@deftai/directive-core 0.74.0 → 0.75.0

package/dist/scope/vbrief-ref.js

@@ -1,4 +1,4 @@
-import { resolve } from "node:path";
+import { resolve, sep } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
 import { resolveLifecycleArtifactRef, } from "../layout/lifecycle-ref.js";
 import { hasArtifactSuffix, stripArtifactSuffix } from "../layout/resolve.js";
@@ -87,7 +87,7 @@ export function scopeIdsForFilename(filename) {
 export function relativeToVbrief(path, vbriefRoot) {
     const resolved = resolve(path);
     const root = resolve(vbriefRoot);
-    if (!resolved.startsWith(`${root}/`) && resolved !== root) {
+    if (!resolved.startsWith(root + sep) && resolved !== root) {
         return null;
     }
     return resolved.slice(root.length + 1).replace(/\\/g, "/");
@@ -95,7 +95,7 @@ export function relativeToVbrief(path, vbriefRoot) {
 export function canonicalRelpath(filePath, projectRoot) {
     const resolved = resolve(filePath);
     const root = resolve(projectRoot);
-    if (resolved.startsWith(`${root}/`) || resolved === root) {
+    if (resolved.startsWith(root + sep) || resolved === root) {
         return resolved.slice(root.length + (resolved === root ? 0 : 1)).replace(/\\/g, "/");
     }
     return resolved.replace(/\\/g, "/");

package/dist/swarm/complete-cohort.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { detectLifecycleFolder } from "../scope/decomposed-refs.js";
 import { runTransition } from "../scope/transition.js";
@@ -31,13 +31,13 @@ function rel(path, projectRoot) {
     }
 }
 function globResolve(pattern, projectRoot) {
-    const absPattern = pattern.startsWith("/") ? pattern : join(projectRoot, pattern);
+    const absPattern = isAbsolute(pattern) ? pattern : join(projectRoot, pattern);
     if (!absPattern.includes("*")) {
         return existsSync(absPattern) ? [resolve(absPattern)] : [];
     }
-    const slash = absPattern.lastIndexOf("/");
-    const dir = slash >= 0 ? absPattern.slice(0, slash) : projectRoot;
-    const glob = slash >= 0 ? absPattern.slice(slash + 1) : absPattern;
+    // Use path module to split directory/glob parts — platform-safe on both POSIX and Windows.
+    const dir = dirname(absPattern);
+    const glob = basename(absPattern);
     if (!existsSync(dir)) {
         return [];
     }
@@ -59,7 +59,7 @@ export function resolveCohortPaths(positional, cohortGlobs, projectRoot) {
         resolved.push(rp);
     };
     for (const raw of positional) {
-        const candidate = raw.startsWith("/") ? raw : join(projectRoot, raw);
+        const candidate = isAbsolute(raw) ? raw : join(projectRoot, raw);
         if (!existsSync(candidate)) {
             errors.push(`path does not exist: ${raw}`);
             continue;

package/dist/swarm/launch.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, join, resolve } from "node:path";
+import { basename, isAbsolute, join, resolve } from "node:path";
 import { inferGithubAuthMode } from "../intake/github-auth-modes.js";
 import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { hasArtifactSuffix, resolveLifecycleFolder, stripArtifactSuffix, } from "../layout/resolve.js";
@@ -166,7 +166,7 @@ export function looksLikePath(token) {
 }
 function resolveOne(token, projectRoot, idMap, issueMap) {
     if (looksLikePath(token)) {
-        const candidate = token.startsWith("/") ? token : join(projectRoot, token);
+        const candidate = isAbsolute(token) ? token : join(projectRoot, token);
         if (!existsSync(candidate)) {
             return {
                 story: null,

package/dist/triage/queue/cache.d.ts

@@ -1,4 +1,18 @@
 import type { CachedIssue } from "./types.js";
+/** Neutral title shown when the scanner fences injection-shaped title text. */
+export declare const QUARANTINED_TITLE_PLACEHOLDER = "[quarantined title]";
+/**
+ * Read `meta.json` `scan_result.passed` for a cache entry.
+ * Returns `false` when the scanner hard-failed, `true` when it passed, and
+ * `null` when meta is missing/unreadable (legacy or incomplete entries).
+ */
+export declare function readCacheScanPassed(entryDir: string): boolean | null;
+/**
+ * Sanitize a queue title through the cache scanner.
+ * Returns `null` when the title hard-fails (omit the issue); otherwise a
+ * display title that never carries unfenced injection-shaped attacker text.
+ */
+export declare function sanitizeQueueTitle(rawTitle: string): string | null;
 /** Read slices.jsonl records. */
 export declare function resolveSlicesLogPath(options?: {
     readonly slicesLogPath?: string | null;

package/dist/triage/queue/cache.js

@@ -1,10 +1,58 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { scan } from "../../cache/scanner.js";
 import { resolveTriageCachePath } from "../cache-path.js";
 import { extractAuthor, extractMilestone } from "../scope-drift/cache-walker.js";
 import { CACHE_DIR_NAME, CACHE_SOURCE_GITHUB_ISSUE } from "./constants.js";
 import { hasActiveScopeIgnores, isRawIssueScopeIgnored, resolveScopeIgnores, } from "./scope-ignores-filter.js";
 import { blockedByIssueNumber, rankByIssueNumber } from "./scope-walk.js";
+/** Neutral title shown when the scanner fences injection-shaped title text. */
+export const QUARANTINED_TITLE_PLACEHOLDER = "[quarantined title]";
+/**
+ * Read `meta.json` `scan_result.passed` for a cache entry.
+ * Returns `false` when the scanner hard-failed, `true` when it passed, and
+ * `null` when meta is missing/unreadable (legacy or incomplete entries).
+ */
+export function readCacheScanPassed(entryDir) {
+    const metaPath = join(entryDir, "meta.json");
+    if (!existsSync(metaPath)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(metaPath, { encoding: "utf8" }));
+        if (typeof parsed !== "object" || parsed === null) {
+            return null;
+        }
+        const scanResult = parsed.scan_result;
+        if (typeof scanResult !== "object" || scanResult === null) {
+            return null;
+        }
+        const passed = scanResult.passed;
+        return typeof passed === "boolean" ? passed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Sanitize a queue title through the cache scanner.
+ * Returns `null` when the title hard-fails (omit the issue); otherwise a
+ * display title that never carries unfenced injection-shaped attacker text.
+ */
+export function sanitizeQueueTitle(rawTitle) {
+    const result = scan(rawTitle);
+    if (!result.passed) {
+        return null;
+    }
+    if (result.flags.some((flag) => flag.category === "injection-heading")) {
+        return QUARANTINED_TITLE_PLACEHOLDER;
+    }
+    if (result.flags.some((flag) => flag.category === "invisible-unicode")) {
+        const stripped = result.transformed_content.replace(/\r?\n+$/u, "");
+        return stripped.length > 0 ? stripped : QUARANTINED_TITLE_PLACEHOLDER;
+    }
+    return rawTitle;
+}
 function cachedState(issue) {
     if (issue === undefined) {
         return "";
@@ -158,9 +206,21 @@ export function loadCachedIssues(repo, options) {
         if (filterScopeIgnores && isRawIssueScopeIgnored(payload, scopeIgnores)) {
             continue;
         }
+        // Fail closed on scanner hard-fail: cachePut keeps raw.json but suppresses
+        // content.md when scan_result.passed is false. The queue must not promote
+        // those titles into the mandatory triage:queue agent context.
+        const scanPassed = readCacheScanPassed(entryDir);
+        if (scanPassed === false) {
+            continue;
+        }
+        const rawTitle = typeof payload.title === "string" ? payload.title : "";
+        const safeTitle = sanitizeQueueTitle(rawTitle);
+        if (safeTitle === null) {
+            continue;
+        }
         issues.push({
             number: n,
-            title: typeof payload.title === "string" ? payload.title : "",
+            title: safeTitle,
             state,
             labels: parseLabels(payload.labels),
             author: extractAuthor(payload),

package/dist/validate-content/validate-links.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join, relative, resolve, sep } from "node:path";
 import { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 const EXCLUDE_DIRS = new Set([
     ".git",
@@ -55,7 +55,7 @@ function findBrokenLinks(cwd) {
         catch {
             continue;
         }
-        const rel = md.startsWith(`${root}/`) ? md.slice(root.length + 1) : md;
+        const rel = md.startsWith(root + sep) ? relative(root, md) : md;
         const lines = text.split("\n");
         for (let i = 0; i < lines.length; i += 1) {
             const line = lines[i] ?? "";

package/dist/value/readback.d.ts

@@ -71,6 +71,7 @@ export declare function runValueShow(options: {
     format?: "text" | "json";
     logPath?: string | null;
     policyOverride?: ValueFeedbackResolved;
+    now?: Date;
 }): ValueShowResult;
 export interface ValueShowCliArgs {
     window?: string;

package/dist/value/readback.js

@@ -415,7 +415,11 @@ export function runValueShow(options) {
         };
     }
     const windowMs = parseWindowMs(options.window);
-    const trend = computeValueShowTrend(root, { windowMs, logPath: options.logPath });
+    const trend = computeValueShowTrend(root, {
+        windowMs,
+        logPath: options.logPath,
+        now: options.now,
+    });
     const empty = trend.total === 0;
     if (options.format === "json") {
         return {

package/dist/verify-env/toolchain-check.js

@@ -20,16 +20,31 @@ export const CONSUMER_TOOLS = [
 export const TOOLS = MAINTAINER_TOOLS;
 const DEFAULT_TIMEOUT_MS = 10_000;
 export function defaultCommandRunner(command, timeoutMs) {
+    const bin = command[0] ?? "";
+    const args = command.slice(1);
+    const trySpawn = (shell) => childProcess.execFileSync(bin, args, {
+        encoding: "utf8",
+        timeout: timeoutMs,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell,
+    });
     try {
-        const stdout = childProcess.execFileSync(command[0] ?? "", command.slice(1), {
-            encoding: "utf8",
-            timeout: timeoutMs,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        const stdout = trySpawn(false);
         return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
     }
     catch (err) {
         const e = err;
+        // win32: npm global shims are `.cmd` and need shell/PATHEXT (#2467 / #2415).
+        if (e.code === "ENOENT" && process.platform === "win32") {
+            try {
+                const stdout = trySpawn(true);
+                return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+            }
+            catch {
+                // Shell still failed — binary is absent (cmd.exe often exits 1, not ENOENT).
+                return { error: "not-found", message: "" };
+            }
+        }
         if (e.code === "ENOENT") {
             return { error: "not-found", message: "" };
         }

package/dist/verify-env/verify-hooks-installed.d.ts

@@ -5,6 +5,7 @@ export interface EvaluateResult {
     readonly stream: OutputStream;
 }
 export declare const REQUIRED_HOOKS: readonly ["pre-commit", "pre-push"];
+export declare const REQUIRED_HOOK_SUPPORT_FILES: readonly ["_deft-run.sh"];
 /** Substrings each hook must contain when it dispatches through the deft CLI (#2049). */
 export declare const PRE_COMMIT_DEFT_COMMANDS: readonly ["verify:branch", "verify:encoding"];
 export declare const PRE_PUSH_DEFT_COMMANDS: readonly ["preflight-gh"];
@@ -15,6 +16,7 @@ export type GitConfigReader = (projectRoot: string) => {
 export interface EvaluateOptions {
     readonly gitConfigReader?: GitConfigReader;
     readonly platform?: NodeJS.Platform;
+    readonly hookExecutable?: (hookPath: string) => boolean;
 }
 /** Drop shell ``#`` comment lines before pattern scans (#2049 shipped-hook false positives). */
 export declare function stripShellCommentLines(content: string): string;

package/dist/verify-env/verify-hooks-installed.js

@@ -2,6 +2,7 @@ import * as childProcess from "node:child_process";
 import { accessSync, constants, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 export const REQUIRED_HOOKS = ["pre-commit", "pre-push"];
+export const REQUIRED_HOOK_SUPPORT_FILES = ["_deft-run.sh"];
 /** Substrings each hook must contain when it dispatches through the deft CLI (#2049). */
 export const PRE_COMMIT_DEFT_COMMANDS = ["verify:branch", "verify:encoding"];
 export const PRE_PUSH_DEFT_COMMANDS = ["preflight-gh"];
@@ -52,7 +53,7 @@ function isDirectory(path) {
 function isPosix(platform) {
     return platform !== "win32";
 }
-function hookExecutable(hookPath) {
+function defaultHookExecutable(hookPath) {
     try {
         accessSync(hookPath, constants.X_OK);
         return true;
@@ -112,6 +113,7 @@ export function evaluate(projectRoot, options = {}) {
     const root = resolve(projectRoot);
     const gitReader = options.gitConfigReader ?? defaultGitConfigReader;
     const platform = options.platform ?? process.platform;
+    const hookExecutable = options.hookExecutable ?? defaultHookExecutable;
     if (!isDirectory(root)) {
         return {
             code: 2,
@@ -173,29 +175,29 @@ export function evaluate(projectRoot, options = {}) {
             };
         }
     }
+    const contentIssues = [];
+    const missingSupport = REQUIRED_HOOK_SUPPORT_FILES.filter((h) => !isFile(join(hooksDir, h)));
+    if (missingSupport.length > 0) {
+        contentIssues.push(`${hooksDir} is missing ${missingSupport.join(", ")} helper(s); pre-commit/pre-push source them at runtime`);
+    }
     const preCommitIssue = validateHookContent("pre-commit", readHookContent(join(hooksDir, "pre-commit")), PRE_COMMIT_DEFT_COMMANDS);
     if (preCommitIssue) {
-        return {
-            code: 1,
-            message: `❌ deft hooks wired but NON-FUNCTIONAL: ${preCommitIssue} (#2049).\n` +
-                "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
-            stream: "stderr",
-        };
+        contentIssues.push(`${preCommitIssue} (#2049)`);
     }
     const prePushContent = readHookContent(join(hooksDir, "pre-push"));
     const prePushIssue = validateHookContent("pre-push", prePushContent, PRE_PUSH_DEFT_COMMANDS);
     if (prePushIssue) {
-        return {
-            code: 1,
-            message: `❌ deft hooks wired but NON-FUNCTIONAL: ${prePushIssue} (#2049).\n` +
-                "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
-            stream: "stderr",
-        };
+        contentIssues.push(`${prePushIssue} (#2049)`);
     }
     if (prePushContent && prePushInvokesVerifyBranch(prePushContent)) {
+        contentIssues.push("pre-push must not invoke verify:branch (#1814)");
+    }
+    if (contentIssues.length > 0) {
         return {
             code: 1,
-            message: "❌ deft hooks wired but NON-FUNCTIONAL: pre-push must not invoke verify:branch (#1814).\n" +
+            message: "❌ deft hooks wired but NON-FUNCTIONAL:\n" +
+                contentIssues.map((issue) => `  - ${issue.replace(/\r?\n/g, " ")}`).join("\n") +
+                "\n" +
                 "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
             stream: "stderr",
         };
@@ -203,7 +205,7 @@ export function evaluate(projectRoot, options = {}) {
     return {
         code: 0,
         message: `✓ deft hooks installed and functional: core.hooksPath=${hooksPath}, ` +
-            `hooks ${REQUIRED_HOOKS.join(", ")} present and dispatch via deft CLI (#2049).`,
+            `hooks ${REQUIRED_HOOKS.join(", ")} plus ${REQUIRED_HOOK_SUPPORT_FILES.join(", ")} present and dispatch via deft CLI (#2049).`,
         stream: "stdout",
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,6 +38,10 @@
       "types": "./dist/agents-md-advisory/index.d.ts",
       "default": "./dist/agents-md-advisory/index.js"
     },
+    "./eval-health-relocation": {
+      "types": "./dist/eval-health-relocation/index.d.ts",
+      "default": "./dist/eval-health-relocation/index.js"
+    },
     "./xbrief-migrate": {
       "types": "./dist/xbrief-migrate/index.d.ts",
       "default": "./dist/xbrief-migrate/index.js"
@@ -281,8 +285,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.74.0",
-    "@deftai/directive-types": "^0.74.0",
+    "@deftai/directive-content": "^0.75.0",
+    "@deftai/directive-types": "^0.75.0",
     "archiver": "^8.0.0"
   },
   "scripts": {