i < command.length) {
+        const code = command.charCodeAt(i);
+        if (code !== 32 && code !== 9 && code !== 10 && code !== 13)
+            break;
+        i += 1;
+    }
+    return i;
+}
+function startsWithVerb(segment, verb) {
+    const i = skipWs(segment, 0);
+    if (segment.slice(i, i + verb.length).toLowerCase() !== verb.toLowerCase())
+        return false;
+    const next = segment[i + verb.length];
+    return next === undefined || next === " " || next === "	" || next === "-";
+}
+function splitWriteSegments(command) {
+    const segs = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        if (c === DQ || c === AQ) {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        const code = command.charCodeAt(i);
+        const next = command.charCodeAt(i + 1);
+        if ((code === 38 && next === 38) || (code === 124 && next === 124)) {
+            segs.push(cur);
+            cur = "";
+            i += 1;
+            continue;
+        }
+        if (code === 124 || code === 38 || code === 59 || code === 10 || code === 13) {
+            segs.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segs.push(cur);
+    return segs.map((seg) => seg.trim()).filter((seg) => seg.length > 0);
+}
+const PATH_PARAM_NAMES = ["path", "literalpath", "filepath"];
+function uniqueNamedParam(flag, names) {
+    const f = flag.replace(/^-+/, "").toLowerCase();
+    if (f.length === 0)
+        return null;
+    const hits = names.filter((n) => n.startsWith(f));
+    return hits.length === 1 ? (hits[0] ?? null) : null;
+}
+function parseFlag(token) {
+    if (!token.startsWith("-"))
+        return null;
+    const colon = token.indexOf(":");
+    if (colon <= 0)
+        return { flag: token, attached: null };
+    return { flag: token.slice(0, colon), attached: token.slice(colon + 1) };
+}
+function extractAfterVerb(command, verb, kind, out) {
+    if (!startsWithVerb(command, verb))
+        return;
+    const i = skipWs(command, 0);
+    let j = skipWs(command, i + verb.length);
+    let named = null;
+    let positional = null;
+    while (j < command.length) {
+        const extracted = extractQuoted(command, j);
+        if (extracted.value.length === 0)
+            break;
+        j = skipWs(command, extracted.next);
+        const parsed = parseFlag(extracted.value);
+        if (parsed === null) {
+            if (positional === null)
+                positional = extracted.value;
+            continue;
+        }
+        let arg = parsed.attached;
+        if (arg === null || arg.length === 0) {
+            const next = extractQuoted(command, j);
+            if (next.value.length > 0 && !next.value.startsWith("-")) {
+                arg = next.value;
+                j = skipWs(command, next.next);
+            }
+            else {
+                arg = null;
+            }
+        }
+        if (uniqueNamedParam(parsed.flag, PATH_PARAM_NAMES) !== null) {
+            if (arg !== null && arg.length > 0 && !arg.startsWith("-"))
+                named = arg;
+        }
+    }
+    const dest = named ?? positional;
+    if (dest !== null && !dest.startsWith("-"))
+        pushUnique(out, kind, dest);
+}
+function pathlibWriteFollows(command, afterPathArgs) {
+    let i = skipWs(command, afterPathArgs);
+    if (command[i] === ")")
+        i = skipWs(command, i + 1);
+    while (i < command.length) {
+        if (command[i] === ";")
+            return false;
+        i = skipWs(command, i);
+        if (command[i] !== ".")
+            return false;
+        i += 1;
+        const start = i;
+        while (i < command.length) {
+            const c = command.charCodeAt(i);
+            if ((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95) {
+                i += 1;
+                continue;
+            }
+            break;
+        }
+        const name = command.slice(start, i);
+        i = skipWs(command, i);
+        if (command[i] !== "(")
+            return false;
+        if (name === "write_text")
+            return true;
+        if (name === "write_bytes")
+            return true;
+        i += 1;
+        let depth = 1;
+        while (i < command.length && depth > 0) {
+            const ch = command[i];
+            if (ch === "(")
+                depth += 1;
+            else if (ch === ")")
+                depth -= 1;
+            i += 1;
+        }
+    }
+    return false;
+}
+function extractPythonPathlib(command, out) {
+    const i = skipWs(command, 0);
+    const head = command.slice(i, i + 10).toLowerCase();
+    if (!head.startsWith("python") && !head.startsWith("py ") && !head.startsWith("py.exe"))
+        return;
+    const needle = "Path(";
+    let from = i;
+    while (from < command.length) {
+        const at = command.indexOf(needle, from);
+        if (at < 0)
+            return;
+        let j = skipWs(command, at + needle.length);
+        const ch = command[j];
+        if (ch === "r" || ch === "R")
+            j = skipWs(command, j + 1);
+        const extracted = extractQuoted(command, j);
+        if (pathlibWriteFollows(command, extracted.next)) {
+            pushUnique(out, "python-pathlib", extracted.value);
+        }
+        from = at + needle.length;
+    }
+}
+function extractIoWrite(command, out) {
+    const i = skipWs(command, 0);
+    if (command[i] !== "[")
+        return;
+    const needles = ["WriteAllText(", "WriteAllBytes("];
+    for (const needle of needles) {
+        const at = command.indexOf(needle, i);
+        if (at < 0)
+            continue;
+        const j = skipWs(command, at + needle.length);
+        const extracted = extractQuoted(command, j);
+        pushUnique(out, "io-writealltext", extracted.value);
+    }
+}
+function classifySimpleWrite(command) {
+    const out = [];
+    extractAfterVerb(command, "Set-Content", "set-content", out);
+    extractAfterVerb(command, "Add-Content", "add-content", out);
+    extractAfterVerb(command, "Out-File", "out-file", out);
+    extractPythonPathlib(command, out);
+    extractIoWrite(command, out);
+    return out;
+}
+export function classifyShellWriteTargets(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitWriteSegments(cmd);
+    if (segments.length === 1)
+        return classifySimpleWrite(segments[0] ?? cmd);
+    const found = [];
+    for (const seg of segments)
+        found.push(...classifySimpleWrite(seg));
+    if (found.length === 0)
+        return [];
+    return found.map((d) => ({ ...d, unprovable: true }));
+}
+export function isInRepoShellWritePath(projectRoot, dest) {
+    const path = dest.trim();
+    if (path.length === 0)
+        return false;
+    if (path.includes("*") || path.includes("?") || path.includes("$"))
+        return false;
+    const root = resolve(projectRoot);
+    const abs = isAbsolute(path) ? resolve(path) : resolve(root, path);
+    const rel = relative(root, abs);
+    if (rel.length === 0)
+        return false;
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    return true;
+}
+//# sourceMappingURL=shell-write-targets.js.map